Sign in
← AI PulseSep 22, 2026

Wire · news · Single-source brief

Foundry Hosted Agent Isolation with Microsoft Agent Framework

Microsoft's Agent Framework introduces Foundry hosted agent isolation, offering independent controls for user data access and the persistence of code and files.

By Illumora Editorial

Source · Sep 22, 2026, 10:14 AM · On Illumora · Sep 22, 2026, 10:17 AM

Media from the primary source — shown here so you can stay on Illumora.

Rewritten from one allowlisted primary — not independent enterprise reporting. Lanes →

Brief drafted by Illumora’s editorial model from the linked primary source. Ops desk reviews flagged pieces. How we write →

Read the source →Microsoft Semantic Kernel Blog — Foundry hosted agent isolation with Microsoft Agent Framework | Microsoft Agent Framework
Save

Microsoft's Agent Framework now includes Foundry hosted agent isolation, which provides two distinct controls: user isolation and Foundry hosted session isolation. User isolation determines whose data an agent can use, while Foundry hosted session isolation specifies where code and files reside.

Foundry can resolve the values for these controls, or an application can provide them. This flexibility supports various scenarios, including direct callers, trusted middle tiers, application-managed sessions, and shared session pools.

Key Points

  • Foundry hosted agent isolation offers two independent controls: user isolation and session isolation.
  • User isolation identifies the data that an agent may use.
  • Foundry hosted session isolation identifies where code and files persist.
  • Foundry can resolve control values, or applications can provide them.
  • A Foundry hosted session provides sandbox compute and persisted files, distinct from a conversation's message and tool-call history.
  • For direct access, Foundry resolves the user from the caller’s Microsoft Entra token.
  • Applications can send a stable delegated identity on each request via a trusted middle tier.

Context

According to Microsoft, the delegated identity is independent of the Foundry hosted session ID. This allows separate user conversations to utilize distinct sandboxes or share a sandbox selected by the middle tier. The delegated identity value is opaque to Agent Framework, with the trusted middle tier managing the mapping between its authenticated application user and that value.

Why It Matters

This isolation mechanism provides developers with granular control over data access and session management within the Microsoft Agent Framework. It enables more secure and flexible agent deployments, particularly in multi-user or multi-tenant environments, by separating user data from computational resources.

What To Do

  • Review the Microsoft Agent Framework documentation on user isolation and Foundry hosted sessions.
  • Examine the provided .NET and Python code samples for implementing delegated identities and session management.
  • Consider how to integrate application-provided session IDs for explicit lifecycle management or stable workload placement.
  • Note how to use both agent_session_id and user identity for partitioning application-owned files, database rows, and caches in pooled designs.

Keep Exploring

/atlas/claude-family /atlas/gpt-family /atlas/**gemini**-family