October 27, 2026
|
5 minutos de lectura
Governing Microsoft Foundry Agents: Identity-First Control for Hosted Agents
.png)
Diseñado para la velocidad: ~ 10 ms de latencia, incluso bajo carga
¡Una forma increíblemente rápida de crear, rastrear e implementar sus modelos!
- Gestiona más de 350 RPS en solo 1 vCPU, sin necesidad de ajustes
- Listo para la producción con soporte empresarial completo
TrueFoundry AI Gateway ofrece una latencia de entre 3 y 4 ms, gestiona más de 350 RPS en una vCPU, se escala horizontalmente con facilidad y está listo para la producción, mientras que LitellM presenta una latencia alta, tiene dificultades para superar un RPS moderado, carece de escalado integrado y es ideal para cargas de trabajo ligeras o de prototipos.
Diseñado para la velocidad: ~ 10 ms de latencia, incluso bajo carga
Try now.
Inscríbase
¿Cómo se puede evitar que los costos de GenAI se disparen a gran escala?
Gartner Hype Cycle for Platform Engineering 2026
One Layer of Control for All AI
Tabla de contenido
Controle, implemente y rastree la IA en su propia infraestructura
Summarize with
Descubra más
No se ha encontrado ningún artículo.
.png)
.png)
.png)
No se ha encontrado ningún artículo.
Blogs recientes
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
Preguntas frecuentes
How do Foundry agents reach MCP servers under governance?
Through the TrueFoundry MCP Gateway rather than directly. The gateway authenticates the caller, resolves it to a registered agent, applies access policy, performs the token exchange the MCP server requires, and writes an audit line. Unregistered agents are refused.
What's the difference between client-credentials and on-behalf-of mode?
Client credentials is for unattended agents with no user — the MCP server sees an app-only token with the Tool.Invoke role. On-behalf-of is for agents acting for a signed-in user — the token carries both the user and the agent, with a delegated Tool.Write scope.
How is a Foundry agent registered in TrueFoundry?
As an identity-provider-backed entry in the Agent Registry, matched on the agent identity object ID in client-credentials mode, or the agent-client application ID (via the azp claim) in on-behalf-of mode.
Why is my roles claim missing?
Almost always because admin consent wasn't granted after assigning the Tool.Invoke app role, or because token version is still 1. Set requestedAccessTokenVersion to 2 on agent-service and grant admin consent.
Can the agent's own identity travel with the call?
Yes — Foundry agents perform their own token exchange, so the agent identity can be carried downstream, unlike Copilot Studio agents whose Entra Agent ID stays in the gateway audit trail.
Can I run the gateway in my own cloud?
Yes. The TrueFoundry Gateway can be self-hosted or deployed in your VPC, so agent tokens, exchanges, and audit stay within your environment alongside your Azure resources.
