Microsoft Foundry Agent Service is previewing network egress controls that restrict the internet destinations a hosted agent can contact. The policy lives on the agent definition rather than inside an individual HTTP tool, creating a boundary that applies even when a library or newly added helper makes the request.
Administrators define ordered hostname rules and a default action in a resource policy. Audit mode allows traffic while recording which requests would have been denied. Enforced mode blocks destinations that do not match an allow rule. Microsoft recommends starting with exact hostnames, observing real calls and then testing one approved endpoint alongside a controlled endpoint that should be unreachable.
The distinction matters because an agent's advertised tool list is not a network control. A document can contain an unexpected upload link, or application code can add another network client. Moving destination decisions into a reviewable policy gives security teams a separate place to inspect outbound access. It does not provide credentials or authorization at an allowed service; applications still own those checks.
The feature is explicitly a preview for development and evaluation. It has no preview service-level agreement and is not intended for production. Microsoft also cautions that seeing a saved policy is insufficient evidence: teams need runtime probes and network decision telemetry to confirm the intended boundary is actually enforced.