Entra ID in Foundry: agent identity is provisioned, accountability is not

Entra ID in Foundry: agent identity is provisioned, accountability is not

Microsoft Entra Agent ID reached general availability, and in Microsoft Foundry the agent identity is provisioned for you. Understand blueprints, the shared project identity and the RBAC that does not carry over on publish, why a sponsor is required at creation, how leaver workflows transfer sponsorship to prevent orphaned agents, and why the token subject decides where a Conditional Access policy actually lands.

Continue ReadingEntra ID in Foundry: agent identity is provisioned, accountability is not
Article cover: Network and security for AI workloads, a private endpoint closes the entrance, not the exit

Network and security for AI workloads: a private endpoint closes the entrance, not the exit

A private endpoint controls ingress; it authenticates nobody and does not decide where the agent writes afterwards. The three boundaries of an AI workload — entrance, identity, and exit —, the three DNS zones Foundry requires, the roles that were renamed, and the egress control almost every project leaves open.

Continue ReadingNetwork and security for AI workloads: a private endpoint closes the entrance, not the exit