{"id":4035,"date":"2026-10-06T08:00:10","date_gmt":"2026-10-06T15:00:10","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/azure-sdk\/?p=4035"},"modified":"2026-10-05T13:46:29","modified_gmt":"2026-10-05T20:46:29","slug":"azure-functions-agent-binding","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/azure-sdk\/azure-functions-agent-binding\/","title":{"rendered":"Bring agentic reasoning to Python function apps with Azure Functions Agent bindings (preview)"},"content":{"rendered":"

Azure Functions applications already have a strong model for event-driven work: a trigger starts the function, bindings connect it to other services, and application code validates input and controls the result. AI reasoning doesn’t need to replace that model.<\/p>\n

Agent bindings for Python function apps add reasoning as a bounded step inside it. The binding constructs a Microsoft Agent Framework Agent<\/code> from Markdown instructions and injects it into a Python handler. The handler still decides what data the Agent sees, when to invoke it, and what to do with the response.<\/p>\n

The same model also works in Durable Functions. An orchestrator can schedule replay-safe Agent calls alongside regular activities, allowing a workflow to persist progress and continue after its original request ends.<\/p>\n

<\/i>Note<\/strong><\/p>Agent bindings are in preview. Microsoft Agent Framework is currently the only supported provider, and Python 3.13 or later is required.<\/div><\/p><\/blockquote>\n

Why use an Agent binding?<\/h2>\n

Most production AI workflows contain two different classes of work.<\/p>\n

Deterministic code should own operations with a precise contract: parsing a request, validating a schema, enforcing authorization, calculating values, selecting fields, branching on known state, and writing a response. Agent reasoning is useful when the application needs to interpret context, classify content, summarize evidence, or make a bounded recommendation.<\/p>\n

Consider an order-processing API. The function can validate the order and reduce it to the fields relevant to fulfillment. An Agent can then assess operational risk and identify missing context. The function owns the HTTP contract and decides how that assessment affects later processing.<\/p>\n

This separation has practical benefits:<\/p>\n

    \n
  • Existing HTTP, queue, timer, Event Grid, and Service Bus triggers continue to work as they do in any Python v2 function app.<\/li>\n
  • Deterministic code controls the trust boundary and limits the data sent to the model.<\/li>\n
  • Agent instructions remain separate from runtime and model configuration.<\/li>\n
  • The handler can invoke the Agent conditionally, inspect its response, combine it with other results, or skip it entirely.<\/li>\n
  • The same Agent definition can participate in a Durable Functions orchestration when the process becomes stateful or long-running.<\/li>\n<\/ul>\n

    Project anatomy<\/h2>\n

    An Agent-enabled project is a standard Python v2 function app with a provider package and one or more instruction files:<\/p>\n

    agent-binding-app\/\r\n\u251c\u2500\u2500 function_app.py\r\n\u251c\u2500\u2500 host.json\r\n\u251c\u2500\u2500 requirements.txt\r\n\u251c\u2500\u2500 local.settings.json\r\n\u251c\u2500\u2500 order-fulfillment.agent.md\r\n\u251c\u2500\u2500 skills\/                         # Optional skills Agent Skills\r\n\u2502   \u2514\u2500\u2500 fulfillment-policy\/\r\n\u2502       \u2514\u2500\u2500 SKILL.md\r\n\u2514\u2500\u2500 mcp.json                        # Optional remote MCP servers<\/code><\/pre>\n
    The main pieces have distinct responsibilities:<\/p>\n\n\n\n\n\n\n\n\n\n\n
    Component<\/th>\nResponsibility<\/th>\n<\/tr>\n<\/thead>\n
    function_app.py<\/code><\/td>\nDefines triggers, deterministic logic, the client factory, and Agent invocation.<\/td>\n<\/tr>\n
    order-fulfillment.agent.md<\/code><\/td>\nContains raw UTF-8 instructions for one Agent.<\/td>\n<\/tr>\n
    requirements.txt<\/code><\/td>\nSelects the Agent provider and client packages.<\/td>\n<\/tr>\n
    local.settings.json<\/code><\/td>\nSupplies local storage, Foundry project, and model settings. Don’t commit this file.<\/td>\n<\/tr>\n
    skills\/<\/code><\/td>\nOptionally provides file-based Skills discovered by the provider.<\/td>\n<\/tr>\n
    mcp.json<\/code><\/td>\nOptionally configures remote MCP servers and tool allowlists.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
    An Agent name resolves to exactly one instruction file. For example, agent_name=\"order-fulfillment\"<\/code> resolves either order-fulfillment.agent.md<\/code> in the app root or agents\/order-fulfillment.agent.md<\/code>.<\/p>\n
    Add an Agent to an HTTP-triggered function<\/h2>\n
    This approach is useful when Agent reasoning can complete within the current function invocation and its result belongs in the immediate response.<\/p>\n
    Before starting the walkthrough, you need an Azure subscription and a Microsoft Foundry project with a deployed model. You also need Azure Functions Core Tools, Azurite or an Azure Storage account, and the Azure CLI. Your local identity must have access to the Foundry project.<\/p>\n
    Install the provider and client packages<\/h3>\n
    The example uses Python 3.13 or later and a Microsoft Foundry model through Microsoft Agent Framework. Its requirements.txt<\/code> contains:<\/p>\n
    azure-functions\r\nazurefunctions-agents-extensions-agent-framework[mcp]\r\nagent-framework-foundry\r\nazure-identity<\/code><\/pre>\n
    azurefunctions-agents-extensions-agent-framework<\/code> integrates the binding with Microsoft Agent Framework, and its mcp<\/code> extra installs the optional dependencies used to discover remote MCP servers from mcp.json<\/code>. agent-framework-foundry<\/code> supplies FoundryChatClient<\/code>, while azure-identity<\/code> supplies the credential used to authenticate during local development.<\/p>\n
    Configure the corresponding values in local.settings.json<\/code>:<\/p>\n
    {\r\n  \"IsEncrypted\": false,\r\n  \"Values\": {\r\n    \"AzureWebJobsStorage\": \"UseDevelopmentStorage=true\",\r\n    \"FUNCTIONS_WORKER_RUNTIME\": \"python\",\r\n    \"FOUNDRY_PROJECT_ENDPOINT\": \"https:\/\/<resource-name>.services.ai.azure.com\/api\/projects\/<project-name>\",\r\n    \"FOUNDRY_MODEL\": \"<model-deployment-name>\"\r\n  }\r\n}<\/code><\/pre>\n
    AzureWebJobsStorage<\/code> points the local Functions host to Azurite.<\/p>\n
    Define the Agent instructions<\/h3>\n
    Create order-fulfillment.agent.md<\/code> in the app root:<\/p>\n
    You are an order fulfillment specialist.\r\nThe supplied order has already been validated and minimized by application code.\r\nTreat the supplied fields as trusted facts. Explain operational risk, identify\r\nmissing fulfillment context, and return a concise, actionable response.<\/code><\/pre>\n
    The extension passes the entire file to the provider as Agent instructions. It doesn’t parse YAML front matter, model configuration, or tool declarations from this file. Model selection belongs in the client factory, and Python tools remain explicit application configuration.<\/p>\n
    Configure the chat client<\/h3>\n
    AgentFunctionApp<\/code> accepts a zero-argument client factory. This example creates a Foundry client from environment settings and authenticates with DefaultAzureCredential<\/code>:<\/p>\n
    def create_chat_client():\r\n    from agent_framework.foundry import FoundryChatClient\r\n    from azure.identity.aio import DefaultAzureCredential\r\n\r\n    return FoundryChatClient(\r\n        project_endpoint=os.environ[\"FOUNDRY_PROJECT_ENDPOINT\"],\r\n        model=os.environ[\"FOUNDRY_MODEL\"],\r\n        credential=DefaultAzureCredential(),\r\n    )<\/code><\/pre>\n
    The extension invokes this factory for each function invocation. That gives each invocation its own live client, Agent, and credential resources, which the extension closes when execution ends.<\/p>\n
    Keep deterministic preparation in code<\/h3>\n
    Before invoking the Agent, select the fields needed for the assessment:<\/p>\n
    def prepare_order(payload: dict, order_id: str) -> dict:\r\n    return {\r\n        \"order_id\": order_id,\r\n        \"customer_id\": payload[\"customer\"][\"id\"],\r\n        \"currency\": str(payload.get(\"currency\", \"USD\")).upper(),\r\n        \"shipping_country_or_region\": payload[\"shipping\"][\"country_or_region\"],\r\n        \"shipping_method\": payload[\"shipping\"][\"method\"],\r\n        \"items\": payload[\"items\"],\r\n    }<\/code><\/pre>\n
    This helper is intentionally ordinary Python. It creates an explicit boundary between incoming application data and model input. Production applications can apply schema validation, authorization, calculated fields, and stricter data minimization at this point.<\/p>\n
    Bind and invoke the Agent<\/h3>\n
    Create AgentFunctionApp<\/code>, retain the standard HTTP trigger, and add markdown_agent<\/code>:<\/p>\n
    app = AgentFunctionApp(client_factory=create_chat_client)\r\n\r\n@app.route(route=\"orders\/{orderId}\", methods=[\"POST\"])\r\n@app.markdown_agent(\r\n    arg_name=\"order_agent\",\r\n    agent_name=\"order-fulfillment\",\r\n)\r\nasync def process_order(\r\n    req: func.HttpRequest,\r\n    order_agent: Agent,\r\n) -> func.HttpResponse:\r\n    try:\r\n        prepared_order = prepare_order(\r\n            req.get_json(),\r\n            req.route_params[\"orderId\"],\r\n        )\r\n    except (KeyError, TypeError, ValueError):\r\n        return func.HttpResponse(\r\n            body=json.dumps({\"error\": \"Order failed validation.\"}),\r\n            status_code=400,\r\n            mimetype=\"application\/json\",\r\n        )\r\n\r\n    response = await order_agent.run(\r\n        json.dumps(\r\n            {\r\n                \"order\": prepared_order,\r\n                \"task\": \"assess fulfillment readiness\",\r\n            }\r\n        )\r\n    )\r\n    return func.HttpResponse(\r\n        body=json.dumps(\r\n            {\r\n                \"order_id\": prepared_order[\"order_id\"],\r\n                \"assessment\": response.text,\r\n            }\r\n        ),\r\n        mimetype=\"application\/json\",\r\n    )<\/code><\/pre>\n
    Two names connect the decorator to the function:<\/p>\n