Plumbing and perimeter: MCP becomes the socket, Agent 365 Skills the identity, and memory the new attack surface
Last week the meter turned on. This week the agent got standardized plumbing and a security perimeter. Agent 365 Skills made governed identity a one-line install for any framework. Two new MCP servers, Planner and the Azure Functions extension, turned the protocol into the default socket. Foundry added production OCR and an agentic observability agent at GA. And in the same days, two Microsoft security teams warned that an agent's memory is now the thing attackers go after.
This week's thread: the agent got plumbing and a perimeter
Build named the parts. Last week's GA wave turned the meter on. This week the connective tissue arrived. @Charles Lamanna's platform shipped Agent 365 Skills, which adds enterprise identity, observability, and governance to an existing agent through a single install, regardless of whether it was built on LangChain, Semantic Kernel, Foundry, or the Claude SDK. The same days, two new MCP servers, the Planner server (part of Work IQ MCP) and the Azure Functions extension (host your own), made the Model Context Protocol the default way an agent reaches a tool. Foundry thickened underneath with production OCR, an open-weight model, and an observability agent at GA. And the security conversation moved one layer in: as agents gain persistent memory, two Microsoft teams published defenses for memory poisoning in the same week. The pattern of the week is that the standard plumbing and the standard perimeter landed together.
Signal of the week
Agent 365 Skills: any agent to a governed identity in minutes
Announced in preview on June 22, Agent 365 Skills are installable skills you add from your coding assistant with a natural-language prompt instead of hand-editing manifests and wiring OpenTelemetry exporters. One command, gh skill add microsoft/agent365-skills, gives an existing agent Agent 365 identity, observability, governance, secure Microsoft 365 data access, and messaging, plus Work IQ Mail and Calendar tools and built-in validators. It is framework-agnostic: it works with agents built on LangChain, OpenAI, Semantic Kernel, Azure AI Foundry, or the Claude SDK.
Why it matters
Last week metering made an agent a governed, billed asset; the gap was how long it took to get there. This collapses the path from days of manifest and telemetry plumbing to a single install, and because it is framework-agnostic, the agent your team already built gets an enterprise identity without a rewrite. The catch is the same as always: in minutes still means you own what those skills expose, so scope the Microsoft 365 data access before you ship it.
1MCP becomes the universal socket
The Model Context Protocol stopped being a Foundry feature this week and became the default way an agent reaches a tool, on both the client and the host side.
The Microsoft Planner MCP Server makes work management a tool call
Previewed June 23 as part of Work IQ MCP, the Planner MCP Server lets custom agents manage and automate work across Planner plans, connecting planning, execution, and tracking inside agent-driven workflows. It exposes Planner as a standard MCP surface rather than a one-off Graph integration.
Why it matters
Work management is now something an agent does as a first-class tool call. Create and update plans, track tasks, no bespoke wiring. Pair it with the Agent 365 Skills install above and a custom agent gets both a governed identity and a work-tracking tool in one afternoon, which is roughly the unit of effort this stack is collapsing toward.
The Azure Functions MCP extension turns a serverless function into a governed MCP server
Previewed June 24, the Azure Functions MCP extension now supports the full MCP primitive set, tool, resource, and prompt triggers, across .NET, Java, Python, TypeScript, and JavaScript. It adds native MCP Apps for interactive UIs, built-in MCP authentication with Entra ID and on-behalf-of token flows, .NET fluent builder APIs, and a one-click portal experience for configuring MCP auth in preview. Deeper Foundry integration that surfaces Functions MCP servers in the Foundry Toolbox is planned.
Why it matters
This is the host side of the socket. @Jeff Hollan's Foundry team made it possible to stand up a remote MCP server as a serverless function, Entra-authenticated, and expose it to Foundry agents without hand-rolling the protocol, the auth, or the tool discovery. The on-behalf-of flow is the line that matters for enterprise: the server acts as the signed-in user, inside the permissions they already have, not as an over-scoped service principal.
2The Copilot surface opens up
SharePoint Copilot Apps bring interactive UI into the Copilot canvas
Previewed June 23, SharePoint Copilot Apps bring rich, interactive UX components into the Microsoft 365 Copilot canvas, built with any JavaScript stack and reusing existing SharePoint Framework investments across Copilot, SharePoint, and Teams. Copilot stops being text-only: users can review data, approve a request, or edit a record in place inside the conversation.
Why it matters
For any organization with an SPFx investment, this is the cheapest path to a custom Copilot experience, because the components you already maintain become interactive surfaces inside Copilot with no new platform or infrastructure. It also reframes Copilot extensibility: the question is no longer just what data you connect, but what interface you put in front of it.
3Foundry's model and operations layer thickens
Mistral Document AI with OCR 4 and Mistral Medium 3.5 arrive in Foundry
Mistral Document AI with OCR 4 went GA in the Foundry model catalog on June 23, with structured document understanding, paragraph-level bounding boxes, and block classification. Mistral Medium 3.5, an open-weight general-purpose model for reasoning, coding, and agentic workloads, followed June 24. Both deploy via real-time or serverless endpoints.
Why it matters
Two production building blocks for document and agent pipelines, both deployable now. OCR 4 is the one to note: paragraph-level bounding boxes make it a real extraction engine, not just a text dump, which is the front end of any document-processing agent. And an open-weight model in the catalog is portability insurance, the lesson the model layer kept teaching last week.
The Azure Copilot Observability Agent reaches GA
On June 23 Microsoft announced general availability of the Azure Copilot Observability Agent, powered by Azure Monitor, with autonomous operations in public preview. It reasons over your cloud's telemetry to surface and explain issues, the operations counterpart to the SRE Agent direction that surfaced last week.
Why it matters
The operations side of agents now has its own agent. Where a custom agent runs is becoming a place agents also watch, and an observability agent at GA is the difference between collecting Azure Monitor signals and having something reason over them. For anyone running agents on Azure, this belongs on the same architecture diagram as the runtime, not bolted on after an incident.
4The security perimeter moves to agent memory
Two Microsoft security teams warn that agent memory is the new attack surface
In two days, two teams published on the same risk. Microsoft Security's Guarding AI memory on June 22 set out how to protect agent memory against tampering and prompt-injection. The Foundry team followed on June 23 with guidance on defending memory in Foundry Agent Service, covering the extraction, persistence, and retrieval stages and the defenses against memory poisoning at each.
Why it matters
As agents gain persistent memory, and memory in Foundry Agent Service is in preview now, a poisoned memory is a durable compromise: it survives the session and quietly shapes every future action the agent takes. The defense is to treat memory as untrusted input, validate on write and scope on read, the same discipline you already apply to user input. Anyone enabling agent memory this quarter should read both posts before they turn it on.
5First-party agents reach the verticals
Microsoft Scout lands in healthcare and life sciences
Microsoft Scout, the always-on personal agent introduced June 2, got its first vertical playbooks on June 22: an industry walkthrough of Scout automating end-to-end multi-step tasks across apps, documents, and the web for healthcare teams, and a technical deep dive showing Scout's planning, tool use, and human-approval gates within security and compliance boundaries.
Why it matters
Vertical playbooks are how a horizontal agent actually lands, and the technical deep dive is the part that matters: it shows the approval gates, which is the first thing a regulated industry asks about. If you advise a healthcare or life-sciences client, treat this as the reference for agentic-but-governed, where @Jared Spataro's always-on agent meets the compliance boundary it has to live inside.
6The layers you do not own
The EU Council formally adopts the Digital Omnibus on AI today
After the European Parliament approved it on June 16, the Council is scheduled to formally adopt the Digital Omnibus on AI on June 29, the last legislative step. The text then goes to legal-linguistic revision, with signing expected July 8 and publication in the Official Journal expected in the second half of July; it enters into force three days after publication. The substance is unchanged: standalone high-risk obligations (Annex III) move to December 2, 2027, embedded ones (Annex I) to August 2, 2028, while the core risk-based provisions and the August 2, 2026 baseline hold.
Why it matters
The clock that started with the June 16 Parliament vote reaches its formal end today. Nothing in the substance moved since last week; the point is that it is now fixed law rather than a provisional deal, so the dates will not slip again. Your readiness work, Agent 365, Sentinel agent identities, Purview, is unchanged. You just now know what you are building toward.
The BIS warns that an AI bust could ripple from growth into credit
On June 28 the Bank for International Settlements cautioned that a downturn in AI investment could spill beyond technology, from economic growth into credit markets, given how concentrated the capital spending has become. It is the macro counterweight to a week of shipping, including Microsoft breaking ground on a roughly two-gigawatt datacenter campus in Pecos, Texas.
Why it matters
The institutions whose job is to ask what happens if the demand curve bends are starting to ask out loud, while the infrastructure bets assume it holds. This is not a reason to slow an AI program; it is a reason to keep it tied to measured outcomes rather than to the investment cycle, so the value survives a correction in the market that funds the buildout.
Voices to follow
- Microsoft EVP - Copilot, Agents & PlatformCharles Lamanna
Executive Vice President for Copilot, Agents, and Platform at Microsoft. He owns the strategy behind Copilot Studio, Agent 365, and the Power Platform, so when the agent stack's direction shifts, it usually shifts because of a decision his org made.
Microsoft EVP - Copilot, Agents & Platform - Microsoft Principal Cloud Advocate - Power Platform + agentsDaniel Laskewitz
Principal Cloud Advocate at Microsoft, ex-Power Platform MVP and co-founder of Forward Forever. One of the clearest voices on multi-agent systems and Power Platform governance - the bridge between the maker community and the product teams.
Microsoft Principal Cloud Advocate - Power Platform governance + agents - Microsoft Principal PM - Copilot Studio (Power CAT)Henry Jammes
Principal Program Manager for Copilot Studio on the Power CAT team at Microsoft. Deep on agent-building mechanics, governance, and the release roadmap - a first-party source on what Copilot Studio can actually do.
Microsoft Principal PM - Copilot Studio (Power CAT) - Microsoft Partner Director - Foundry Agent ServiceJeff Hollan
Partner Director of Product at Microsoft, leading the Foundry agent platform: Agent Service, the Agent Framework, and the SDKs. The clearest source on how agents actually go from prototype to a hosted production runtime.
Microsoft Partner Director - Foundry Agent Service + Agent Framework - Microsoft Principal Group PM - DataverseJulie Koesmarno
Principal Group Product Manager at Microsoft, leading the Dataverse as Agent Data Platform team. Follow her to see where the governed data layer, MCP surface, and coding-agent plugins are heading before they ship.
Microsoft Principal Group PM - Dataverse as Agent Data Platform - Microsoft CVP - Security, Compliance, Identity & PrivacyVasu Jakkal
Corporate Vice President for Microsoft Security. Defender's AI agent posture risk, the Agent 365 security integration and the wider security-for-AI story all ship out of her organisation.
Microsoft CVP - Security, Compliance, Identity & Privacy - Copilot Studio MVPLisa Crosbie
6x Microsoft MVP, Practical AI for Business with Copilot and Agents at Barhead. Calm, hands-on voice on production-grade agent design - the one to follow when you want patterns you can ship, not just demo.
6x Microsoft MVP - YouTuber + International Speaker - ~21K followers - Microsoft Principal Cloud Advocate - Power Platform Advocacy LeadApril Dunnam
Principal Cloud Advocate and Team Lead for the Power Platform Advocacy team at Microsoft, and the face of Agent Academy. If a Copilot Studio feature or governance update ships, April has usually broken it down within 48 hours.
Microsoft Principal Cloud Advocate - Power Platform + AI Demystifier
Coming up
- July 1, 2026 · Copilot Cowork billing begins. The Frontier grace period ends, so set per-user and per-group Copilot Credit spend limits before the first metered invoice.
- July 8, 2026 · The Digital Omnibus on AI is expected to be signed, with publication in the Official Journal expected in the second half of July and entry into force three days later.
- Coming weeks · The fine-tuned Cowork 1 model arrives, to run routine Copilot tasks at a substantially lower credit cost than Opus 4.8.
- August 2, 2026 · Core AI Act provisions take effect. The Omnibus postponed the high-risk dates, not these: GPAI, prohibited-practice, and core transparency rules still start on schedule.
This week's question
This week handed you the standard plumbing and the standard perimeter in the same days. Two questions for Monday: now that Agent 365 Skills can add a governed identity in one install and MCP servers expose your tools in another, which of your custom agents is still running without either? And the harder one: if any of your agents has persistent memory, who can write to it, and would you notice if something poisoned it?
Get Agentic Weekly in your inbox
Every Monday morning. Unsubscribe any time.