What's changed: Added per-section figures (cert-figure-retrofit). New AI-901 Chapter 4 (Domain 2: agent definition = goal→autonomous plan→tool execution→loop, building blocks = instructions/model/knowledge/tools, function calling, difference from generative AI, Foundry Agent Service, multi-agent, safety = least privilege/human-in-the-loop/Content Safety)
4.2Building Agents in Foundry
Understand building agents with Foundry Agent Service in Microsoft Foundry (compose model + instructions + knowledge + tools), multi-agent orchestration, and safety practices for operating agents (permissions, approval, monitoring).
In Microsoft Foundry you build and run agents with Foundry Agent Service. The recipe: (1) pick a deployed model → (2) write instructions (role/constraints) → (3) connect knowledge (reference data) → (4) register usable tools. Combined, these produce an agent that takes a goal and acts autonomously. Note how the earlier pieces (model deployment, grounding, tools) come together here as a single agent.
4.2.1Multi-agent — dividing roles
Work too complex for one agent becomes manageable when you split roles across multiple agents that collaborate—this is multi-agent. For example, specialized agents for "research," "drafting," and "review," with an orchestrator coordinating the whole. Letting each agent focus on a small task it is good at improves quality and maintainability. For AI-901, it is enough to grasp the concept: complex work can be divided among specialized, collaborating agents.
4.2.2Operating agents safely
Because agents act autonomously, safety matters most. Three basics: (1) least privilege—give the agent only the tools and access it truly needs. (2) human-in-the-loop—require human approval for high-impact actions like payments or deletions. (3) monitoring and safety filters—evaluate and monitor responses/actions, block harmful output with Azure AI Content Safety, and defend against prompt injection. These are also implementations of Responsible AI (reliability & safety, accountability).
| Risk | Mitigation |
|---|---|
| Over-broad permissions cause mistakes | Least-privilege tools/access |
| High-impact auto-execution | Human-in-the-loop (approval) |
| Harmful output | Detect/block with Azure AI Content Safety |
| Instruction hijacking | Prompt-injection defenses, input validation |
Scenario: an expense assistant (multi-agent). "Process this claim" → a reader extracts amounts from receipts → a policy checker compares against internal policy (knowledge/RAG) → an executor files it in the reimbursement system (tool). But above a threshold, human approval (human-in-the-loop) is required, each agent has least privilege, and actions are recorded in monitoring logs.
Watch out: (1) do not confuse Foundry Agent Service (where you build agents) with a one-off model call. (2) Multi-agent ≠ always best—simple tasks are fine with a single agent or plain generative AI. (3) Safety (least privilege, human approval, Content Safety) is a prerequisite, not optional decoration. (4) Knowledge (RAG) and permissions (tools) are different—"what it knows" vs "what it can do."
Common: (1) "the service to build/run agents in Foundry" = Foundry Agent Service. (2) an agent = model + instructions + knowledge + tools. (3) "split complex work across specialized collaborating agents" = multi-agent. (4) "human approves before high-impact actions" = human-in-the-loop; "least necessary permissions" = least privilege; "block harmful output" = Content Safety.
4.2.3Section summary
- Foundry agents = built in Foundry Agent Service by combining "model + instructions + knowledge + tools"
- Multi-agent = split complex work across specialized agents, coordinated by an orchestrator
- Safety: least privilege / human-in-the-loop / monitoring & Content Safety / prompt-injection defenses
- Distinguish knowledge (what it knows · RAG) from permissions (what it can do · tools)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which service is used to build and operate agents in Microsoft Foundry?
Q2. Which is the correct set of basic elements that make up an agent in Foundry?
Q3. What is the configuration called where complex work is split across specialized collaborating agents?
Q4. Which safety practice has a human approve high-impact actions (payment, deletion) before the agent auto-executes?
Q5. Which statement about operating agents safely is correct?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.