Azure AI Foundry, now Microsoft Foundry, provisions an agent identity blueprint, a first-class Entra ID resource, for every project. It’s what turns a prototype agent sharing a project’s identity into a production agent auditable on its own. Atlan closes the part the blueprint leaves open: the business context an agent needs to reason well once its identity is settled.
| Quick facts | |
|---|---|
| Vendor | Microsoft |
| Current name | Microsoft Foundry (rebranded from Azure AI Foundry) |
| Blueprint type | First-class Microsoft Entra ID resource |
| Blueprint scope | One per Foundry project, shared until an agent is published |
| Blueprint defines | Credentials, scopes, accountability, linked identities |
| What it does not cover | Context and knowledge sources for grounding agents |
What do Azure AI Foundry agent blueprints cover?
The gap between creating proof-of-concept or prototype agents and promoting them to production is typically in security, leakage, explainability, and regulatory compliance. As many agents are created across a large organization without a trust layer, organizational enforcement, or blueprints, this gap widens.
To fix this problem, agent blueprints, defined in Agent Factory, target and cover the following:
-
Agent identity: Ensure that each agent has its own identity with a principal to ensure governance.
-
Agent classification: Classify agents into specific types, making it easy for administrators to control them better.
-
Checks and balances: Build organizational grounding checks and mechanisms to identify risky or unsafe agent behavior.
-
Agent security: Evaluate safety and security features of an agent continuously, before and after production deployment.
-
Authentication: Facilitate runtime authentication for MCP or A2A (agent-to-agent) calls.
At the heart of all of the above is ensuring the identity works, which means every agent should have its own identity tied to a principal. In Azure AI Foundry, the identity blueprint solves this issue. Identity is the only named resource that links directly to a blueprint. Here’s how that blueprint actually works underneath.
How do agent identity blueprints work in Azure AI Foundry?
Microsoft Entra is the main identity and network access solution for Microsoft services, Azure services, and even third-party vendors.
The agent identity blueprint is a reusable Entra ID object that serves as the top-level governing template for a group or category of agents. When using the blueprint, the agent’s core identity, which is a special service principal, is created using the blueprint.
During that process, the following actions take place:
-
The agent blueprint logs the agent type, the publisher, the roles, and Microsoft Graph permissions or delegated scopes.
-
AI Foundry provisions all the aforementioned objects as part of the agent’s Entra Agent ID.
-
Foundry also assigns relevant RBAC or other types of roles to the agent identity.
Note: Because you can only create agents in a project when working with AI Foundry, all the unpublished agents will share a project-level blueprint and agent identity.
This makes prototyping, testing, and experimentation easy. Once you publish an agent, the agent application gets a dedicated blueprint and agent identity. Next: what it actually takes to move an agent through that publishing step.
How do you use agent identity blueprints to bring agents to production?
The agent identity blueprint is central to moving an unpublished agent with a shared project identity into a production agent with its own identity. Once the agent identity is sorted, you can implement the rest, including governance, sensitive data protection, policies, prompt-level protection, and other controls.
Here’s the step-by-step flow of what you need to do to bring agents to production:
Step 1: Begin prototyping under a Foundry project, where every unpublished agent shares the same blueprint and agent identity.
Step 2: Create a new identity by publishing the agent when basic testing and evaluation of the prototype is completed.
Step 3: The roles assigned in the shared project don’t carry over, so new roles need to be assigned to the new agent identity.
Step 4: Conditional Access policies are automatically applied if you’ve scoped them to the agent identity blueprint.
Source: Microsoft Learn
Step 5: Add controls for safety and security with AI Foundry features like Prompt Shields and Task Adherence.
Step 6: Evaluate agents in production continuously for context grounding, safety compliance, and general behavior.
Step 7: Use Defender XDR and Foundry observability for issue investigations and real-time oversight of agent activity.
The first four steps work as part of the agent identity blueprint, which is an Entra ID resource. The remaining steps are other Foundry capabilities that are applied once the agent identity blueprint is applied. They’re linked to the agent identity blueprint only conceptually. Think of these more as best practices turned into a production pattern than as a first-class resource implemented in Foundry.
With the agent identity blueprint applied, most of the production requirements are met. One requirement stays, at best, a best-effort mechanism, mainly because no blueprint exists to solve it.
The other key requirement is context and knowledge, which leads to grounding. The agent identity blueprint covers how the agent acts, what tools it can call, and what logs it can generate, but it says nothing about context sources, trusted or otherwise.
While there are many knowledge sources in Microsoft, including Fabric IQ and Foundry IQ, they are usually not enough to accumulate, curate, and distill context from hundreds of systems across the enterprise.
For that, you need an enterprise context layer that fills the knowledge and context gaps the agent identity blueprint leaves. Atlan is an enterprise context platform that creates precisely the kind of enterprise context layer agents need.
How does Atlan supply Foundry agents with an enterprise context platform for AI?
Atlan is the Context Layer for AI, built on the Context Lakehouse architecture, an Iceberg-native storage layer paired with a context intelligence layer that adds vector and graph capabilities, bringing context from all of your enterprise systems into one plane.
This takes the hassle of managing context and knowledge for grounding agents away from the agent blueprints. Agent blueprints can focus on the foundational aspects of creating agents, such as identity, security, networking, tool use, and more. At the same time, Atlan’s context layer can provide the context.
Once the agent identity blueprint is implemented, you can add Atlan’s MCP server as a remote MCP tool to the Foundry agent.
Authentication for the MCP server lives in a Foundry project connection, which supports key-based auth, OAuth, and even the agent’s own identity for servers that accept it. With this single MCP server, the Foundry agent has access to all enterprise context and knowledge, instead of one custom MCP server per connected system.
All of this is possible in Atlan because of the following key constructs:
-
Context Lakehouse: Context Lakehouse is an Iceberg-native knowledge architecture with vector and graph capabilities, so agents retrieve meaning rather than keywords
-
Enterprise Data Graph: Enterprise Data Graph maps the entity relationships between systems, assets, code, and products across your stack, functioning as the context graph beneath everything else Atlan does
-
Active Ontology: Active Ontology distills organizational language into glossary terms, domains, metrics, and relationships as a semantic layer, aligned with Open Semantic Interchange.
-
Context Engineering Studio: With the Context Engineering Studio, you can build Context Repos for your projects, run context engineering evaluations on them, and deploy the best version for your agents to use.
For Azure AI Foundry agents, while the agent identity blueprint handles identity, governance, and auditability, Atlan provides the most accurate, up-to-date knowledge for agents. To move agents from prototyping or testing to production, both are required.
Real stories from real customers: context beyond agent identity
"Atlan captures Workday's shared language to be leveraged by AI via its MCP server. As part of Atlan's AI labs, we're co-building the semantic layer that AI needs."
Joe DosSantos, VP Enterprise Data & Analytics, Workday
"Atlan is our context operating system to cover every type of context in every system including our operational systems. For the first time we have a single source of truth for context."
Sridher Arumugham, Chief Data Analytics Officer, DigiKey
Moving forward with Azure AI Foundry agent blueprints
Microsoft Agent Factory defines several reusable trust patterns: the agent identity blueprint for identity, and others covering evaluations, security, and observability.
The agent identity blueprint manifests itself as a first-class Entra ID resource that dictates how agent identities are created for new agents.
So, when you create agents for testing and prototyping in a Foundry project, all unpublished agents share the same identity. Once the agents are ready to be published, they get their own identity from the blueprint, get roles reassigned, and pick up the required production-specific policies.
While agent blueprints solve identity and governance, they don’t solve for the knowledge and context needed to ground agents. An enterprise context layer solves that problem, and Atlan provides it with its Context Lakehouse architecture, MCP server, and other such key capabilities.
Book a demo to know more.
FAQs about Azure AI Foundry agent blueprints
1. What are agent blueprints in Azure AI Foundry?
Agent blueprints are reusable patterns as defined in Agent Factory. These blueprints cover several aspects of the agent lifecycle and development. Some blueprints translate to real resource-level mappings in Foundry, while others are more conceptual and left for agent developers to implement.
2. What are the key responsibilities of the agent identity blueprint?
One key responsibility of the blueprint is to let you define the agent class or type, specify its name, publisher, associated roles, and Microsoft Graph permissions or delegated scopes. Another key responsibility is to enforce Conditional Access for agents: a policy applied to the blueprint automatically covers every agent of that class.
3. How can you implement the agent identity blueprint in Azure AI Foundry?
You can implement the agent identity blueprint with Microsoft Entra ID, as the blueprint translates into a first-class resource within Entra ID. It acts as the governing template Foundry uses to provision identities as special service principals when an agent needs to move from the shared Foundry project identity to a dedicated identity.
4. Can Atlan work with Azure AI Foundry blueprints?
Yes, agent blueprints and Atlan are complementary. While agent blueprints handle identity, governance, and security for agents of a specific type or class, Atlan provides context from its enterprise context layer.
5. How do Atlan and Azure AI Foundry work together?
Azure AI Foundry and Atlan communicate via MCP calls to Atlan’s MCP server, with authentication stored in a Foundry project connection that can even use the identity provisioned by the agent identity blueprint.
Sources
- Microsoft Entra Blog, Build AI agents for production with secure identities from day one. https://techcommunity.microsoft.com/blog/microsoft-entra-blog/build-ai-agents-for-production-with-secure-identities-from-day-one/4524606
- Agent Factory Blog, Microsoft Azure. https://azure.microsoft.com/en-us/blog/tag/agent-factory/
- What is the Model Context Protocol (MCP)? https://modelcontextprotocol.io/docs/2026-07-28/getting-started/intro
- Connect to an A2A agent endpoint from Foundry Agent Service (preview), Microsoft Learn. https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/tools/agent-to-agent?pivots=python
- What is Microsoft Entra?, Microsoft Learn. https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra
- Agent identity concepts in Microsoft Foundry, Microsoft Learn. https://learn.microsoft.com/en-us/azure/foundry/agents/concepts/agent-identity
- Microsoft Foundry architecture, Microsoft Learn. https://learn.microsoft.com/en-us/azure/foundry/concepts/architecture
- View and manage agent identity blueprints in your tenant, Microsoft Learn. https://learn.microsoft.com/en-us/entra/agent-id/manage-agent-blueprint
- Conditional Access for agents, Microsoft Learn. https://learn.microsoft.com/en-us/entra/identity/conditional-access/agent-id
