Microsoft introduces network egress controls for Foundry hosted agents
Released network egress controls for Microsoft Foundry hosted agents — the destinations an agent may connect out to are defined on ARM resources as FQDN rules. Rules can specify four actions — Allow, Deny, request-header modification (Transform) and destination rewriting (Rewrite) — and policies run either in Audit mode, which only observes without blocking, or in Enforced mode, which actually blocks, with admins deciding whether unapproved destinations are denied by default. It targets situations in which an agent sends unexpected external requests, such as following an unfamiliar upload link in a document, or a new helper library that follows unexpected URLs; the design calls for a security boundary that can be reviewed separately from application authentication and authorization, rather than relying only on tool vetting.
Why it matters
A commercial implementation that moves prompt-injection defense down from model alignment to the network boundary. Starting from the premise that agents cannot be kept from being fooled, it keeps data from getting out even when they are, reaching at the product layer the same conclusion as the same week's NVIDIA and AgentKernel line of discussion. One more piece of cumulative evidence for the observation topic "agent security and sandboxing".
Source — Primary sources first; secondary reports are labelled “Press”
Officialdevblogs.microsoft.comhttps://devblogs.microsoft.com/foundry/egress-controls-hosted-agent/Added in Week 41, 2026 · See that week