In this blog post Microsoft Agent Framework Python 1.23 and .NET 1.26 Production Guide we will explain what the latest releases mean for organisations already running, or preparing to deploy, production AI agents.
The immediate challenge is not installing another software update. It is understanding whether that update changes how an agent accesses business systems, separates customer data, maintains conversations or performs actions on an employee’s behalf.
Microsoft released Python 1.23 on 22 October 2026 and the .NET 1.26 release followed on 23 October 2026. Both contain useful production improvements, but several changes affect security and application behaviour. This is not an upgrade that should move directly from a developer’s laptop into the live environment.
What Microsoft Agent Framework actually does
Microsoft Agent Framework is a software layer for building AI agents with Python or .NET. An AI agent goes beyond answering questions. It can connect to company data, call approved tools, follow a workflow and take actions such as creating a support ticket or preparing a customer response.
CPI Consulting helps organisations design, build and secure Azure AI solutions, from Azure OpenAI and Microsoft Foundry to agents, governance and production deployment.
Visit CPI ConsultingThe framework sits between the AI model and your business systems. It manages conversations, tools, stored information, multi-step processes and connections to services such as Azure OpenAI, OpenAI and other model providers.
That makes framework updates important. A small change in how sessions or tools are handled can affect privacy, reliability and which information an agent can see.
Python 1.23 tightens access to agent interfaces
One of the most important Python 1.23 changes is a new requirement for explicit authorisation when registering certain AG-UI endpoints. AG-UI is a protocol used to connect an agent to a user-facing application, such as an internal assistant or customer service screen.
In plain English, developers must now be clearer about who is permitted to use that interface. They need to specify an authorisation scope or formally declare that the application is intended for a single user.
This is a positive security change. It reduces the chance of an internal test interface being exposed without suitable access controls. However, it is also a breaking change, which means an existing application may stop starting or fail its deployment checks until its configuration is updated.
The business outcome is better control over who can reach an agent. For organisations following the Essential 8, the Australian government’s cybersecurity framework, this supports broader goals around restricting access and reducing unnecessary privileges. It does not create compliance by itself, but it removes an easy configuration mistake.
MCP 2.x changes require integration testing
Python 1.23 also introduces the compatibility foundation for MCP 2.x. MCP, or Model Context Protocol, is a standard way for AI agents to connect to external tools and data sources.
For example, an MCP connection might allow an agent to search SharePoint, retrieve a customer record or create an item in a project management system. Python 1.23 changes parts of the transport, error handling, connection lifecycle and message structure used by these integrations.
The long-term benefit is a cleaner and more consistent way to manage connections. The short-term risk is that custom MCP servers and older connectors may behave differently after the upgrade.
If your agent uses MCP, test more than whether it can connect. Confirm that it closes connections properly, handles timeouts, respects user permissions and fails safely when a tool is unavailable.
Our earlier Python 1.22 and .NET 1.25 roadmap covered the need to document hosting and state decisions. Python 1.23 makes that documentation even more valuable because connection ownership is now a specific upgrade concern.
Python reliability improvements reduce silent failures
Several Python 1.23 changes address problems that can be difficult to diagnose in production. These include safer handling of unexpected streaming failures, better propagation of errors through nested streams and improved separation of background completion tasks.
Streaming is the process that displays an AI response as it is generated rather than waiting for the entire answer. When streaming fails badly, users may see a response freeze halfway through while monitoring systems record little useful information.
The new handling should make these failures easier to contain and investigate. There are also fixes for functional workflows and Redis-backed context storage. Redis is commonly used to hold fast, temporary session information.
For a business, the outcome is fewer stuck conversations and clearer fault information. That can reduce support effort, but only if your monitoring captures the new error behaviour and alerts the right team.
.NET 1.26 improves separation between requests
The most significant .NET 1.26 change affects organisations hosting agents through AG-UI in ASP.NET applications. The framework can now resolve certain agents, session stores and isolation settings separately for each request.
Previously, an agent intended to exist only for one request could effectively be reused more widely because of how the hosting endpoint obtained it. This is known as a scoped dependency problem, but the business risk is simpler: information or settings associated with one user or customer could remain attached to an agent serving another request.
Version 1.26 changes this behaviour so request-specific agents can receive a fresh instance for each request. It also allows the application to choose an agent based on the incoming request.
This is especially important for multi-tenant applications, where one platform serves several customers. It can also help businesses running separate agents for finance, human resources and customer support through one application.
The improvement reduces isolation risk, but do not assume the upgrade automatically makes a multi-tenant design safe. Your team still needs to test identity, session storage, caching, logging and data retrieval.
Session deletion becomes easier to govern
.NET 1.26 adds a standard method for deleting an agent session from the session-store interface. A session contains the information needed to continue an agent interaction, which may include conversation history and operational context.
A consistent deletion method is useful for privacy requests, retention policies and support processes. Under Australian privacy obligations, organisations should know what personal information an AI system stores, where it is stored and how it can be removed.
The method does not automatically define your retention policy. Technology leaders should decide when sessions expire, who can request deletion and what audit record must remain after content is removed.
A practical production scenario
Consider a 200-person professional services business with an internal AI assistant. Employees use it to search policies, prepare client emails and retrieve project information from several systems.
The Python service uses MCP connectors, while the employee portal is hosted in .NET. Upgrading only the Python packages could break a connector or prevent an interface from starting because authorisation has not been declared. Upgrading only the .NET application could alter when agents and session stores are created.
A safer approach is to create a test group covering different departments and access levels. The team then checks whether one employee can ever see another employee’s conversation, whether failed tools produce controlled errors and whether session deletion works across every storage location.
Finding one isolation problem before deployment could prevent a privacy incident, customer notification costs and weeks of investigation.
What to do before approving the upgrade
- Build an integration inventory. List every model, MCP server, business system, session store and user interface connected to each agent.
- Review authentication. Confirm every AG-UI endpoint has an explicit access model and is not relying on an assumed internal boundary.
- Test tenant and user separation. Use separate test accounts and verify that conversations, tools, instructions and cached results do not cross boundaries.
- Run failure tests. Disconnect a tool, interrupt a streamed response and expire a user token. The agent should fail safely and create a useful alert.
- Test deletion and retention. Confirm that deleting a session removes the intended data without erasing records that must be retained for security auditing.
- Deploy gradually. Start with a small user group, monitor behaviour and keep a tested rollback plan.
# Example controlled Python upgrade
pip install --upgrade "agent-framework==1.23.0"
pytest
# Review .NET dependencies before changing versions
dotnet list package --include-transitive
dotnet testPackage names and versions should be pinned in your deployment process rather than updated automatically. Rebuild the same release in development, testing and production so that emergency troubleshooting does not become guesswork.
The decision is about risk rather than version numbers
Python 1.23 and .NET 1.26 move Microsoft Agent Framework in a positive direction. The stronger authorisation requirements, improved request isolation, clearer session deletion and reliability fixes all address real production concerns.
They also show why AI agents need more governance than an ordinary chatbot. Once an agent can access company systems and take action, framework upgrades must be treated like changes to a business application.
CloudProInc combines more than 20 years of enterprise IT experience with practical work across Azure, Microsoft 365, Microsoft Defender, OpenAI and Claude. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we assess AI deployments alongside identity, cloud security and Australian compliance requirements rather than treating the agent as an isolated experiment.
If you are not sure whether Python 1.23 or .NET 1.26 is safe for your current agents, we are happy to review the architecture and upgrade plan before it reaches production — no strings attached.