Microsoft Foundry Claude on Azure: Five Agent Capabilities Developers Need to Know

Microsoft Foundry now gives Azure-hosted Claude deployments five capabilities that previously pushed many teams toward client-side agent scaffolding: structured outputs, web search, web fetch, an MCP connector, and tool search. Microsoft announced the availability on August 17, 2026, and Microsoft Learn documents the split between Claude deployments hosted on Azure and those hosted on Anthropic infrastructure.

The practical answer for builders is not “Claude is now an agent framework.” It is more specific: if you already deploy Claude through Microsoft Foundry, Azure-hosted deployments can now cover several pieces of the agent loop while keeping model inference on Azure infrastructure. That can reduce custom code, but it does not remove the need for authorization, data-flow review, observability, or human approval around consequential actions.

What changed for Azure-hosted Claude

Microsoft Foundry exposes Claude through two hosting paths:

Microsoft Learn currently lists Claude Opus 5, Opus 4.8, Sonnet 5, and Haiku 4.5 as available on Azure-hosted deployments at different capability levels. Availability and lifecycle status are model-specific, so check the live model table before designing around a particular model ID.

The August release matters because the five features are not merely convenience helpers. Together, they cover output contracts, current-information retrieval, document retrieval, remote tool connectivity, and large-tool-set discovery—the parts that commonly turn a model call into an agent platform.

The new agent capability stack

Visual: an original request-flow diagram showing where Foundry capabilities fit and where application authorization must remain. It is based on the Microsoft Foundry announcement and Microsoft Learn capability model; it is not an official Microsoft architecture diagram.

1. Structured outputs and strict tool use

Structured outputs constrain a response to a declared format instead of relying on a retry loop after malformed JSON. Microsoft’s announcement describes JSON output formatting and strict tool use as complementary controls: one governs the model’s response shape, while the other constrains tool-call arguments.

That distinction is useful in production:

• Use an output schema when a downstream queue, database, or workflow expects a predictable object.
• Use strict tool schemas when a function must receive validated arguments.
• Keep business authorization outside the model. A schema can say that amount is a number; it cannot decide whether this user is allowed to refund that amount.

A minimal conceptual request using the Anthropic-compatible client looks like this:

1from anthropic import AnthropicFoundry
2
3client = AnthropicFoundry(resource="my-foundry-resource")
4
5response = client.messages.create(
6    model="claude-sonnet-5",
7    max_tokens=1200,
8    messages=[
9        {"role": "user", "content": "Classify this support request."}
10    ],
11    output_config={
12        "format": {
13            "type": "json_schema",
14            "schema": {
15                "type": "object",
16                "properties": {
17                    "category": {"type": "string"},
18                    "needs_human": {"type": "boolean"}
19                },
20                "required": ["category", "needs_human"],
21                "additionalProperties": False
22            }
23        }
24    }
25)

The exact SDK and model support should be checked against the current Foundry documentation before copying this into a service. Treat schemas as contracts: version them, test refusal and validation behavior, and do not put secrets or unnecessary personal data into them.

2. Web search with citations

The web-search tool lets Claude investigate current information without a team maintaining its own crawler, search index, and citation plumbing. Microsoft’s post says the model can decide when to search and return citations tied to the relevant spans.

For a research agent, the important control is domain restriction. A regulatory monitor should prefer official regulator domains; a product-release monitor should prioritize company documentation and release notes. Search availability does not make every result trustworthy.

A safe application pattern is:

1. Ask Claude to search only approved domains for the task.
2. Preserve returned citations in the application record.
3. Fetch and review primary pages for claims that trigger an external action.
4. Apply a freshness rule, such as “published within seven days,” only when the use case requires it.

This is a good complement to the AI agent tool authorization threat model, because current information and permission to act are separate concerns.

3. Web fetch for known documents

Web fetch handles the next step after discovery: retrieve and analyze a specific page or PDF. Search is useful for finding candidates; fetch is useful when the application already has a URL or needs the full source document.

A retrieval workflow should preserve provenance:

• Store the URL, retrieval time, and document hash where practical.
• Keep the answer linked to the exact source spans or citations.
• Treat fetched instructions as untrusted content; a page can contain prompt-injection text.
• Do not allow a fetched page to change tool permissions or system policy.

For compliance workflows, fetch is not a substitute for an approved document repository. It is a model-access mechanism and should sit behind URL, domain, and content controls.

4. MCP connector for remote tools

The MCP connector allows a Foundry-hosted Claude deployment to connect to a remote MCP server without every application implementing its own MCP client, session lifecycle, and tool-schema translation.

That can shorten integrations with systems such as Jira, ServiceNow, Confluence, or internal APIs. It also concentrates risk at the connector boundary. Use an explicit allowlist for tools, especially for identity, finance, deletion, deployment, and write operations.

A useful boundary looks like this:

Microsoft’s announcement notes that Azure-hosted inference can keep prompts and completions within Azure, while also noting that usage metadata and content flagged by Anthropic safety systems may egress. The independent Enera analysis also highlights that MCP connector traffic deserves a separate data-handling review and should not be assumed to inherit every zero-data-retention property.

5. Tool search for large tool catalogs

Injecting hundreds of tool definitions into every prompt increases context pressure and can make selection less reliable. Tool search changes the loading model: the agent discovers relevant tools instead of receiving the entire catalog at the beginning of every turn.

Use it when a unified enterprise agent spans many systems. Do not use it as a reason to expose every internal operation to one universal identity. Discovery improves context management; it does not improve authorization by itself.

A practical rollout is to group tools by domain, attach precise descriptions and examples, measure selection accuracy, and keep write tools behind approval. Read-only tools should also be scoped because data exposure is a security event even when no mutation occurs.

What Azure-hosted Claude does not solve

The new capabilities reduce scaffolding, not responsibility. A production design still needs:

• Server-side authorization for every consequential tool call.
• Tenant and user identity propagation through the full request.
• Prompt-injection and malicious-document tests for web and MCP inputs.
• Timeouts, retries, idempotency keys, and circuit breakers.
• Redaction and retention rules for prompts, tool payloads, citations, and traces.
• Human approval for financial, legal, account, deployment, or irreversible actions.
• A kill switch that disables tools without asking the model to cooperate.

The Microsoft RAMPART and Clarity safety guide is a useful related read for evaluating agent behavior before connecting these capabilities to production systems. Teams migrating MCP infrastructure can also compare the MCP C# SDK 2.2 stateless HTTP guide with the connector’s managed approach.

Recommended architecture for a first deployment

Start with a read-heavy workflow: research, document classification, or ticket summarization. Keep web search and fetch constrained to approved domains. Connect one read-only MCP server. Require structured output and validate it in application code. Measure citation completeness, tool-selection accuracy, latency, token cost, and false-positive escalations before adding writes.

Do not begin with a universal “do anything” agent. A narrow agent with explicit tools is easier to evaluate, easier to disable, and easier to explain to security reviewers.

FAQ

Is Azure-hosted Claude the same as using the Anthropic API?

No. Microsoft Foundry provides an Azure-hosted deployment path with its own model availability, billing, authentication, quotas, and documented API surface. The Anthropic-compatible Messages API makes integration familiar, but hosting and operational commitments still matter.

Does MCP connector make an agent secure by default?

No. It removes client-side MCP plumbing. Your team still owns server configuration, tool allowlists, identity, authorization, audit logging, and approval boundaries.

Should every agent use tool search?

No. It is most useful when the tool catalog is large enough to create context and selection problems. For a small, stable set of tools, explicit registration is simpler and easier to test.

Can structured outputs guarantee a correct answer?

No. They can constrain shape and, with strict tool use, argument validity. They cannot guarantee factual accuracy, safe intent, correct permissions, or a valid business decision.

Bottom line

Microsoft Foundry’s August 2026 update makes Azure-hosted Claude more practical for agent builders who need current information, remote tools, predictable outputs, and a manageable tool catalog. The architectural win is avoiding four classes of undifferentiated scaffolding: JSON repair loops, search and fetch infrastructure, custom MCP clients, and oversized tool prompts.

The safe adoption path is incremental. Keep the model inside a narrow workflow, preserve citations and provenance, validate every output, authorize every action outside the model, and add write capabilities only after the read path has measurable evidence behind it.

Sources and visual credits

• Microsoft Foundry Blog: five new Claude capabilities — primary announcement, August 17, 2026.
• Microsoft Learn: Claude models in Microsoft Foundry — hosting, model availability, APIs, and capabilities.
• Anthropic tool-use documentation — tool execution model, client/server tools, MCP connector, and tool search concepts.
• Enera: Claude Agents Land on Azure — independent analysis of the enterprise and data-handling implications.
• Original Mermaid request-flow diagram by Essa Mamdani; adapted from the cited Microsoft and Anthropic documentation, not an official product screenshot.