Microsoft Foundry Agents in Practice: Identity, Boundaries, Guardrails, Traces, Bills

Day two on Microsoft Foundry. Every agent gets an Entra identity and can act on behalf of a user — decide when it should. Standard setup pulls conversation state into your own storage, search and Cosmos DB, and network injection is a one-way door. Guardrails scan four intervention points including tool responses for cross-prompt injection, and they are one layer, not the defence. Then traces into Application Insights, version rollback, and the two shapes of a Foundry agent bill.

Content current as of 2026-09.

Lessons

1. Whose authority is the agent acting with?
2. Network and data boundaries: what Standard setup actually buys you
3. Guardrails, Prompt Shields and the tool-response scan
4. Traces, evaluations and the version you can roll back to
5. What it costs and what will bite you