Weekly AI Roundup: Foundry Models, Agent Deployment and Security

by TechHub

GPT-6.1 Terra is generally available in Microsoft Foundry with text and image inputs and up to one million input tokens, while MAI-Image-2.6 adds generally available multi-reference editing and fal begins rolling out video models in public preview. Foundry's Azure Developer CLI extension reaches general availability at version 1.0, letting developers reuse azure.yaml for local development and CI/CD and deploy source through remote builds without building containers locally. Microsoft Execution Containers and Defender's local AI-agent discovery are now generally available, alongside a report showing an AI agent move from searching GitHub for exposed secrets to exfiltrating Azure Key Vault data in five minutes. Multi-LoRA serving previews let compatible adapters share deployment capacity, and direct SIP support connects Foundry voice agents to existing telephony without a customer-managed audio bridge. The week's deployment and security guidance emphasizes controls outside the model, including pinned serving versions, regression checks, least-privilege tools, and human approval for sensitive actions.

This Week's Overview

Foundry connects agent deployment, hosting, and release checks

Foundry's updates cover both deployment tooling and the controls needed to operate agents after deployment. The Azure Developer CLI extension is generally available, while several hosting and optimization capabilities still carry preview restrictions.

Azure Developer CLI extension reaches version 1.0

The Microsoft Foundry extension bundle for Azure Developer CLI is now generally available at version 1.0. Agent and deployment configuration lives in azure.yaml, so local development and continuous integration and delivery (CI/CD) can reuse the same definition. Deployment uploads source for a remote Foundry build without requiring developers to build a container locally.

The walkthrough requires Azure Developer CLI 1.37.0 or later, a current uv release, and Python 3.13 or later. The Evaluations extension generates datasets and grading rubrics, runs evaluations, and lets teams reuse those checks in CI/CD.

Copilot harness examples clarify execution boundaries

Following last week's Copilot harness preview, a newsroom implementation shows how to separate agent reasoning from external actions. Microsoft Copilot Harness handles research and editing, while Hosted code calls external APIs, validates results, synthesizes audio, and publishes outputs. Completed evidence, scripts, audio, and status are checkpointed in private Blob storage so interrupted tasks can reuse finished work.

The harness provides a managed agent loop and sandbox, but existing agents cannot switch to it after creation in the initial public preview. Foundry's October recap places that preview on October 28, alongside general availability of hosted-agent long-running resilience, which still requires application checkpoints and idempotent handling of external actions. The recap also records Browser Automation's October 19 general availability, using a Toolbox remote Model Context Protocol (MCP) endpoint connected to a separately provisioned Playwright Workspace.

Hosted-agent releases need explicit version control

Foundry's hosted-agent architecture supplies dedicated identities, session sandboxes, immutable versions, private networking, and default OpenTelemetry tracing through hosting protocol libraries. Applications still own authorization, business effects, data handling, and evidence that the complete workflow behaves correctly. Concurrent hosted-session quotas are shared across accounts and projects within a subscription and region, and several covered features remain previews without a service-level agreement or recommendation for production workloads.

Release routing follows the latest version by default, so teams should pin the serving version before creating a release candidate. The endpoint selector serves one version at 100%, while existing sessions remain attached to their original version. Application Insights and OTLP telemetry destinations operate independently, so configuring both sends telemetry to both.

Closed-loop evaluation becomes a release discipline

Agent Optimizer, currently in preview, searches instructions, skills, tool descriptions, and approved model deployments. The proposed workflow converts production traces into versioned datasets with MinHash sampling and private-content redaction enabled by default, then keeps training and validation data separate from a held-out regression suite. Missing evaluation records, failed evaluator jobs, quality regressions, and critical tool failures all block release.

Operational checks matter beyond evaluation scores: hosted-agent optimization requires the Responses protocol and subscription allow-list access, and optimizer evaluations invoke hosted tools for real. Routing rollback does not stop existing candidate sessions, which must drain or be stopped explicitly. A companion reliability checklist adds timeout handling, restricted tool access, human approval for sensitive operations, monitoring, and a rollback strategy.

Agent security pairs containment with evidence from attacks

Microsoft's security reports show why agent permissions and credential handling need enforcement outside the model. New containment and discovery capabilities sit alongside observed attacks that adapt requests and move from exposed secrets to cloud data.

Containment and discovery reach general availability

Microsoft Execution Containers is generally available, enforcing least-privilege boundaries across files, networks, processes, and user interactions. Dynamic Permissions scopes agent authority to the current task, while Dynamic Conditional Access can restrict permissions or require human approval. Microsoft Defender's generally available discovery identifies more than 50 supported local AI agents and their configured MCPs on Windows and macOS.

The accompanying MXC demonstrations show local containment, granular process policy, learn modes, and ways to flag agentic processes. The broader security update also makes the enhanced Defender for SQL Servers agent generally available in Azure Government without requiring Azure Monitor Agent deployment, while Secure Now pairs recent threat information with focused initiatives and recommended actions.

Exposed credentials give agents a short path to cloud data

Microsoft observed an AI agent progress from searching GitHub for client secrets to exfiltrating Azure Key Vault data in five minutes. Since August 2026, threat actors have used an agentic framework to submit large volumes of GitHub queries for secrets. As early as October 28, compromised application credentials enabled service principal sign-ins across multiple tenants, including downstream tenants of vendor-owned applications.

Observed requests showed adaptive troubleshooting: failed calls were followed by changes to API versions or HTTP methods and then successful responses. The immediate response is to revoke or rotate exposed credentials, because removing their public disclosure does not invalidate them.

ARTEX activity targets financial organizations

Cambodia-based Storm-3358 began using ARTEX in October 2026 to target financial organizations, primarily in Southeast Asia. The group exploits anonymous file-upload and server-side request forgery flaws, then deploys WISP, vshell, and AdaptixC2 for persistence and lateral movement. Microsoft provides Defender XDR and Sentinel hunting queries with sample indicators of compromise.

Microsoft's testing found that honeypots, decoys, tarpits, and fake wins reduced attack traffic reaching real assets while producing high-confidence signals. Known threat actor infrastructure also generates high-risk Verified threat actor IP detections in Microsoft Entra ID Protection, giving defenders another signal to investigate.

Tool contracts enforce least privilege outside the model

A Foundry implementation guide places authorization in identity, connection configuration, Azure role-based access control, narrow tool contracts, and runtime policy. Its invoice tool binds the storage account and container server-side and derives user partitions from verified identity, rather than accepting those boundaries from model input. Read, propose, and commit capabilities are separated, with trusted approval and idempotency controls for high-consequence actions.

The Python example uses DefaultAzureCredential locally and explicitly selects ManagedIdentityCredential in Azure-hosted production code. OpenTelemetry records authorization decisions, while negative tests cover unknown agents, incorrect tenants, missing user context, and disallowed actions.

AI-assisted vulnerability discovery raises patching demands

The October 2026 monthly security update addressed more than 1,100 Windows CVEs. Microsoft's MDASH uses multiple AI models and specialized agents to find and validate potential vulnerabilities, with security and engineering teams reviewing findings. Yet August telemetry showed fewer than half of sampled Windows enterprise devices installed the security update within two weeks.

Microsoft exposes vulnerability information through the Security Update Guide, CSAF advisories, VEX documents, and an API. For eligible Windows Server 2025 environments, hotpatching and Azure Update Manager provide options for applying and orchestrating updates.

Foundry expands its text, image, and video model catalog

Foundry's model announcements cover long-context reasoning, image editing, and video generation, with different availability and deployment conditions. Teams need to distinguish generally available models from previews and evaluate regional hosting separately from data-processing terms.

GPT-6.1 Terra reaches general availability

GPT-6.1 Terra is generally available in Microsoft Foundry with text and image inputs and support for up to one million input tokens. It uses the Responses API without new SDK requirements or schema changes. Developer controls include adjustable reasoning effort, a none setting, verbosity adjustment, and interim messages where the orchestration layer supports them.

Global Standard deployments cover all supported regions, while Data Zone Standard deployments are available in the US, EU, and APAC. Global Standard short-context pricing is $1 per million input tokens and $5 per million output tokens.

Kimi K3.1 Pro adds an open-weight long-context option

Moonshot AI's Kimi K3.1 Pro is launching in Foundry with text and image understanding and a context window of up to one million tokens. The open-weight model is the first in the K3.1 series and builds on Kimi K3. Pricing per million tokens is $2.30 for input, $0.23 for cache, and $11.50 for output.

The accompanying guidance recommends testing representative tasks, completed-work quality, long-input reliability, and visual processing. Cost per successful task is a more useful comparison than token prices alone when evaluating these workflows.

Mistral Large 4 preview is planned for European deployment

Microsoft plans to make Mistral Large 4 available in public preview through Foundry in the coming days, rather than reporting it as already available. The planned deployment options are Global Standard and EU DataZone in Sweden Central. According to Mistral, the model was trained in European datacenters and has 1 trillion parameters, with 52 billion active parameters.

Mistral OCR 4 is scheduled to move from preview to general availability on the same day, using OCR 4.1 weights internally. For sensitive agents, the article recommends least-privilege tool access, explicit action boundaries, human approval, and observable execution.

MAI-Image-2.6 supports multi-reference editing

MAI-Image-2.6 and MAI-Image-2.6-Flash are generally available in Foundry. MAI-Image-2.6 supports editing with up to five reference images, while the family offers Bing-backed web grounding, dynamic aspect ratios, and output resolutions up to 1.5K.

MAI-Image-2.6 pricing starts at $5 for text input, $8 for image input, and $38 for image output per million tokens. Flash pricing starts at $1.75, $2.50, and $19 respectively, giving teams a lower-priced option to evaluate for their image workflows.

fal brings US-hosted video models into public preview

Kling, LTX, and MiniMax video models are rolling out in Foundry through fal as a first-party Azure service. The initial public-preview portfolio includes Kling v3 Pro, LTX-2.5 Fast, LTX-2.5 Pro, MiniMax H3 Max, and MiniMax H3 Max Turbo. Both LTX variants support text-to-video and image-to-video generation with synchronized audio, with Fast prioritizing speed and Pro prioritizing quality.

The initial portfolio is US-hosted, and Foundry is the first provider to offer a US-hosted Kling endpoint. Teams should still review each model's documented processing and storage terms rather than treating endpoint location as sufficient evidence of compliance with residency requirements.

ComfyUI workflows call hosted generation APIs

Two custom ComfyUI nodes call Foundry APIs directly, allowing image and video generation workflows to run from CPU-only machines. The example combines hosted models such as MiniMax H3 Max with Foundry's image-generation options. DefaultAzureCredential uses Azure CLI sign-in locally or managed identity on Azure, avoiding API keys.

The calling identity needs the Cognitive Services User or Foundry User role on the Foundry resource. The author's example produced a five-second, 24 fps video in about 80 seconds, an observed run rather than a general latency guarantee.

Foundry fine-tuning adds models and shared adapter serving

Foundry's fine-tuning previews expand the available training targets and introduce shared deployment capacity for compatible adapters. The serving model changes the cost calculation: Managed Compute bills hourly for hardware, including idle time, rather than per-token inference.

More models support managed fine-tuning

Muse-Glimmer-30B, qwen3.8-27b, qwen3.6-35b-a3b, and gpt-oss-120b enter public preview with supervised and reinforcement fine-tuning support. MAI-Code-1.1-Flash becomes the first Microsoft model available for Managed Fine-Tuning on Foundry resources, but supports reinforcement fine-tuning only in this preview. Multi-LoRA Managed Compute allows compatible adapters to share base-model weights and GPU capacity.

Shared deployments support up to eight adapters

The Multi-LoRA deployment preview supports up to eight adapters on a target deployment, sharing its serving capacity without provisioning additional compute or separate adapter pricing. Applications select an adapter by setting the chat-completions request's model value to its deployment name. Each adapter must match the target's base model and version.

Deployment requires a compatible LoRA-enabled template and accelerator quota. The preview accepts Foundry fine-tuning outputs, not externally trained adapters, so compatibility needs to be checked before planning a shared deployment.

Decision APIs make bounded judgments explicit

Decision-oriented workflows return probabilities, choices, or scores instead of relying on free-form answers. This week's coverage combines a generally available Azure OpenAI API with Microsoft-Decision-1 examples that emphasize evidence quality and the limits of small experiments.

Azure OpenAI Decisions API is generally available

The Azure OpenAI Decisions API became generally available in Microsoft Foundry on October 22, 2026. It evaluates text, images, and structured inputs, returning probabilities, selections from predefined options, or scores against defined rubrics. The /openai/v1/decisions endpoint runs on an Azure OpenAI resource and supports GPT-6 Luna.

Developers can use OpenAI SDKs or REST, authenticating with an API key or Microsoft Entra ID. GPT-6 Luna pricing per million tokens is $0.10 for input, $0.01 for cached input, and $0.125 for 30-minute cached writes.

Package-upgrade advice separates evidence gathering from judgment

A package-upgrade tutorial combines a GPT-4.1 Foundry agent and Grounding with Bing Custom Search to retrieve trusted package information, then uses Microsoft-Decision-1 to assess upgrade necessity, reason, and urgency. The example checks Django 4.2.0 against official security advisories and asks the agent to identify fixed versions. When the decision model selects insufficient evidence, the application recommends gathering more evidence instead of treating an urgency score as actionable.

Next-best-action experiments distinguish selection from planning

A Microsoft Agent Framework example compares three approaches using isolated copies of the same synthetic evidence retrieved from Azure AI Search. Microsoft-Decision-1 calls POST /providers/microsoft/v1/systemone to return selected actions and scores without written rationales. In the contextual scenario, both models ranked Summit first, while the fixed rules formula ranked Apex first.

Tool-assisted GPT-4o produced a validated rollout plan costing $23,200, leaving $300 after earlier incorrect costs were rejected. Those results, latency figures, and token costs are single-run observations on authored synthetic cases, not general benchmarks or evidence of sales outcomes.

Work IQ routing results need benchmark context

In a 13-question experiment, Jev routing answered first on 12 questions, with a 5.6-second median compared with 22.3 seconds for Work IQ ask. On a separate 134-question routing set, Jev scored 131, while Microsoft-Decision-1 and OpenAI's Decisions API each scored 128. Fine-tuning Laya for three epochs took 17 minutes on one A100 and raised its score from 53 to 110.

The benchmark wording was refined against Jev, so the revised set was not a true held-out test. Microsoft-Decision-1 timings measured individual API calls rather than complete routing plans, and its end-to-end Work IQ races had not been rerun.

Voice agents connect to telephony and personalized interfaces

Foundry's voice coverage addresses two different integration tasks: connecting existing phone infrastructure and assembling a personalized conversational interface. The telephony update removes an intermediary component, while the portal workflow reduces application setup for prepared voice and avatar assets.

Direct SIP connects existing telephony infrastructure

Microsoft Foundry voice agents and Voice Live API now support SIP connections through existing telephony infrastructure. Direct SIP removes the need for a customer-managed intermediary audio bridge using WebSocket or WebRTC.

Inbound calls require a SIP connection bound to a voice agent, with provider routing configured using the SIP binding URL. Outbound calls require no binding: developers configure the SIP connection through the SDK or REST API when placing the call.

Voice Agent combines knowledge, voice, and an avatar

Voice Agent combines a Foundry IQ knowledge base, Personal Voice, and a custom photo avatar in a real-time conversation. Prepared assets can be connected through four portal steps without local SDK setup or speech, avatar, or application code. Knowledge documents can be refreshed without recreating the voice or avatar, and assets can be reused across agents.

Personal Voice requires a voice sample and recorded consent statement, while custom photo avatars require an authorized photo and consent video. Eligibility requirements apply, and available models, regions, and preview features vary.

Retrieval and memory need relevance, authorization, and lifecycle controls

Retrieval quality depends on more than finding semantically similar text. The week's guidance connects reranking with authoritative document state, authorized memory access, and deletion that actually prevents future retrieval.

Cohere Rerank V5 adds passage-focused retrieval

Cohere Rerank V5 is available in Foundry for enterprise search and retrieval-augmented generation, where retrieved material supplies context to a model. Context Focus returns relevant passages from reranked documents, potentially reducing token consumption and latency. Fast targets low latency and high throughput, while Pro prioritizes retrieval quality for complex queries and specialized documents.

Calibrated relevance scores remain stable across runs, helping developers set thresholds that filter less relevant results. The model supports multilingual retrieval across domains including finance, healthcare, and manufacturing.

Agent memory requires separate read and write gates

The memory architecture separates Remember, Retrieve, Revalidate, and Forget across agents, application policy, memory services, and authoritative systems. Durable writes pass through policy gates rather than persisting arbitrary model output, and authorization constrains retrieval candidates before semantic or hybrid ranking. Time-to-live controls storage or retrieval lifetime, not whether a stored value remains correct.

Foundry Agent Service supports profile, chat-summary, and procedural memory, but its current Memory preview documentation states that memory stores do not support VNet integration. The governed design derives scope from authenticated, tenant-qualified identity and recommends keeping production writes disabled until staging verifies isolation, prohibited-data rejection, deletion, trace redaction, and rollback. Deletion must disable retrieval, propagate across derived data, retry idempotently, and produce audit evidence of completion.

Document updates need deterministic lifecycle workers

A self-updating retrieval architecture uses Azure Cosmos DB as the authoritative lifecycle metadata store and Azure AI Search as the retrieval index. Conditional version updates prevent delayed ingestion jobs from activating older versions, while logical deletion blocks retrieval before workers physically remove indexed chunks. A transactional outbox coordinates lifecycle changes with reliable publication of background jobs.

Microsoft Agent Framework handles reasoning and tool-based queries, while conventional workers perform deterministic document lifecycle operations. That separation keeps document activation and deletion governed by explicit state transitions rather than model decisions.

Agent skills move guidance closer to development tools

Installable skills package development guidance for agents, but they do not replace runtime dependencies or authorization. Updates across Agent Framework, NuGet, and Azure plugins show different ways to distribute that guidance and keep it aligned with a project.

Agent Framework adds .NET and Python builder skills

Microsoft's Agent Framework builder skills provide development-time guidance for .NET and Python rather than application runtime capabilities. Developers can install them through GitHub CLI or the cross-agent skills CLI, pinning tags or commits for reproducible guidance snapshots. Microsoft Learn MCP supplies complete framework documentation and code examples through a Streamable HTTP endpoint.

The .NET skill covers AIAgent, Microsoft.Extensions.AI, NuGet, dependency injection, and ASP.NET Core hosting. Applications still need SDK packages and model credentials, and optional Azure operations require their own credentials and permissions.

NuGet packages can carry agent skills

NuGet-delivered skills use SKILL.md, combining Markdown with a YAML header. dotnet restore downloads bundled skills alongside binaries, project.assets.json lists the files, and dotnet-inspect discovers them. dotnet-package-skills can copy skills into repositories for persistent availability.

NuGet MCP does not yet support skills, although support is planned. The team recommends evaluation with frontier models and warns that agents consuming package Markdown introduce a new threat vector.

Azure plugins specialize troubleshooting and knowledge access

The Azure plugin catalog includes six specialized plugins alongside the core Azure plugin. Cost analysis has moved out of the core plugin into Azure Cost, which users must install to retain that capability. AKS Skills begins with evidence collection and requires explicit approval for resource changes and packet captures, while Foundry IQ Skills manages and queries knowledge bases through Azure AI Search.

Users can install the plugins from the microsoft/azure-skills marketplace in GitHub Copilot CLI, Claude Code, or Cursor. The split makes plugin selection an explicit setup step rather than assuming the core plugin contains every workflow.

Coding-agent model access spans gateways and local inference

Two implementations address where coding-agent requests run and how they authenticate. One routes requests through an Azure gateway, while the other requires enough local GPU capacity to host the model.

Claude Code gateway design separates identity from backend access

CCOF is the author's implementation, not a Microsoft product, and routes Claude Code requests through Azure API Management to Foundry. The gateway validates tenant, audience, client application, and delegated scope, while managed identities authenticate backend calls. Its staged deployment ends with authentication, model-permission, and accounting tests.

The implementation remains single-region across API Management and Function Apps, and Foundry accounts in the same subscription share model quota pools. Displayed spend is a lower bound rather than an invoice cap because reconciliation is delayed and some token categories remain unknown.

Foundry Local connects an on-device model to Copilot

The local coding setup requires Foundry Local CLI 0.13.0 or later and an NVIDIA GPU with at least 24 GB of VRAM. Four-bit quantization reduces Qwen3.8-27B to approximately 18 GB, while Foundry Local uses ONNX Runtime with speculative decoding, cache optimizations, continuous batching, and CPU offloading.

CUDA and compatible cuDNN runtimes must be installed separately because Foundry Local does not download them. The example connects GitHub Copilot through Bring Your Own Key and a local API endpoint.

AI-assisted software delivery needs review and observable execution

The software-delivery examples pair agent-generated changes with human gates, replay tests, and inspection of agent behavior. They also show why a working output alone does not establish that the process was safe or efficient.

Levi Strauss coordinates specialized development agents

Levi Strauss & Co. built a software development lifecycle on GitHub Copilot's custom agents platform using 17 specialized agents. They cover requirements, specifications, testing, security scanning, accessibility validation, and deployment, with MCP connections to Jira, Confluence, and New Relic. Each pull request receives review from 5 to 11 independent agents that can fix issues and commit changes, while strict human approval gates remain in place.

Copilot Cowork migration combines generated changes with replay tests

Nine engineers merged 1,211 pull requests into the Copilot Cowork backend main branch on October 21. About 430 generated fixtures captured Python behavior for exact replay in Rust tests, and critical changes required at least one human check in addition to agentic review. First-turn median time to first token fell from 7.9 to 2.7 seconds, with moving the agent loop also contributing.

The agent container holds no user credentials. A trusted host controls identity, policy, approvals, tool execution, and audit, keeping those responsibilities outside agent-generated code.

Agent trajectories expose problems hidden by working scripts

Five GitHub Copilot Chat runs using Claude Sonnet 5.5 without extensions produced working CI scripts, but their trajectories exposed 15 problems. Each run took 29 to 39 requests and consumed up to 1.2 million tokens, and all five read Dev Proxy's plugin DLL as raw bytes to discover class names. Three scripts would reroute all Windows CI runner traffic through Dev Proxy and skip proxy cleanup in their kill fallback.

The author recommends fixing product interfaces and documentation before adding agent skills. Comparing task quality and cost before and after those fixes can reveal whether the underlying tooling has become easier for agents to use correctly.

Azure operational agents start with evidence and bounded permissions

Operational agent examples focus on inspecting pipeline evidence, server telemetry, and cloud spending. Their shared constraint is that investigation access does not automatically authorize infrastructure changes or establish production readiness.

An MCP layer exposes image-pipeline evidence

A Python MCP server exposes four tools for listing Azure DevOps runs, inspecting status, checking release evidence, and optionally queueing a pipeline. Queueing is disabled by default and requires explicit confirmation and allow-listed parameters when enabled. The evidence tool checks build-summary, image-validation, security-scan, and promotion-record artifacts.

Visual Studio Code starts the local server through workspace MCP configuration and exposes its tools in Copilot Chat. Azure DevOps approvals and permissions remain authoritative, with separate read and queue permissions recommended for production.

Reader-only IIS investigation depends on collected telemetry

A reader-only Azure SRE Agent can investigate Azure control-plane signals and collected Log Analytics data without running guest commands or changing the server. The starter collection rule gathers IIS logs, selected Windows events, configuration and file-audit events, and eight performance counters. The guide recommends 60-second counter sampling and narrowly scoped file auditing to control ingestion volume.

IIS configuration Event 29 records changes through management tools, while file-audit Event 4663 identifies accounts, processes, and files involved in direct edits. The supplied triage skill requires the agent to verify telemetry availability, cite timestamped evidence, and recommend actions for operators.

Cloud-spend investigation distinguishes snapshots from live billing

An Azure SRE Agent prototype combines Azure Cost Management billing data, Azure Resource Graph inventory, and Azure Advisor recommendations. It requires Cost Management Reader and Reader permissions on target subscriptions, with billing or commitment access checked separately. Opening the report displays its latest refreshed snapshot, while direct billing updates require a supported connector.

Current-month projections are not completed-month actuals, and newly billed resources are not necessarily newly created resources. Scheduled reports and alerts require separate configuration and supported capabilities, and the prototype does not establish production readiness or measured savings.

Copilot Studio separates runtime choices from authorization and evaluation

Copilot Studio guidance distinguishes the agent runtime, the application interface, and the data permissions behind both. Its examples reinforce that previews, warnings, and approval pilots should not be mistaken for production certification.

Harness selection is separate from interface design

The GitHub Copilot harness discussed in Copilot Studio is an orchestration runtime, not the GitHub Copilot service or coding assistant. App authoring provides an interactive preview and access to underlying code, but Apps in Copilot Studio remains a preview with potentially restricted functionality and is not intended for production use. Sharing an app does not automatically grant access to organizational data, and sensitive operations require backend or data-source authorization.

Sapan Patel's STAR mnemonic, which is not an official Microsoft framework, separates runtime harnesses from application interfaces and voice channels. It describes the Standard harness in terms of defined topics, instructions, conditions, and conversational paths, and identifies SharePoint Framework as an option for custom interfaces. A short roundup separately introduces the Conversation Harness for customer-facing agents.

Multi-agent handoffs preserve context and escalation evidence

A Copilot Studio architecture guide separates a front-door supervisor from specialized workers with bounded responsibilities. Delegation options include direct tool invocation, Bot Framework Skills, and asynchronous orchestration through Dataverse. Mapping supervisor variables into worker inputs preserves identity, intent, and extracted entities across handoffs.

Human escalations should include transcripts, attempted diagnostic steps, and error codes. The guide recommends separate Power Platform environments, input sanitization, and Dataverse logs for delegation timestamps, latency, and token consumption.

Approval-expiry testing demonstrates only bounded outcomes

An MCP approval pilot using Microsoft Entra delegated identity and federated connector authentication confirmed zero target writes for a denied proposal and no execution for an expired proposal. An expiry-related correction passed the same 89-test suite locally and on Azure Linux, but approved execution and replay remain unqualified, both identities are operated by one person, and benefit over native controls remains unmeasured.

Evaluation warnings flag missing or outdated tests

Agent status evaluation warnings have been generally available since October 15, 2026. The Review panel flags agents that have never been evaluated or whose underlying model has changed since their latest evaluation, but warnings do not block publishing, run tests automatically, or certify production readiness.

Fabric connects agent access, dashboard generation, and capacity controls

Fabric's updates cover how agents discover governed data, how Copilot generates dashboards, and where eligible Copilot usage is billed. These are separate operational choices: data access, generated-query validation, and capacity assignment each need their own checks.

OneLake adds remote MCP access and endpoint discovery

OneLake now offers a remotely hosted MCP server in preview while retaining the local option. Fabric Core MCP includes tools for managing shortcuts and OneLake security, and a preview endpoint discovery API returns query engines, skills, MCP servers, and endpoints for Fabric items. GitHub Copilot uses discovery to select engine-specific querying tools and run Spark analysis.

Shortcuts query external data without copying it. Shortcut transforms serve a different purpose, converting files into tables and maintaining those tables as files change.

External-data integration distinguishes access from replication

Fabric shortcuts expose externally stored data without moving it, while pipelines handle explicit movement, multi-step orchestration, and complex transformations. Snowflake managed tables and views can be replicated into OneLake, whereas Iceberg integration can use metadata mirroring and shortcuts to access existing table data. Azure Databricks catalog mirroring exposes Unity Catalog structure and accesses underlying data through shortcuts rather than replication.

Open Mirroring accepts changes in a landing zone, after which Fabric converts and manages them as Delta tables. Fabric data agents can then connect to Copilot Studio or serve as tools for Foundry agents accessing governed enterprise data.

Copilot generates editable Real-Time Dashboards

In preview, users can select an Eventhouse database, choose Generate with Copilot, describe their goals, and refine a dashboard plan through follow-up messages. Generated dashboards remain editable, including visual types and the queries behind individual tiles. The stadium example compares transit demand with gate entries and queue lengths, while the guidance recommends verifying queries, relationships, and measure meanings before operational use.

Eligible Copilot usage can use a separate capacity

Organizations can assign users or groups to a designated Fabric capacity so eligible Copilot usage is billed separately from workspace workloads. F2 is the minimum SKU, but sizing depends on observed usage. The lab kept an Adventure Works workspace on F16 and recorded eight successful operations on the separate F2 Copilot capacity.

Industrial-edge agents retain a local execution path

An industrial-edge architecture routes cloud-connected devices directly to Azure IoT Hub and on-site devices through Azure IoT Operations on Kubernetes, with Foundry Local running AI workloads on premises. Data from both paths lands in Microsoft Fabric, while Azure Resource Manager manages the architecture.

The on-site operational technology virtual coworker continues working when the cloud connection drops. An enterprise virtual coworker in Foundry or Fabric reaches workers through Teams and Dynamics, separating local continuity from cloud-based interaction.

Other Artificial Intelligence News

The free, public, read-only pghacker-mcp server exposes 17 tools connecting PostgreSQL source history with mailing-list discussions, backed by 58,734 processed threads and 105,000 commits stored as 24 million line versions. The author reports a 50-millisecond historical search for fsync_fname and matching GNU grep output across 7,254 replayed commands, results specific to the described Azure HorizonDB deployment.

The Logic Apps newsletter covers a public-preview Azure CLI extension for local Standard project development and diagnostics. It also describes orchestrating Foundry Prompt Agents and Hosted Agents with branching, retries, timeouts, parallel execution, and run history, plus a community example exposing workflows through OpenAPI tools with managed identity and Microsoft Entra authorization.

Microsoft's October AI video overview collects model, agent-tooling, GitHub Copilot, and infrastructure announcements. Its coverage includes GPT-6.1 Terra, MAI-Image-2.6, multi-LoRA adapters, SIP telephony, Copilot Fusion, session continuity, and Azure API Management A365 integration.

Also relevant this week