Build Agents with Foundry Agent Service

• Prompt agents are configuration-only with no compute to manage; hosted agents are your container run by Foundry
• Agents are immutable versions addressed by name and version, referenced at inference by agent_reference
• Conversations replaced the thread-and-run pair, and items are appended automatically as responses generate
• A conversation longer than the model's context window is silently truncated on input, not rejected
• Hosted agents get one VM-isolated sandbox per session whose filesystem survives idle deprovisioning
• The model picks a tool and fills its arguments from the tool name, description, and parameter schema, so wrong-tool and bad-argument failures are fixed in the tool definition
• Memory, a knowledge base, and file search answer three different grounding needs
• A Foundry IQ knowledge base plans subqueries, enforces permissions, and returns cited grounding to the agent
• An indexed knowledge source ingests content into Azure AI Search; a remote one is queried live and never ingested
• The memory search tool resolves scope automatically only with the userId token; the low-level APIs demand an explicit scope
• An OpenAPI tool injects a stored key only when the spec declares a security scheme, not a header parameter
• OpenAPI tools authenticate anonymously, by API key through a connection, or with managed identity
• The Azure Functions tool is executed by the service; a plain function tool is executed by your process
• Code Interpreter runs model-written Python in a sandbox, and the custom variant adds your packages and environment
• Browser Automation and Computer Use drive user interfaces when a target system exposes no API
• Multi-step web research is a model choice - the o3-deep-research model plus the web search tool - not the separate Deep Research tool, which is deprecated
• require_approval defaults to always and accepts a per-tool object for selective gating
• An approved MCP call resumes only when you post an mcp_approval_response tied to the original response id
• Omitting allowed_tools exposes every tool the MCP server publishes to the agent
• A Foundry Toolbox exposes a curated tool bundle as one MCP endpoint with central auth and promotable versions
• Agent Service accepts only remote MCP endpoints, and non-streaming MCP calls time out at 100 seconds
• The classic Connected Agents tool is gone; agent-to-agent delegation now runs through A2A or a workflow
• With the A2A tool the calling agent summarizes the remote answer and keeps the user session
• Making a Foundry agent callable by others means enabling its incoming A2A endpoint or registering it in the control plane
• Each hosted agent gets its own Entra identity, so downstream RBAC and audit attribute to the agent
• One agent with several tools is the documented default; a multi-agent split has to be justified by a boundary, never by task count
• Intent Resolution, Task Adherence, and Tool Call Accuracy each isolate a distinct agent failure mode
• Tool Selection, Tool Input Accuracy, Tool Output Utilization, and Tool Call Success split tool behavior into four testable stages
• Continuous evaluation scores production traffic at a configured sampling percent and hourly request cap
• Prohibited Actions and Sensitive Data Leakage measure agent-specific risk that content-category evaluators miss
• Production traces convert into evaluation datasets, and cluster analysis groups failures into patterns
• A multi-agent solution is scored once over the whole interaction — on the orchestrator or final agent — because per-agent scores can all pass while the combined journey contradicts itself

Unlock with Premium — includes all practice exams and the complete study guide.