October 27, 2026
|
5 min read
Governing Microsoft Foundry Agents: Identity-First Control for Hosted Agents
.png)
Built for Speed: ~10ms Latency, Even Under Load
Blazingly fast way to build, track and deploy your models!
- Handles 350+ RPS on just 1 vCPU — no tuning needed
- Production-ready with full enterprise support
TrueFoundry AI Gateway delivers ~3–4 ms latency, handles 350+ RPS on 1 vCPU, scales horizontally with ease, and is production-ready, while LiteLLM suffers from high latency, struggles beyond moderate RPS, lacks built-in scaling, and is best for light or prototype workloads.
Built for Speed: ~10ms Latency, Even Under Load
Try now.
Start free
How Can You Prevent GenAI Costs From Spiraling at Scale?
Gartner Hype Cycle for Platform Engineering 2026
One Layer of Control for All AI
Discover More
No items found.
.png)
.png)
.png)
No items found.
Recent Blogs
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
Frequently asked questions
How do Foundry agents reach MCP servers under governance?
Through the TrueFoundry MCP Gateway rather than directly. The gateway authenticates the caller, resolves it to a registered agent, applies access policy, performs the token exchange the MCP server requires, and writes an audit line. Unregistered agents are refused.
What's the difference between client-credentials and on-behalf-of mode?
Client credentials is for unattended agents with no user — the MCP server sees an app-only token with the Tool.Invoke role. On-behalf-of is for agents acting for a signed-in user — the token carries both the user and the agent, with a delegated Tool.Write scope.
How is a Foundry agent registered in TrueFoundry?
As an identity-provider-backed entry in the Agent Registry, matched on the agent identity object ID in client-credentials mode, or the agent-client application ID (via the azp claim) in on-behalf-of mode.
Why is my roles claim missing?
Almost always because admin consent wasn't granted after assigning the Tool.Invoke app role, or because token version is still 1. Set requestedAccessTokenVersion to 2 on agent-service and grant admin consent.
Can the agent's own identity travel with the call?
Yes — Foundry agents perform their own token exchange, so the agent identity can be carried downstream, unlike Copilot Studio agents whose Entra Agent ID stays in the gateway audit trail.
Can I run the gateway in my own cloud?
Yes. The TrueFoundry Gateway can be self-hosted or deployed in your VPC, so agent tokens, exchanges, and audit stay within your environment alongside your Azure resources.
