Microsoft’s Build 2026 announcement, Frontier models and production agents advancing Microsoft Foundry for the agentic era, reframes Foundry from a model catalog into a place you run production agents. The headline that makes it real: hosted agents in Foundry Agent Service are now generally available, and the catalog spans both OpenAI and Anthropic frontier models (1,900+ on Microsoft Learn, not the “11,000” some coverage repeats).
So it is GA. GA of what, exactly, and what should an enterprise architect actually do with it? This is the take, not a feature recap: the pro, the con, and where I would draw the line.
What’s genuinely better, and it’s the governance, not the models#
The advance that matters is that agent identity is finally first-class. Entra Agent ID gives each agent a real identity instead of a shared service principal:
- Blueprints: apply Conditional Access and permissions once, inherit them across every instance.
- A mandatory human sponsor accountable for the agent’s lifecycle and access reviews.
- Per-agent RBAC that scopes down to a single agent.
- On-behalf-of so an agent can act inside the requesting user’s own access.
If you have watched non-human identities sprawl into ungoverned secrets, this is the first credible answer: you govern agents with the same primitives you already use for people.
The Agent Control Specification (ACS) is the other piece worth adopting. It is MIT-licensed, framework-agnostic, and enforces deterministic, fail-closed policy at defined checkpoints across an agent’s lifecycle, with adapters spanning LangChain, AutoGen, Semantic Kernel, and the OpenAI and Claude SDKs. Policies are portable YAML, so you enforce the same contract whether or not the agent runs on Foundry. That is the opposite of lock-in, and it pairs with ASSERT, which turns written policy into executable evals.
The runtime is credible too: per-session VM-isolated sandboxes, immutable agent versions with canary rollout, OpenTelemetry tracing on by default, and scale-to-zero when idle. For bursty workloads that is a real cost win over an always-on AKS cluster.
So does it help you govern agents? At the identity and policy layer, genuinely yes, and those are the parts you can adopt without betting the stack on one runtime.
The proven cons, where an architect earns their keep#
- No SLA, even at GA. Microsoft states plainly that Agent Service has no availability or state-durability SLA, and there is no automatic failover or disaster recovery. Multi-region resilience is your architecture to build.
- The tooling you’d actually govern with is still preview. Rubric evaluator, Guided Guardrail Setup, Memory, the Foundry IQ portal, Conditional Access for agents, and ACS itself are public preview: no SLA, “not recommended for production.” Agent Optimizer and Agent ROI are only now reaching preview. The runtime shipped GA; the machinery to prove and audit it lags a release behind.
- Conditional Access for agent identities is block-only. Agent identities get allow/deny, not the MFA, device-compliance, and session controls humans get. Your adaptive-access story for autonomous agents is thinner than the marketing implies.
- Governance stops at the Microsoft boundary. Entra Agent ID governs agents inside Microsoft environments; real estates span AWS, GCP, Bedrock, GitHub, and Slack. Entro’s Itzik Alvas warns this risks recreating the “vault sprawl” the secrets-management world already lived through.
- Stack sprawl. Forbes analyst Janakiram MSV reports that Microsoft’s own IT needed three platforms to build a single internal agent, across too many overlapping entry points (Agent Framework, Copilot Studio, Agent Service, the M365 Agents SDK, Azure OpenAI, Agent 365).
- Vendor claims are unverified. Every performance figure is Microsoft’s own: the procedural-memory gain is ~5% on its own benchmarks, and the “10x cheaper than GPT-5.5” Frontier Tuning line rests on a single internal example. No independent benchmarking exists yet.
- Watch the bill’s edges. Enabling network isolation silently provisions a billed Azure Firewall; PTU savings only hold at steady token volume; and the ecosystem is five weeks old, so there are no long-haul production post-mortems to lean on. The GA cutover already deprecated the preview
azure-ai-agentsSDK out from under early adopters.
Bottom line#
- Adopt now: Entra Agent ID and ACS. They are the durable, portable parts, and they genuinely move agent governance forward.
- Pilot, don’t commit: wire the hosted runtime to non-critical workloads to build muscle.
- Not yet: SLA-bound agents. Design your own HA/DR and treat every benchmark as vendor-reported until someone independent runs it.
This is the right direction with the governance layer still assembling, which is exactly the moment to design against it, not to bet production on it.