NO.32 You have a Microsoft Foundry project that includes three agents named FinanceOrehestrator, invoiceValidationAgent, and PayaentApprovalAgent. The agents interact with an external agent named vendorfiegotiationAgent. The agents are configured as shown in the following table.

You need to recommend an identity structure for the agents.
What should you recommend? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.


Explanation:
InvoiceValidationAgent and PaymentApprovalAgent: One blueprint and one agent identity per agent role; VendorNegotiationAgent: An independent blueprint, one agent identity, and one agent user account.
Invoice validation and payment approval are distinct finance roles with different ERP permissions, so each should have its own logical agent identity for least-privilege access and audit attribution. They can remain within the same finance trust boundary while using separate identities. The vendor-negotiation agent operates across an external supplier boundary and should therefore use an independent blueprint/trust boundary. Its dedicated Exchange Online mailbox introduces an additional Microsoft 365 requirement: Microsoft Entra Agent ID supports associating an agent identity with an agent user account when the agent needs resources that require a user object, such as Exchange mailboxes or Teams. Sharing a single identity across all roles would blur audit ownership and expand compromise impact. The answer therefore matches Microsoft ‘ s current agent-identity separation model. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.
Official Microsoft reference: Microsoft Entra Agent ID – plan agent identity architecture

Topic 1, Contoso Ltd Case Study
Overview – Contoso, Ltd. is a health provider. The company is building an Azure-based multi-agent solution to streamline patient triage, access historical medical records, and schedule specialist appointments. Existing Environment – Microsoft Foundry – Contoso has a Microsoft Foundry project named HealthAssist that contains the following agents: Patient Intake: A public-facing chat interface where patients describe their symptoms Record Retrieval: An internal system that retrieves a patient ‘ s past medical history from a secure database Scheduling: Integrates with an external third-party booking system by using a Model Context Protocol (MCP) server Lead Orchestrator: A workflow agent that makes decisions based on the output of the other agents Knowledge Base – Contoso uses a Retrieval-Augmented Generation (RAG) system that contains clinical documents. Only the Patient Intake agent can access the RAG system. Problem Statements – Contoso identifies the following issues: The MCP server used by the Scheduling agent frequently times out during peak load. Patients report that during the intake process, the session frequently times out silently without indicating why. The issue occurs during workflow execution. Occasionally, the Patient Intake agent cannot extract relevant symptoms when patients provide verbose personal stories that are irrelevant to the medical issue. When the Patient Intake agent engages in long, multi-turn conversations with patients, the accumulating conversation history causes high latency due to massive prompt sizes and risks that exceed the model ‘ s context window. Requirements – Business Requirements – Contoso identifies the following business requirements: A physician must approve any triage assessments that recommend an emergency room visit.
HealthAssist must be able to handle large spikes in concurrent patient intake requests during flu season.
Before releasing updates to HealthAssist, the clinical team must review the accuracy of the Lead Orchestrator agent triage routing decisions against a set of historical test cases. Safety Requirement – Contoso identifies the following safety requirements: Implement a robust guardrail strategy to prevent HealthAssist from providing inappropriate medical diagnoses. Ensure that all public-facing agents block violence and hate speech. Prevent hardcoding new logic into the agents ‘ core prompt. Consultant Proposal – A consulting firm proposes the following solution to address various requirements and issues: Add a guardrail that has the highest sensitivity for all controls. Add a system prompt message to direct the agent to ignore hate speech. Implement a short- term memory context window that prompts patients multiple times to verify their symptoms. Add a system prompt message to direct the agent to recommend an emergency room visit if the patient is having heart palpitations. Security Requirements – Contoso identifies the following security requirements: Ensure that the agents do NOT have overlapping permissions to prevent lateral movement. Prevent the agents from accessing patients ‘ data outside of the current patient context. Ensure that all API keys are securely stored and rotated.
Follow the principle of least privilege, when possible. Performance Requirements – Contoso identifies the following performance requirements: Token usage must be monitored. Long-term semantic memory must be isolated by patient.