Microsoft Foundry launches hypervisor-isolated hosted agents

If you have ever built an autonomous AI agent locally, you know the magic of watching it write code, edit local files, and run tasks. But if your boss asked you to deploy that same agent for thousands of enterprise employees, you would probably hit a wall.

Traditional cloud architecture was built for shared, stateless API requests. Having multiple enterprise users talk to an agent that actively executes arbitrary code and writes to disk on a shared container is a security nightmare.

Microsoft just launched hosted agents in Foundry Agent Service, now available in public preview, rolling out an entirely redesigned compute layer purpose-built for AI agents.

Real hypervisors and filesystems that survive zero

Instead of process-level isolation or temporary code sandboxes, Microsoft gives every single agent session its own hypervisor-isolated virtual machine.

Even better is how it handles idle time and state. The service supports scale-to-zero billing, meaning you pay nothing when an agent is sitting idle. But when a new prompt wakes it up, cold starts are predictable and fast, and the entire filesystem and working directory remain completely intact. The agent resumes exactly where it left off without requiring developers to wire up external databases.

Identity is treated as a first-class citizen. Each hosted agent receives a dedicated Entra Agent ID. When an employee triggers the agent through Microsoft Teams or M365 Copilot, it uses OAuth 2.0 On-Behalf-Of flows to inherit user permissions. When running autonomous background tasks, it authenticates via its own Managed Identity.

Microsoft is also keeping things open. Developers can bring Dockerfiles and any harness, including LangGraph, OpenAI Agents SDK, Claude Agent SDK, or the freshly launched Microsoft Agent Framework 1.0 (which unifies Semantic Kernel and AutoGen), deploying everything via a single azd deploy CLI command.

Why it matters

Building an impressive agent demo has become trivial. Deploying it across a Fortune 500 company without creating massive security holes or blowing through cloud budgets has remained nearly impossible.

We think Microsoft just delivered a masterclass in enterprise positioning. Instead of trying to lock developers into proprietary model endpoints, Redmond is leveraging its real moat: virtualization, identity governance, and enterprise distribution channels.

By packaging hypervisor sandboxing, zero-scale persistence, and Entra identities into a managed service, Microsoft takes the nastiest infrastructure headaches off developers' plates. For enterprise IT teams terrified of prompt-injected agents leaking data across user sessions, this provides a credible path to production.

The real question mark will be pricing at scale. While scaling to zero keeps idle costs down, keeping thousands of persistent disk snapshots and spinning up hypervisor VMs under sudden bursts might carry hidden infrastructure overhead. Still, this draws a very clear line in the sand for cloud providers: the battle is no longer just about hosting LLMs, but hosting the operating system for agents.