Over the last ten months Microsoft has shipped most of the scaffolding that agent projects used to have to build for themselves. It is worth being precise about what landed, because the useful conclusion is not the one the announcements invite.
What actually shipped
At Ignite in November 2025, Azure AI Foundry became Microsoft Foundry, and was repositioned from an Azure service into a platform pillar alongside Microsoft 365 and Fabric. That was a naming change with an intent behind it: agents were being moved from something you assemble to something the platform hosts.
The substance followed at Build in June 2026.
- Foundry IQ reached general availability — knowledge bases behind a single retrieval endpoint, spanning Work IQ, Fabric IQ, Azure SQL, file search and MCP sources, with an SLA attached. This is the part that replaces a hand-rolled retrieval pipeline.
- Hosted agents in Foundry Agent Service, generally available since July 2026 — a managed runtime with per-session sandboxing, persistent state and filesystem access, and no requirement to use Microsoft's own framework.
- Publishing into Teams and Microsoft 365 Copilot, so an agent reaches the applications people already have open rather than a portal nobody visits.
- Memory — procedural, user and session — in public preview, alongside toolboxes and tool search.
- Evaluation and governance tooling: a rubric evaluator, tracing and evaluations that work across frameworks, guided guardrail setup, and ASSERT, an open-source project that turns written policy into measurable tests.
Separately, Agent 365 went generally available on 1 May 2026 as a control plane: a registry of every agent running in the organisation, Microsoft's and otherwise, with identity through Entra Agent ID and lifecycle governance applied the way it is applied to staff. It will also inventory agents running on Amazon Bedrock and Google Vertex AI, which is a more honest reading of how enterprises actually buy than most vendor roadmaps manage.
On the Dynamics side, Business Central now ships agents in the box — sales order, payables, expense — and Microsoft has published an MCP server for it, so an external client can read, and with permission write, ERP data directly.
What that changes
It changes the cost of the build. Retrieval, hosting, memory, tracing and the deployment surface were each a small project a year ago, and each one was a place where a promising prototype quietly died. Most of that is now a configuration decision rather than an engineering one.
It also changes who can start. A team that could not previously have stood up a production retrieval layer can now reach one through a managed endpoint, which is genuinely good and will produce a great deal of work that should never have been started.
What it does not change
We ask four questions before enabling Copilot on a client's estate. Nothing announced this year answers any of them.
What is it grounded in, and who approved that list? Foundry IQ makes it straightforward to point an agent at Work IQ, a Fabric ontology, a SQL estate and a document store at once. It does not tell you whether the person whose data that is agreed to it, or whether the permissions that governed those sources in their original systems survive the journey into a knowledge base. That is a decision with a named owner, or it is an incident waiting for a date.
What must it never surface? Guardrail tooling has improved sharply, and a questionnaire that recommends PII filters and jailbreak protection is a real improvement on nothing. But the list of things a given business cannot afford to have said out loud is specific to that business, and no default produces it. ASSERT is the most interesting thing in the Build release precisely because it assumes someone has written the policy down first.
How will you know it is working? A rubric evaluator will generate criteria. It will not tell you the baseline you are measured against, and a score with no baseline is a number, not evidence. We evaluate agentic systems on four axes — trajectory, grounding, user experience and safety — because a single accuracy figure hides the failure modes that actually reach customers.
What happens when it is confidently wrong? Still a process question. Still unanswered by any product.
Where the work has moved
Three places, in our experience of the last few months.
Into the registry. Agent 365 will show you every agent in the estate, which is the first time most organisations will see that number. It is usually higher than expected and the ownership is usually unclear. Treating that inventory as a governance programme rather than a dashboard is the difference between control and a list.
Into the data underneath. None of this touches the oldest problem. When an agent gives a confidently wrong answer about a customer balance, the cause is almost never the model. It is that finance and the CRM disagree, and have for two years, and nobody had to reconcile them before because no system was asked to speak with one voice. A knowledge base with an SLA in front of contradictory sources returns contradictions faster.
Into deciding what not to build. When the build is cheap, the discipline has to come from somewhere else. The question worth asking of any agent proposal is what it replaces and what it costs when it is wrong — and that question gets easier to skip the easier the tooling gets.
One practical caution
A good deal of the above is in preview, not general availability. Memory, toolboxes, the rubric evaluator, cross-framework tracing and Foundry IQ Serverless are all preview at the time of writing; hosted agents have since reached general availability, and tracing and evaluations went GA earlier in the year. Preview is the right place to learn and the wrong place to put a process the business depends on. Read the status before you read the roadmap.
What we would do first
The same thing we would have recommended before any of it shipped: pick one process where being wrong has a known cost, run it for four weeks on production data, and agree in writing what success looks like before the build starts. The new tooling makes week three considerably faster. It has no opinion at all about week one.
If the answer at the end of four weeks is no, that is still the answer. That part has not been automated either.