The response log keeps what the agent said, not the path it took. The Foundry trace keeps the order of the steps, the failures and the tokens of each turn, and leaves the content to a protected table. See what the trace shows, who can see the content and what changed in Agent Framework 1.22.0, with an example run locally.
The user prompt was clean. The hostile instruction came in through the content the tool brought back — and that is the door almost no security review looks at. This article gathers what moved in the 2026 OWASP Top 10, the two Prompt Shields intervention points, the spotlighting that ships off by default, what the MCP specification protects and what it leaves to you — and shows what has to be in place so a successful injection does not become impact.
Microsoft Entra Agent ID reached general availability, and in Microsoft Foundry the agent identity is provisioned for you. Understand blueprints, the shared project identity and the RBAC that does not carry over on publish, why a sponsor is required at creation, how leaver workflows transfer sponsorship to prevent orphaned agents, and why the token subject decides where a Conditional Access policy actually lands.
A private endpoint controls ingress; it authenticates nobody and does not decide where the agent writes afterwards. The three boundaries of an AI workload — entrance, identity, and exit —, the three DNS zones Foundry requires, the roles that were renamed, and the egress control almost every project leaves open.