Azure

Production auth for an MCP server on Microsoft Graph: browser SSO with a public client and PKCE, delegated tokens, the On-Behalf-Of exchange, and the engineering that keeps an 85-tool surface safe.

One name, two products, two lifecycle stages. Azure AI Content Safety’s Groundedness detection blocks and corrects ungrounded answers at runtime; the Evaluation SDK’s GroundednessEvaluator scores them offline in CI. Here’s the decision boundary for RAG, the without-Foundry path for each, the honest recall numbers, and the open-source substitutes.

Microsoft ships real code for every guardrail layer, but no sample wires them together around one agent. Here’s the reference stack — Presidio for PII, Content Safety for harm categories, NeMo Guardrails for programmable rails, FIDES for deterministic flow control — where each fits in the MAF middleware pipeline, and the licenses.

Prompt Shields is a real input classifier, but it’s probabilistic — and Spotlighting and Groundedness are model-only, so an agent’s tool calls can pass completely unscanned. Here’s what each defense blocks, where the agent coverage gap is, and how to layer probabilistic filters with deterministic controls.

The levers that actually move an Azure OpenAI bill — model tier, the four caches, output discipline, batching — in order of impact.

How to see what an AI agent actually did: the OpenTelemetry GenAI span tree, wired into Azure Monitor, from the agent runtime through the APIM AI gateway and across the MCP boundary — with the copy-paste KQL and the gotchas that will cost you an afternoon.

How an AI agent reaches Microsoft Graph as the signed-in user through MCP — why token passthrough fails, and how on-behalf-of, Conditional Access, and RBAC secure the chain.

A reference to all 39 evaluators in Azure’s AI Evaluation SDK — quality, RAG, agent, safety, and custom — organized by which ones you can actually import, and which only exist in the cloud catalog.

Satya Nadella just named something every architect should pin to the wall. Kenneth Arrow’s old information paradox said a seller can’t prove information’s worth without revealing it: disclose, and you’ve given it away. AI inverts it: now the buyer leaks. To get real value from a model you feed it your proprietary context, and the vendor learns more about you than you learn from it.

The first design decision for any Azure AI agent is which identity it uses. A decision matrix across managed identity, Entra Agent ID, on-behalf-of, and service principals.

The exact RBAC role, disable-local-auth switch, and DefaultAzureCredential snippet for every Azure hop an agent uses — OpenAI, AI Search, Cosmos, SQL, Blob, Key Vault, and more.

Microsoft’s Build 2026 announcement, Frontier models and production agents advancing Microsoft Foundry for the agentic era, reframes Foundry from a model catalog into a place you run production agents. The headline that makes it real: hosted agents in Foundry Agent Service are now generally available, and the catalog spans both OpenAI and Anthropic frontier models (1,900+ on Microsoft Learn, not the “11,000” some coverage repeats).