What an agent is, and what runs it
An AI agent is a software service that uses generative AI to understand and perform tasks on behalf of users — unlike rule-following apps or plain chat models, it understands context, decides, and acts autonomously. Agents deliver automation, better decisions, scalability, and 24/7 availability across use cases (productivity, research, sales, customer service, developer agents like GitHub Copilot).
Key concept · Microsoft Foundry Agent Service
A fully managed service to securely build, deploy, and scale agents without managing compute or storage — build in fewer than 50 lines of code. It provides automatic tool calling (runs the model, invokes tools, returns results), managed conversation state (via the Responses API), an extensive tool catalog, model selection, enterprise-grade security (keyless auth, content safety), customizable storage, and built-in observability & tracing.
Declarative, hosted, and the parts inside
The service supports two families of agent. Declarative agents are defined by configuration: prompt-based (a single agent with a model, instructions, tools, prompts — the most common) and workflow (multi-agent orchestrations defined in YAML). Hosted agents are containerized, code-defined agents the platform hosts.
| Component | Role |
|---|---|
| Model | The LLM powering reasoning and responses. |
| Instructions | The system prompt defining behavior, personality, and constraints. |
| Tools | External capabilities that extend the agent beyond text generation. |
| Knowledge | Context or data the agent can access. |
| Thread / conversation state | Ongoing history and context across interactions. |
Two approaches, one workflow
You can build in the Foundry portal (web UI — quick prototyping, visual config, centralized management, non-technical collaboration) or in VS Code with the Foundry extension (developer workflows, Git version control, YAML editing, local playgrounds, hosted-agent deployment). Both support the same eight-step workflow: connect → create → configure instructions → add tools → test → iterate → deploy → integrate. Many teams use both.
Key concept · Required & optional Azure resources
You always need a Foundry project and model deployments (provisioned automatically with the project). Optional services add capability as needed: Azure AI Search (Foundry IQ / file search), Azure Storage (files), Azure Key Vault (secrets), and Azure Functions (custom tools).
New autonomy, new risks
Agents' autonomy and system access expand the attack surface. Design for security from the start.
| Risk | Example |
|---|---|
| Prompt injection | Hidden instructions in a message make the agent leak credentials. |
| Data leakage | Summarizing internal files exposes private data in a customer reply. |
| Privilege escalation | Weak access control lets an agent perform admin actions on a CRM. |
| Over-reliance on autonomy | An unconstrained agent sends payments or publishes unverified content. |
| Supply-chain / poisoning | A compromised plugin or poisoned data corrupts agent behavior. |
Key concept · Security-by-design mitigations
Enforce role-based access control and least privilege; add prompt filtering/validation; gate sensitive operations behind human-in-the-loop approvals; keep comprehensive logging and traceability; audit third-party dependencies; and retrain/validate to catch drift or poisoning.
Chapter 7 quiz
Fifteen questions on agents and the Foundry Agent Service, agent types/components, development approaches, and security. Answer first, then expand Show answer.
Part A · Multiple choice
What best distinguishes an AI agent from a plain chat model?
- A It only generates text
- B It understands context, decides, and takes actions autonomously
- C It never uses an LLM
- D It requires no configuration
Show answer
B. Agents combine models with tools to act, not just generate text.
The Foundry Agent Service is best described as:
- A A code editor
- B A fully managed service to build/deploy/scale agents without managing compute or storage
- C A single LLM
- D A vector database
Show answer
B. It lets you build agents in fewer than 50 lines of code.
Which agent type is a multi-agent orchestration defined in YAML?
- A Prompt-based declarative agent
- B Workflow agent
- C Hosted agent
- D Chat model
Show answer
B — workflow agent. Prompt-based is a single declarative agent; hosted agents are containerized/code.
Which is NOT a component of a prompt-based agent?
- A Model
- B Instructions
- C Billing tier
- D Thread / conversation state
Show answer
C — Billing tier. The components are model, instructions, tools, knowledge, and thread state.
Which development approach best fits Git version control and code-first workflows?
- A Foundry portal
- B VS Code with the Foundry extension
- C A REST client
- D The Azure mobile app
Show answer
B. The portal suits visual config and prototyping; VS Code suits developer workflows.
Which two Azure resources are always required to build agents?
- A A Foundry project and model deployments
- B Azure AI Search and Key Vault
- C Azure Functions and Storage
- D A VM and a database
Show answer
A. Others (AI Search, Storage, Key Vault, Functions) are optional, added by capability.
How does the Foundry Agent Service handle tool calling?
- A The developer must write all integration code
- B Automatically — it runs the model, invokes tools, and returns results
- C It doesn't support tools
- D Only via the portal
Show answer
B. Automatic tool calling removes complex integration code.
Part B · True or false
Prompt injection is a real security risk for agents.
Show answer
True. Hidden instructions can override behavior; mitigate with prompt filtering/validation.
The portal and VS Code approaches support the same agent-development workflow.
Show answer
True. They differ in interface style, not capability.
Highly autonomous agents need no constraints because they're reliable.
Show answer
False. Over-reliance on autonomy is a risk — gate sensitive actions behind human-in-the-loop approvals.
The Foundry Agent Service manages conversation state for you via the Responses API.
Show answer
True. It removes the need for manual state management.
Part C · Short answer
Name the two families of agent the service supports.
Show answer
Declarative agents (prompt-based and workflow) and hosted agents (containerized/code).
Name the five components of a prompt-based agent.
Show answer
Model, instructions, tools, knowledge, and thread/conversation state.
Give three security-by-design mitigations for agents.
Show answer
Any three: RBAC/least privilege, prompt filtering/validation, human-in-the-loop approvals, comprehensive logging, dependency auditing, and retraining to catch drift/poisoning.
Give three of the four value dimensions agents provide.
Show answer
Any three of: automation of routine tasks, enhanced decision-making, scalability, and 24/7 availability.