Microsoft just made it far cheaper to run agentic workloads on Azure: Foundry is GA with GPT5.6, production-ready hosted agents, and a new AsiaPacific data zone, and Microsoft is folding Cohere Command A+ and Kimi K2.7 into both Foundry and GitHub Copilot. The practical outcome is the same for platform teams you no longer need to stitch together model hosting, latency-optimized zones, and agent runtime plumbing to get subsecond, multimodal agents in production. But you do now have a much narrower set of architectural choices that determine whether those agents are safe, observable, and affordable.
Why Foundry's hosted agents change the architecture
Hosted agents change the integration story: instead of treating models as a remote API you wire into via bespoke runtimes, Foundry's managed agent execution places runtime close to hosted models with first-class links to Copilot, Databricks, and other Azure services. That yields lower tail latency for multimodal flows (images, code, text) and easier routing of action connectors but it also makes identity, network egress, and telemetry the primary control surfaces for production safety and cost.
This is the right call from Microsoft. Platform teams were already split between paying for expensive self-managed inference clusters or accepting higher latency with public APIs. Foundry collapses that decision. The cost is concentrated: you must get identity federation, host network topology, and observability right, because you can no longer scatter those responsibilities across many small, isolated projects.
AKS: Routing agent traffic is three decisions
Azure's AKS engineering published a useful, opinionated piece titled "Routing agent traffic is really three decisions." It's short but consequential: outbound agent traffic architecture breaks into node egress (NAT, SNAT pools, egress gateways), control-plane / management communication (how agents reach Foundry/management endpoints), and observability endpoints (metric, trace, and log shipping). If you're placing agents in AKS you must decide each independently you can't treat egress as a single config knob.
That guidance pairs perfectly with Foundry hosted agents. If your cluster will host connectors or run inference-sensitive sidecars, design egress and egress scaling from day one. Otherwise you'll either exhaust SNAT ports or force agent traffic through centralized proxies that add latency and single points of failure.
Identity and security are the new chokepoints
Microsoft is consolidating around Microsoft Entra for workload identity; teams should plan to converge their federation and workload identity strategies accordingly. Entra now emphasizes workload/agent principals and improved protections for privileged accounts, so expect operational changes to how you mint, rotate, and audit agent credentials. This reduces ad-hoc credential hacks, but it's painful for teams that assumed identity was "solved" by default SDK flows.
Operational knock-on effects: cost and migration
Alongside the AI and networking work, Microsoft has published deprecation and migration guidance for some older VM families and legacy storage tiers. If your agent pipelines or Batch jobs run on older instance types or legacy storage accounts, migration isn't optional; capacity and local instance choice shape latency and price. Move inference and connector workloads to supported VM families in the same data zones that host Foundry models to avoid cross-zone egress costs.
Observability and resilience
Azure published a Copilot Observability Agent and operational patterns for Azure Files, Azure NetApp Files for Oracle, and Chaos Studio CLI workflows. Treat the Copilot observability primitives as an operational building block for agentic systems: attaching model decisions to telemetry and resource metadata is indispensable when debugging hallucinations or connector errors in multi-model pipelines. If you haven't read the Copilot Observability Agent preview, it's worth a look: Azure Copilot Observability Agent Public Preview.
Final take
Foundry's GA is the pivotal shift: model ops moves toward managed, low-latency runtimes and away from ad-hoc self-hosting. That's good for velocity and reliability. But platform teams that ignore the adjacent operational workAKS egress design, Entra issuer consolidation, VM family migrations, and observability integrationwill discover the same old problems in new clothes: subtle latency cliffs, credential sprawl, and surprise bills. Build your network and identity model for agents first; the rest becomes boring plumbing.
Sources
- Azure Updates (service-wide feed, including chaos studio, VM retirements, and storage changes)
- Announcements | Microsoft Azure Blog
- Azure Charts – Latest Azure Updates (aggregated Azure update feed)
- Azure Weekly Newsletter Issue 571 (Foundry models, Copilot Observability Agent, DevOps issuer retirement)
- News – Azure – Tech Hub (Foundry GPT‑5.6 GA, data zones, hosted agents)
- Microsoft Entra – What's new (Agent ID GA and identity hard-match policy changes)