Ai-Agents

Production auth for an MCP server on Microsoft Graph: browser SSO with a public client and PKCE, delegated tokens, the On-Behalf-Of exchange, and the engineering that keeps an 85-tool surface safe.

One name, two products, two lifecycle stages. Azure AI Content Safety’s Groundedness detection blocks and corrects ungrounded answers at runtime; the Evaluation SDK’s GroundednessEvaluator scores them offline in CI. Here’s the decision boundary for RAG, the without-Foundry path for each, the honest recall numbers, and the open-source substitutes.

Microsoft ships real code for every guardrail layer, but no sample wires them together around one agent. Here’s the reference stack — Presidio for PII, Content Safety for harm categories, NeMo Guardrails for programmable rails, FIDES for deterministic flow control — where each fits in the MAF middleware pipeline, and the licenses.

Prompt Shields is a real input classifier, but it’s probabilistic — and Spotlighting and Groundedness are model-only, so an agent’s tool calls can pass completely unscanned. Here’s what each defense blocks, where the agent coverage gap is, and how to layer probabilistic filters with deterministic controls.

How to see what an AI agent actually did: the OpenTelemetry GenAI span tree, wired into Azure Monitor, from the agent runtime through the APIM AI gateway and across the MCP boundary — with the copy-paste KQL and the gotchas that will cost you an afternoon.

A model can only generate text. The harness is the loop around it that calls tools, manages context, gates actions, and decides when to stop.

How an AI agent reaches Microsoft Graph as the signed-in user through MCP — why token passthrough fails, and how on-behalf-of, Conditional Access, and RBAC secure the chain.

A reference to all 39 evaluators in Azure’s AI Evaluation SDK — quality, RAG, agent, safety, and custom — organized by which ones you can actually import, and which only exist in the cloud catalog.

The first design decision for any Azure AI agent is which identity it uses. A decision matrix across managed identity, Entra Agent ID, on-behalf-of, and service principals.

Microsoft’s Build 2026 announcement, Frontier models and production agents advancing Microsoft Foundry for the agentic era, reframes Foundry from a model catalog into a place you run production agents. The headline that makes it real: hosted agents in Foundry Agent Service are now generally available, and the catalog spans both OpenAI and Anthropic frontier models (1,900+ on Microsoft Learn, not the “11,000” some coverage repeats).

The governance case for keyless Azure: why shared keys are a liability, how managed identity plus RBAC fixes it, and how security, network, and platform teams enforce it.

I used to think the commit was the natural unit of software history. It is clean: a hash, a message, something CI can chew on and a reviewer can revert, cherry-pick, or blame. Then AI coding agents made the gap around the commit impossible to ignore.