From 98e62704dfb0a52e90ae1c2ec2cea9a08fdaee33 Mon Sep 17 00:00:00 2001 From: rkoster Date: Thu, 2 Jul 2026 12:28:26 +0200 Subject: [PATCH 1/2] Add research note: Azure Foundry hosted agents model --- research/azure-hosted-agents.md | 52 +++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 research/azure-hosted-agents.md diff --git a/research/azure-hosted-agents.md b/research/azure-hosted-agents.md new file mode 100644 index 0000000..2809cf2 --- /dev/null +++ b/research/azure-hosted-agents.md @@ -0,0 +1,52 @@ +--- +title: "Azure Foundry — Hosted Agents Model" +author: Ruben Koster (@rkoster) +date: 2026-07-02 +tags: [runtime-lifecycle, sandboxing-isolation, identity, observability-governance, ecosystem-survey] +cf_areas: [diego, capi, uaa] +status: draft +sources: + - https://learn.microsoft.com/en-us/azure/foundry/agents/concepts/hosted-agents +--- + +## Summary + +Azure Foundry's hosted agents model runs agents as containerized workloads with per-session +VM-isolated sandboxes, a persistent filesystem, and scale-to-zero with stateful resume. Each +agent deployment gets a dedicated Microsoft Entra identity. The platform auto-injects +OpenTelemetry traces (see `opentelemetry-genai.md`) and natively supports A2A agent +delegation (see `a2a-protocol.md`), the Responses protocol (OpenAI-compatible), and an +arbitrary-payload Invocations protocol. + +## Key findings + +- **Isolation model**: Per-session VM-isolated sandboxes with a persistent filesystem + (`$HOME` and `/files`). 15-minute idle timeout, 30-day maximum session lifetime. +- **Packaging**: Agents are container images pushed to ACR; the platform pulls, provisions + compute, assigns identity, and exposes an endpoint. +- **Identity**: Each agent deployment gets a dedicated Microsoft Entra ID created + automatically. On-behalf-of (OBO) user identity available via M365 channels. +- **Protocols**: Responses (OpenAI-compatible, platform-managed conversation history), + Invocations (arbitrary JSON, long-running async), and A2A for agent-to-agent delegation. +- **Observability**: Built-in Application Insights; protocol libraries emit OTel traces by + default using the GenAI semantic conventions. +- **Scaling**: Per-session, not per-replica — no replica count to configure; concurrent + sandboxes bounded by active-session quota. + +## CF relevance + +Azure Foundry illustrates what a production-grade PaaS-hosted agent model looks like when +built from scratch with agents as first-class citizens. The container-packaging model +parallels CF's app deployment; the per-session isolation and stateful resume go beyond CF's +stateless process model; and the per-agent identity and auto-injected observability raise +questions about what a platform should provide vs. what each application must wire up itself. + +## Open questions + +- Could a session-scoped state persistence model be layered onto a stateless process model, + or does it require a different lifecycle primitive? +- What would an "agent buildpack" look like — protocol libraries, OTel auto-instrumentation, + identity bootstrap? +- How would A2A endpoints be exposed through a platform's routing layer? +- Is per-session VM isolation necessary, or can process-level isolation suffice for most + agent workloads? From 9ff6f82008dbe641f1eba73f1e9dee6df1b07fb9 Mon Sep 17 00:00:00 2001 From: rkoster Date: Thu, 2 Jul 2026 12:31:29 +0200 Subject: [PATCH 2/2] Fix azure note: remove unsourced OBO identity claim --- research/azure-hosted-agents.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/research/azure-hosted-agents.md b/research/azure-hosted-agents.md index 2809cf2..337d0d5 100644 --- a/research/azure-hosted-agents.md +++ b/research/azure-hosted-agents.md @@ -25,7 +25,7 @@ arbitrary-payload Invocations protocol. - **Packaging**: Agents are container images pushed to ACR; the platform pulls, provisions compute, assigns identity, and exposes an endpoint. - **Identity**: Each agent deployment gets a dedicated Microsoft Entra ID created - automatically. On-behalf-of (OBO) user identity available via M365 channels. + automatically. Agent identity is scoped per deployment, not per session. - **Protocols**: Responses (OpenAI-compatible, platform-managed conversation history), Invocations (arbitrary JSON, long-running async), and A2A for agent-to-agent delegation. - **Observability**: Built-in Application Insights; protocol libraries emit OTel traces by