Microsoft Foundry Agent Service vs Orchestrator Zero

Conditional: Microsoft hosts the agents

Hosted agents run on Microsoft-managed infrastructure; you do not choose the machines they run on.

learn.microsoft.com

No: Microsoft cloud only

Hosted agents are container images that Agent Service runs on Microsoft-managed infrastructure; nothing runs on your own Linux, macOS or Windows machines.

learn.microsoft.com

No: Managed Azure service

Foundry Agent Service is a managed Azure service; there is no control plane to run yourself.

learn.microsoft.com

No: Platform calls the container

The platform routes each request to your container, so the container has to accept inbound calls.

learn.microsoft.com

No: Microsoft-managed compute

The platform provisions and removes compute itself; there are no machines of yours to join, label, route to or block.

learn.microsoft.com

Conditional: Preview, handler restarts

Resilience for long-running hosted agents is a preview, and recovery runs the handler again from the start, using your own checkpoints, with no deterministic replay.

learn.microsoft.com

Conditional: Per-agent MCP lists

Each agent's MCP tool takes an allowed_tools list and a require_approval setting per tool, enforced for prompt agents; hosted agents enforce approval in their own code, and there are no admin rules across agents.

learn.microsoft.com learn.microsoft.com learn.microsoft.com

Conditional: API only, no chat approvals

A tool that needs approval returns an approval request and your client sends the answer back through the API; deciding in Teams or another chat app is not documented.

learn.microsoft.com

Conditional: Toolbox versions; manual review

Foundry Toolboxes support versioned endpoints and promotion of a default version. Remote MCP changes still need your review; automatic blocking of changed tool descriptions or schemas is not documented.

learn.microsoft.com

Conditional: Tenants defined by your app

Sessions can be isolated per user, and per tenant's users, but tenants are something your app defines.

learn.microsoft.com

Conditional: Token quotas, no run budget

Token quotas can be set per project, but there is no spend limit in money that stops a run.

learn.microsoft.com

Conditional: Entra identity, no static key

Hosted agents call Foundry models with their own Entra agent identity, so no provider key sits in the container, but the runtime holds those credentials; models behind your own gateway are reached through a project connection.

learn.microsoft.com

Conditional: No egress, or via your VNet

Code Interpreter runs in Hyper-V isolated sessions with no outbound network, and hosted agents run in VM-isolated sandboxes; keeping their egress to listed hosts takes your own VNet and firewall.

learn.microsoft.com learn.microsoft.com

Conditional: Audit log, no integrity proof

Purview's unified audit log records prompts and responses for Foundry agents, but Microsoft documents no hash chain or signature to verify it, and the AI gateway does not log tool traces.

learn.microsoft.com learn.microsoft.com

Conditional: Per-user delete, no own keys

Purview eDiscovery can find and delete one user's AI interaction data, but no encryption key per person is documented.

learn.microsoft.com

Yes: Purview, pay-as-you-go

Purview retention policies keep or delete Foundry prompts and responses for a period you set, and eDiscovery holds stop their deletion; managing Foundry interactions in Purview needs pay-as-you-go billing.

learn.microsoft.com

Yes: Catalog or your own gateway

Agents use Azure OpenAI and other vendors' models from the Foundry catalog, such as DeepSeek, Grok, Llama and Mistral, and models behind your own API Management or other gateway, which can front self-hosted models.

learn.microsoft.com learn.microsoft.com

Yes

Agents use remote MCP servers and toolboxes over MCP, and Agent Service supports A2A v1.0 for agent-to-agent calls.

learn.microsoft.com