wal.sh
home > events > microsoft-frontier-transformation-week > 2026 · Jul 20, 2026
conferencesai-agentsagent-governancemicrosoftfoundrypurviewprovenanceevals

Microsoft Frontier Transformation Week 2026

Table of Contents

Microsoft Frontier Transformation Week :conference:ai-agents:microsoft:

Microsoft Frontier Transformation Week (Aug 11–14 2026, Digital, 12:00–15:30 EDT) Vendor "Frontier Firm" transformation event; decision-maker-weighted, ~50% keynote air. Substrate under the marketing: Foundry Agent Service + Microsoft Agent Framework, Agent 365 + Purview SDK, Microsoft IQ (Foundry/Fabric/Work IQ). Register free.

Alignment verdict [I]

The event's register is precisely the growth-ops / AI-hype vocabulary the filter strips: "digital labor," "trusted agents," "operating model," "rearchitect work for growth." Audience is business decision-makers; two of four daily slots are keynote.

Against this corpus — deterministic simulation testing, TLA+/Quint, CALM, FP — the event is mostly orthogonal. Enterprise agent-ops is a different discipline from program correctness. The overlap is one thread, and it is worth naming precisely:

  • The eval + control-spec layer is the only correctness-adjacent surface. Microsoft shipped, at Build 2026, an "Open Trust Stack": ASSERT (Adaptive Spec-driven Scoring for Evaluation and Regression Testing — policy → measurable eval), the Agent Control Specification (ACS — a portable policy YAML enforcing deterministic controls at five checkpoints: input / LLM / state / tool-execution / output), and evaluators pitched as "unit tests for agentic systems." ACS's 5-checkpoint deterministic model is the closest thing in the stack to a behavioral invariant rather than a probabilistic gate. That is the artifact to read if you read one. [E]
  • Everything else is probabilistic. Of the shipping agent evaluators, exactly one is deterministic/ground-truthed (Task Navigation Efficiency, expected_actions with exact/in-order/any-order match); the rest are LLM-as-judge, grader-model-dependent, non-deterministic. So "testable contract" degrades to "thresholded pass/fail on a stochastic judge" everywhere outside ACS. [E]

Refutation condition. This verdict flips to "attend broadly" only if the research program is agent-ops governance (identity, audit, lifecycle) rather than correctness/verification. If the program stays formal-methods-first, the honest recommendation is: skim ACS/ASSERT as prior art for agent contracts, ignore the rest, do not spend four afternoons.

Cost of being wrong: low — the sessions are free and recorded; the only stake is attention. Triage accordingly.

Agenda by topic

Payload rating: P = engineering substance · ~ = partial/security-platform · air = keynote/SMB/skilling.

Day 1 — Aug 11 (Tue)

  • 12:00 Set the frontier: redefining growth w/ human judgment + trusted agents — air (regional keynote)
  • 13:00 Bring AI into the flow of work — air (M365 Copilot / Dynamics / Power Apps positioning)
  • 14:00 Build context-aware agents at scale with Microsoft IQ — P (Foundry IQ, Fabric IQ, Work IQ; grounding + provenance)
  • 15:00 Becoming a Frontier Firm as SMB — air

Day 2 — Aug 12 (Wed)

  • 12:00 Turning innovation into action; customer-zero + security — ~ (ambient/autonomous security framing)
  • 13:00 Secure the foundation. Scale the future. — ~ (trusted platform, data protection, governance)
  • 14:00 Build & host enterprise-grade agents with Foundry — P (design→evaluate→deploy→operate; Agent Service + Agent Framework)
  • 15:00 Drive growth w/ AI-powered productivity + security (M365) — air

Day 3 — Aug 13 (Thu)

  • 12:00 Build your Frontier Center of Excellence + skilling — air
  • 13:00 From one frontier agent to operating at scale — ~P (Microsoft IQ as shared context layer; context inheritance / blast radius)
  • 14:00 Build secure, enterprise-ready agents with Agent 365 — P (Agent 365 SDK + Purview SDK; runtime visibility, identity, lifecycle governance)
  • 15:00 AI-ready security for SMB — air

Day 4 — Aug 14 (Fri)

  • 12:00 Four pillars of becoming a Frontier Firm (MasterClass preview) — air
  • 13:00 Modernize foundation + unify data estate for AI — ~P (Azure Copilot, GitHub agents, OneLake, Fabric IQ, Foundry IQ; data provenance)
  • 14:00 From CLI to PR: automating the path to merged code — P? (GitHub Copilot agentic loop; plan→build→review→merge — conditional on agent-assisted-dev interest)
  • 15:00 Build your first AI agent (Foundry) — air (intro)

Sessions worth a hold

Four with real payload; ranked. Holds below are org timestamps in America/New_York (EDT).

TODO Foundry lifecycle: design→evaluate→deploy→operate

Watch what evaluate concretely means — this is the refutation surface. Is there a contract on agent behavior, or LLM-judge vibes? (See dossier §Foundry.)

TODO Agent 365 + Purview SDK: identity, audit, lifecycle governance

The governance-tuple session. Map claims onto principal/authority/provenance/audit/ revocation as it runs; note where DLP is detect-only vs enforcing. (See dossier §Agent365.)

TODO Microsoft IQ: grounding + provenance

Provenance/grounding layer. Distinguish real data-lineage (Fabric IQ ontology) from RAG-rebranded retrieval (Foundry IQ). (See dossier §MicrosoftIQ.)

MAYBE From CLI to PR (agentic dev loop)

Only if the agent-assisted-dev / EDD-to-merge loop is in scope. Otherwise a Copilot demo.

Research dossier — the three substrate pieces

Scope note: findings gathered 2026-07-20 from first-party Microsoft Learn/devblog sources plus secondary corroboration. Shipping-status labels are the load-bearing claims; treat day-precision GA dates as [P] where sourced from admin blogs rather than press releases.

Foundry Agent Service + Microsoft Agent Framework   foundry lifecycle evals

Contract. Two coupled layers. Microsoft Agent Framework (MAF) — open-source (MIT) SDK for .NET + Python (Go in preview), positioned as successor to both Semantic Kernel and AutoGen (convergence, not code-merge; migration guides provided). GA'd v1.0 ~2026-04-03; active minor cadence (Py 1.8.0, .NET 1.9.0 by June). Foundry Agent Service — managed runtime inside Microsoft Foundry (the 2026 rebrand of Azure AI Foundry; formerly Azure AI Agent Service), framework-agnostic host (MAF, LangGraph, OpenAI/Anthropic SDKs, raw code). MAF = what you build with; Foundry Agent Service = the control/runtime plane. [E]

Shipping status [E]

  • MAF 1.0: GA (~2026-04-03), .NET + Python. Go: preview.
  • Foundry Agent Service core + Prompt agents: GA. Hosted agents (containerized, autoscale, dedicated Entra identity): announced Build 2026 (2026-06-02) as "GA in 30 days" → should be GA by now; verify current state. [P]
  • Preview (the production pitch leans on this): Toolboxes/tool-search, all three Memory types, Agent Optimizer (private), Routines, Autopilot + Entra Agent ID, A2A inbound, Rubric evaluator, Foundry IQ serverless tier, CodeAct (Hyperlight micro-VM).

Lifecycle contract — what "evaluate" actually means [E]

  • 9-phase lifecycle with immutable versioned snapshots (rollback) — this is the real provenance primitive: an agent version is a pinned, reproducible artifact.
  • Evaluator library is real, code-first (azure_ai_evaluator, builtin.<name>), framed as "unit tests for agents." But the coverage split matters:
    • GA, deterministic: Task Navigation Efficiency (only ground-truthed one; expected_actions).
    • GA, tool-mechanics: Tool Call Accuracy / Selection / Input / Output / Success — all process-level, all still effectively judge-scored on tool traces.
    • Preview, LLM-judge: Task Completion, Task Adherence, Intent Resolution, Quality Grader, Customer Satisfaction. Non-deterministic, grader-model-dependent (gpt-*-mini recommended).
    • Unsupported for several first-party tools (Azure AI Search, Bing Grounding, SharePoint, Code Interpreter, Fabric Data Agent, Web Search) — coverage holes.
  • No native CI/CD eval task — you wire the Python SDK into your own pipeline (cloud-evaluation batch).

Governance surface [E]

  • Identity: dedicated Microsoft Entra Agent ID per agent (not a shared service principal).
  • Tool auth: managed credentials + On-Behalf-Of; key/Entra/OAuth-passthrough/none modes; MCP catalog.
  • Tracing: OpenTelemetry → Application Insights; per-call + per-tool traces; replay (preview).
  • Open Trust Stack (the actual governance model): ASSERT (policy→eval, cross-framework, OSS) + Agent Control Specification (portable policy YAML, deterministic 5-checkpoint runtime controls — input/LLM/state/tool/output) + Rubric (auto-weighted criteria). The loop: ASSERT finds risk → ACS applies a runtime control → ASSERT re-confirms → observe → optimize.

Refutation notes [I]

  • Preview-heavy production story; the strongest deterministic claim (ACS) is months old with logo-slide adoption (KPMG/Zscaler/IBM/CrewAI cited), not proven ecosystem uptake.
  • "Structured evals" = yes; "testable behavioral contract" = mostly probabilistic gates outside the single deterministic evaluator + ACS.
  • Vendor benchmarks (CodeAct "52.4% latency / 63.9% token", memory "7–14% gains") are Microsoft-internal, unverified.
  • Rebrand churn (Azure AI Agent Service → Foundry Agent Service; Azure AI Foundry → Microsoft Foundry; "foundry-classic" already in Learn) is a tell the surface is still moving.

Agent 365 + Purview SDK   agent365 purview identity audit

Contract. Agent 365 = control plane for agents in the M365 Admin Center — register, identify, secure, govern agents regardless of origin (Copilot Studio, Foundry, OSS, third-party incl. Bedrock/n8n). Not a build runtime; the governance envelope around agents built elsewhere. Identity substrate = Entra Agent ID (agents as first-class directory principals). Data/compliance substrate = Microsoft Purview (DSPM for AI + Purview SDK). Five pillars: Registry · Access Control · Visualization · Interoperability · Security. [E]

Shipping status [E]

  • Announced Ignite 2025-11-18 (Frontier early-access, no SLA). GA worldwide 2026-05-01 [P] (standalone SKU or bundled in M365 E7).
  • Preview at GA time — and these are exactly the enforcement primitives that matter: agent-identity creation, identity blueprints, Auth SDK (sidecar), non-MS agent onboarding, Copilot Studio migration; Conditional Access for agents (public preview 2026-07-07); Defender agent protection (the "Security" pillar's threat layer).
  • Purview SDK for Agent Framework: GA (Microsoft.Agents.AI.Purview / agent-framework-purview).
  • Net: SKU is GA; register + observe in prod is real, enforce access is preview-gated.

Purview SDK — what a developer actually instruments [E]

  • Middleware one-liner: .WithPurview(credential, new PurviewSettings("...")) / PurviewPolicyMiddleware.
  • Graph surface: Compute Protection Scopes (pre-flight: which DLP/label policies apply), Process Content (inline DLP eval + audit log per prompt/response), sensitivity-label compute (computeinheritance, usagerightsincluded). Perms: ProtectionScopes.Compute.All, Content.Process.All, ContentActivity.Write.
  • Feeds unified audit log, Communication Compliance, Insider Risk, eDiscovery, Data Lifecycle.
  • Per Agent 365 instance: auto-enabled audit + sensitive-data classification; DSPM→AI observability = per-agent 30-day risk-ranked activity view; covers agent↔human, agent↔tool, agent↔agent.

Governance-tuple mapping [I]

Vertex Coverage Note
principal (who/what) covered Entra Agent ID = first-class identity; blueprints encode lineage (preview)
authority / scope partial CA (preview) + Identity Governance packages; no declarative per-action scope
provenance of action partial Process Content + audit capture content/interactions; new content does not inherit source labels
audit trail strong unified audit log, Activity Explorer, eDiscovery, retention — most mature vertex
revocation weakest "block high-risk identity" CA (preview) + deprovision; no org-wide kill-switch

Refutation notes [I]

  • "Control plane" real but partly aspirational at GA: you can register/observe in prod; the CA enforcement that makes it a control plane was still preview through mid-2026.
  • DLP "enforcement" overstated: Purview doc explicitly warns agents don't recognize DLP block actions — owners must monitor. Treat as detect-and-audit, not closed-loop prevention.
  • Label-inheritance gap + encryption-without-labels unsupported → real classification holes.
  • Licensing gravity: most enforcement value sits behind Entra P1/P2 + M365 E5/E7 on top of the Agent 365 license. "Governance included" = "governance available if you buy the stack."

Microsoft IQ — Foundry IQ / Fabric IQ / Work IQ   microsoftiq provenance grounding

Contract. Microsoft IQ = architecture brand (not a SKU) for permission-aware "context layers" grounding agents, split by context type: Work IQ (work/collab context over MS Graph), Fabric IQ (data/semantic context over OneLake + ontology), Foundry IQ (knowledge/retrieval for pro-code agents over Azure AI Search agentic retrieval). Each standalone; sources are NOT interoperable across layers — the main interconnect is a Foundry agent mounting Work/Fabric IQ as knowledge sources. [E]

By layer [E]

  • Foundry IQ — managed knowledge over Azure AI Search agentic retrieval. Knowledge base (shareable, reasoning-effort knob) + sources (indexed: Blob/OneLake/SharePoint/index; remote always-current: SharePoint via Copilot Retrieval API, Web via Bing). Agentic retrieval = query decomposition + hybrid + semantic rerank; prefers extractive output with citations (span-level provenance). ≈ managed agentic RAG, not a novel primitive.
  • Fabric IQ — semantic layer over OneLake: Power BI semantic models → Ontology (preview) (entity types, typed directional relationships, data-binding to lakehouse/eventhouse/ semantic models, NL2Ontology; needs Graph-in-Fabric at tenant level). The one substantively new capability. Digital-twin framing (cross-domain reasoning).
  • Work IQ — semantic layer above MS Graph (not a replacement). Work IQ API GA 2026-06-16: 7 read-only Graph scopes, Context API (grounding blocks), Chat API (cited answers), per-agent Workspaces (durable tenant-boundary scratch). Consumption-billed via Copilot Credits.

Provenance & grounding substance [E]/[I]

  • Governance is the genuinely differentiated part: ACL sync on indexed sources, query-time enforcement under the caller's Entra identity, Purview sensitivity-label honoring, security trimming at retrieval. Caveat: only holds where the source supports it (SharePoint yes; raw Blob may not). [E]
  • Provenance = citation-to-source + ontology data-binding lineage. No unified cross-IQ provenance graph — provenance is per-layer, sources don't cross. [E]
  • Is grounding just RAG rebranded? On retrieval, largely yes (Foundry IQ = agentic RAG over pre-existing AI Search). The novel substance is (a) governed permission-trimmed retrieval, (b) Fabric IQ ontology/semantic-lineage — genuinely new, but preview. [I]

Shipping status [E]

  • Foundry IQ: partial GA (knowledge bases + core sources + security GA; serverless/dev tier
    • newer sources preview 2026-06).
  • Fabric IQ: preview-heavy (Power BI semantic model + Data Agent GA; Ontology / Graph / Plan / Operations Agent preview).
  • Work IQ: GA (API GA 2026-06-16).

Refutation notes [I]

  • "Microsoft IQ" is architecture branding, not a purchasable product (corroborated: Directions on Microsoft, James Serra).
  • Foundry IQ = repackaged Azure AI Search agentic retrieval; Work IQ = semantic layer over Graph + M365 index. Real new value = packaging + governance, not the retrieval algorithm.
  • Fabric IQ Ontology is the real new thing but preview, needs tenant Graph-in-Fabric, and refreshes on schedule not live — "digital twin / real-time" exceeds shipping reality.
  • "Unified context" oversells interop: the docs' own limitation (non-interoperable sources) undercuts the single-pane framing.

Governance stack — how the pieces compose

ms-agent-stack.png

Machine-readable session triage

Tangles a session-triage manifest for programmatic use (agenda import, hold generation). 

event: Microsoft Frontier Transformation Week 2026
when: 2026-08-11/2026-08-14
tz: America/New_York
sessions:
  - day: 2026-08-11
    time: "14:00-15:00"
    title: Build context-aware agents at scale with Microsoft IQ
    payload: high
    topic: [microsoft-iq, foundry-iq, fabric-iq, work-iq, provenance]
    hold: true
  - day: 2026-08-12
    time: "14:00-15:00"
    title: Build & host enterprise-grade agents with Foundry
    payload: high
    topic: [foundry-agent-service, agent-framework, lifecycle, evals]
    hold: true
  - day: 2026-08-13
    time: "13:00-14:00"
    title: From one frontier agent to operating at scale
    payload: medium
    topic: [microsoft-iq, context-inheritance, blast-radius]
    hold: false
  - day: 2026-08-13
    time: "14:00-15:00"
    title: Build secure, enterprise-ready agents with Agent 365
    payload: high
    topic: [agent-365, purview-sdk, identity, audit, governance-tuple]
    hold: true
  - day: 2026-08-14
    time: "13:00-14:00"
    title: Modernize foundation & unify data estate for AI
    payload: medium
    topic: [onelake, fabric-iq, foundry-iq, data-provenance]
    hold: false
  - day: 2026-08-14
    time: "14:00-15:00"
    title: "From CLI to PR: automating the path to merged code"
    payload: conditional
    topic: [github-copilot, agentic-dev, edd]
    hold: maybe

Open questions / refutation conditions

  • Is ACS a real invariant or a policy DSL with runtime hooks? Read the Agent Control Specification spec directly (microsoft.github.io/agent-governance-toolkit). Refutation: if the "deterministic 5 checkpoints" reduce to string-match guardrails, it is not a contract in any load-bearing sense.
  • Does "evaluate" gate deployment or just report? If evaluators are advisory (no publish-blocking threshold enforced by the platform), the "unit tests for agents" framing is aspirational.
  • Hosted-agents GA state as of 2026-07-20 (announced "GA in 30 days" on 06-02).
  • Revocation: is there any org-wide agent kill-switch, or only per-identity CA blocks? The absence is a governance gap worth confirming before trusting the control-plane framing.

Sources