Establishing Azure AI Foundry
as Your Enterprise AI Platform
This session covers the complete Microsoft AI Agent Platform stack, the enterprise governance and integration layer that accelerates enterprise adoption, and direct answers to Bank of Canada's specific architecture questions — all scoped to Canadian financial sector regulatory requirements.
What We Are Covering Today
This workshop is structured in two halves. We start with the Microsoft native platform — every GA and Preview feature relevant to large-scale enterprise AI deployment — then show the enterprise governance layer that accelerates adoption and closes the gaps Microsoft does not address natively. The second half takes each of Bank of Canada's open architecture questions and gives a layered, production-grade answer.
What Microsoft Ships Out of the Box
The 2025–2026 Microsoft release cycle delivered a complete enterprise AI agent platform. The starting position is strong — do not build what Microsoft already provides. The Enterprise Kit configures and extends this platform; it does not replace it.
| Capability | Microsoft Feature | Status | Answers Bank Question |
|---|---|---|---|
| Agent 365 | Enterprise agent registry, lifecycle, AI Teammates, cross-cloud sync | GA | AI at Scale — sprawl prevention |
| Foundry Agent Service | Managed agent runtime, tool invocations, multi-agent orchestration | GA | AI at Scale — runtime |
| A2A Protocol v0.3 | Standardised agent-to-agent delegation with AgenticIdentity auth | GA | AI at Scale — multi-agent |
| Foundry Continuous Eval | Automated quality gates, benchmarks, Red Teaming Agent | GA | AI at Scale — quality |
| Foundry Memory | Cross-agent shared memory with TTL and access controls | Preview | AI at Scale — state |
| Foundry Toolbox | Versioned, immutable MCP bundles with promotion gates | Preview | MCP Governance — versioning |
| Private Tool Catalog (API Center) | Org-scoped MCP server registry with risk classification | Preview | MCP Governance — inventory |
| APIM AI Gateway for MCP | Rate limiting, geo-routing, semantic caching, correlation IDs | Preview | MCP Governance — policy enforcement |
| MCP Auth (5 methods) | API Key, OAuth Bearer, Managed Identity, mTLS, Entra SPN | GA | MCP Governance — auth |
| Entra Agent Identity — Blueprint | Application-level identity template with scoped permissions | GA | Identity — provisioning |
| Entra Agent Identity — BlueprintPrincipal | Deployment-level service principal per agent class | GA | Identity — deployment |
| Entra Agent Identity — per-instance | Unique identity per live agent instance with kill switch | GA | Identity — instance isolation |
| FMI Path Token Exchange | Federated chain: Entra → SAP BTP → legacy system without secrets | GA | Identity — SAP propagation |
| Defender for AI | Prompt injection detection, adversarial input blocking at runtime | GA | Identity — runtime threat |
| Foundry IQ | OneLake-backed KB, permission-aware agentic retrieval, citations | GA | Data Flow — knowledge |
| Work IQ | M365 signal plane: Calendar, Mail, Teams, SharePoint, OneDrive, User | GA | Data Flow — M365 |
| Fabric IQ | BI and analytics signal plane over Fabric semantic models | GA | Data Flow — analytics |
| Purview Lineage Graph | Agent-aware data lineage, column-level tracking to OneLake | GA | Data Flow — lineage |
| Purview DLP for AI | Policy-enforced content scanning on all agent tool invocations | GA | Data Flow — data boundary |
| Foundry Guardrails | Content safety filters, PII redaction, output schema validation | GA | Data Flow — safety |
| Entra Admin Center — AI Agents view | Centralised agent inventory with last-active, permissions, kill switch | GA | AI at Scale — visibility |
| Azure Monitor / KQL | Structured telemetry, latency dashboards, token-usage analytics | GA | All — observability |
| AI Foundry SDK (Python/TS) | AIProjectClient, ToolboxClient, AgentClient scaffolding | GA | All — developer experience |
What the Enterprise Kit Adds on Top of Microsoft
The Azure Foundry Enterprise Kit is not an alternative AI platform. It is a pre-built governance and integration layer that configures Microsoft's native stack for heavily regulated enterprise use. Six weeks of platform engineering is compressed to five days. Every module below maps to a control Microsoft does not provide natively.
Agent 365, Foundry, Toolbox, Private Tool Catalog, APIM AI Gateway, Entra Agent Identity, Defender for AI, Foundry IQ, Work IQ, Fabric IQ, Purview.
Decision Ledger, Certification Pipeline, Policy Graph, enterprise adapters, eval harness, banking policy packs, Bicep IaC, business value dashboards.
OSFI B-10 evidence bundle export, bank-specific MCP governance YAML, identity propagation registry, SAP Clean Core Bridge, Agent Portfolio Registry manifest extension.
AI Architecture at Scale: Governing 50+ Agents
“How do we prevent agent sprawl? How do we ensure every agent across business units is visible, governed, and compliant — without creating a governance bottleneck?”
Agent 365 is the sprawl prevention platform. Every agent — deployed anywhere in the Microsoft ecosystem — registers here automatically. Four-type registry: Domain Agents, Cross-Domain Agents, Orchestrator Agents, Specialist Agents.
- AI Teammates integration: agents appear alongside human colleagues in M365 org chart, with last-active timestamp and assigned owner
- Cross-cloud registry sync: Azure + AWS Bedrock + GCP Vertex agents unified in one control plane
- A365 CLI gate:
a365 register --manifest agent.yaml --env prod— enforced in CI, no unregistered deployments - Kill switch:
a365 disable-agent --id <agent-id> --reason "policy-violation"
The A2A Protocol defines how agents delegate to each other safely. Orchestrator agents discover sub-agent capabilities via Agent Cards (JSON-LD), then delegate with AgenticIdentity-scoped tokens — the sub-agent can only do what the orchestrator explicitly delegates.
- Skill discovery:
GET /.well-known/agent-card— every registered agent exposes its capabilities - Delegation chain: tokens carry the full orchestration path for audit purposes
- Foundry Memory (Preview): shared working memory across a multi-agent workflow session with TTL and conflict resolution
The Enterprise kit adds the governance controls Microsoft does not provide: a cross-agent compliance topology that visualises violation paths, and an automated certification pipeline that agents must pass before production.
- Policy Graph: Cytoscape topology of all registered agents, with edges representing tool-sharing relationships and policy dependencies. Identifies compliance violation paths before they reach production.
- Certification Pipeline: Bronze (basic safety) → Silver (policy compliance + eval gates) → Gold (OSFI evidence bundle + Red Teaming passed). No Gold → no production deployment.
- Agent Manifest Extension:
risk_tier,regulatory_scope,lob,duplicate_assessment— banking-specific manifest fields appended to A365 base schema. - Scorecard Compiler: Automated PDF scorecard per agent per release, signed by certification pipeline, suitable for board-level AI governance reporting.
MCP Server Strategy: Fleet Governance at Enterprise Scale
“We will have hundreds of MCP servers across business units. How do we version them, control access, enforce policy, and prevent rogue tool servers from being connected to production agents?”
The Enterprise Kit provides production-ready MCP adapters for the systems Bank of Canada already uses. No adapter code to write from scratch.
A bank-specific MCP governance overlay extending the Private Tool Catalog with OSFI-aligned risk classification, Canadian data residency enforcement, and automated audit export.
# bank-mcp-governance.yaml
tool_risk_classification:
tiers:
tier_1_low: [graph-calendar, graph-mail, foundry-iq-search]
tier_2_medium: [servicenow-incident, workday-hr-read]
tier_3_high: [sap-finance-write, servicenow-change-approve]
tier_4_restricted: [core-banking-ledger, wire-transfer-api]
data_boundary:
canadian_residency_required: true
allowed_regions: [canadacentral, canadaeast]
restricted_data_types: [PII_SIN, SWIFT_codes, OSFI_regulated_data]
audit:
export_format: osfi_b10_signed_bundle
retention_days: 2555 # 7 years per OSFI B-10 guideline
hash_algorithm: SHA-256-chainIdentity & Principal Propagation: Zero-Secret Enterprise Auth
“How does the agent identity propagate through to SAP, ServiceNow, and our internal systems without creating shared service accounts or storing credentials? And how do we prove to auditors which human authorised a given AI action?”
The FMI Path (Federated Managed Identity) eliminates shared service accounts entirely. The agent's Entra identity becomes a Federated Identity Credential that exchanges for a SAP BTP token without storing any credentials anywhere.
Each hop carries the correlation ID. The Decision Ledger records: originating human session (if any), agent instance ID, FMI exchange timestamp, SAP action taken. This is the complete delegation chain auditors require.
# identity-propagation-registry.yaml (Enterprise Kit extension)
entra_group_to_system_roles:
- entra_group: "BoC-FX-Traders"
sap_auth_object: "F_BKPF_BES"
servicenow_role: "financial_operations_reader"
allowed_data_tiers: [internal, confidential]
- entra_group: "BoC-AI-Platform-Admins"
sap_auth_object: "S_TABU_DIS"
servicenow_role: "admin"
allowed_data_tiers: [internal, confidential, restricted]- Decision Ledger: Hash-chained Cosmos DB log. Every SAP write, every ServiceNow change, every agent decision — immutably recorded with originating identity chain.
- OSFI B-10 Audit Export: Certification Pipeline packages the Decision Ledger, Entra audit logs, and Purview lineage into a signed bundle. Directly submittable to OSFI examiners.
- Defender for AI (Microsoft GA): Prompt injection detection at runtime. If an adversarial input attempts to override the agent's identity or escalate permissions, it is blocked and logged.
Data Flow & Clean Core: From SAP to Foundry IQ Without Data Copies
“How do agents access our SAP financial data, regulatory data, and internal knowledge bases without creating data copies that breach our clean-core SAP policy or Canadian data residency requirements? And how do we trace every data access for auditability?”
Foundry IQ is the knowledge layer. Data lives in OneLake (Canada Central). Agents query Foundry IQ — which enforces the querying agent's permissions before returning any content. No data copies leave the sovereignty boundary.
- Multi-source KB: SharePoint, SAP extracts, regulatory documents, internal policies — all indexed into Foundry IQ with column-level Purview classification
- Agentic retrieval: semantic search with permission enforcement. An agent with finance-read scope cannot retrieve HR data even if it asks for it.
- Citations: every response includes source attribution with Purview lineage record. Auditors can trace any agent output back to its source document.
- Work IQ: M365 signal plane — Calendar, Mail, Teams, SharePoint, User. Foundry IQ + Work IQ = complete organisational knowledge.
The SAP Clean Core Bridge extracts SAP financial data into OneLake using a CDC (Change Data Capture) pattern — no direct SAP queries from agents, no data copies outside Azure Canada region.
- SAP clean-core preserved: no custom SAP extensions. OData V4 is SAP's standard API surface.
- Canadian data residency: all ADF pipelines, OneLake, and Foundry IQ scoped to canadacentral / canadaeast.
- Purview lineage: every row in OneLake carries a lineage record back to its SAP source table and column.
From Zero to Production Platform: 7-Month Sequence
The build sequence is designed around zero custom infrastructure code in the first sprint. Every phase builds on the previous with no throwaway work.
- Deploy Enterprise Kit Bicep IaC: subscription-scoped Azure CAF baseline
- Provision Foundry project, Agent 365 tenant, APIM AI Gateway, API Center
- Configure Entra Agent Identity: 1 Blueprint per agent class
- Register 3 pilot agents in Agent 365 with extended banking manifest
- Activate foundry-baseline-v1 and data-boundary-v1 policy packs
- Wire Foundry Continuous Eval + Red Teaming Agent
- Customise bank-mcp-governance.yaml for BoC risk classification
- Configure identity-propagation-registry.yaml (Entra → SAP auth objects)
- Deploy SAP Adapter + ServiceNow Adapter into Private Tool Catalog
- Implement Foundry IQ multi-source KB: internal policies, regulatory docs
- Integrate Decision Ledger with SAP Adapter (every write is ledgered)
- Run first Bronze Certification for 3 pilot agents
- Build SAP → OneLake Bronze/Silver/Gold ADF pipeline
- Configure Purview column classification on all OneLake tables
- Connect Fabric IQ semantic models to OneLake Gold
- Achieve Silver Certification for all pilot agents (eval gates passing)
- Wire OSFI B-10 audit bundle export into Certification Pipeline
- Load test at 5x target throughput (k6 load test kit included)
- Enable self-service agent registration via A365 CLI gate in DevOps pipeline
- Publish Private Tool Catalog to all business units (with tier-based access)
- Achieve Gold Certification for production agents
- Activate business value dashboards (ROI, scorecard A–F per agent)
- Establish quarterly OSFI B-10 evidence bundle export cadence
- Expand to full enterprise: 50+ agents, 10+ MCP server fleet
We are not building a custom AI platform on top of Azure. We are configuring Microsoft's enterprise AI platform — Agent 365 for governance, Foundry for runtime, MCP for tool connectivity, and the Three-IQ intelligence layer for knowledge and analytics — with the enterprise governance and banking-specific integration layer on top.
Bank of Canada gets a production-grade, OSFI-compliant AI agent platform in 7 months, with zero throwaway infrastructure work, using tools that are already procured through the Microsoft enterprise agreement.