In this blog post Microsoft Agent Framework 1.x Production AI Agent Upgrade Guide we will explain why an apparently routine framework update can stop an agent, change its security boundaries or expose weaknesses in your operating controls.
As of November 2026, Python 1.25 and .NET 1.28 are the latest core releases. They provide useful safeguards for production AI, but they are not simple maintenance updates. Several changes affect permissions, connected tools, software compatibility and how agents handle failures.
What Microsoft Agent Framework actually does
Microsoft Agent Framework is the software foundation developers use to build AI agents in Python, .NET and Go. Python is commonly used by AI and data teams, while .NET is widely used for business applications built with Microsoft technology.
An AI agent does more than answer questions. It can interpret a request, decide what steps are needed and use approved tools to retrieve information or complete work. For example, an agent might check an order, draft a customer response and create a follow-up task.
CPI Consulting helps organisations design, build and secure Azure AI solutions, from Azure OpenAI and Microsoft Foundry to agents, governance and production deployment.
Visit CPI ConsultingThe framework provides the structure around that process. It manages conversations, connects models such as Azure OpenAI, OpenAI and Anthropic Claude to business systems, coordinates multi-step workflows and records what the agent did.
Think of the AI model as the brain and the framework as the operating environment. A capable brain is not enough if permissions, memory, approvals and failure handling are poorly controlled.
Why the latest releases matter to technology leaders
Previous CloudProInc guides covered the production controls introduced in Python 1.22 and .NET 1.25. The latest releases continue that direction, with stronger boundaries around tools, sessions and external connections.
The business issue is that stronger defaults can also break older implementations. An agent may suddenly lose access to a tool, time out while loading a large catalogue or fail because its server still uses an unsupported Python version.
1. Python 1.25 requires Python 3.11 or newer
Python 1.25 removes support for Python 3.10. If an agent is running on an older server image, container or application platform, the framework upgrade may fail before the agent even starts.
This is not just a developer inconvenience. It may require operating system updates, new deployment images, compatibility testing and changes to automated build processes.
Technology leaders should ask for an inventory of every production agent and its Python version. Unknown or manually maintained environments are where emergency upgrade costs usually appear.
# Record an exact production dependency
agent-framework==1.25.0
# Confirm the runtime before deployment
python --version
# Required: Python 3.11 or laterThe business outcome is predictable deployment. Pinning the exact version prevents a routine rebuild from silently installing a newer framework release that has not passed your testing process.
2. Tool discovery now has safer limits
Agents often connect to business tools through Model Context Protocol, or MCP. MCP is a standard way for an AI agent to discover and use approved functions, such as searching documents, reading customer records or creating service tickets.
Python 1.25 limits tool discovery to 100 pages or 1,000 items by default. Framework-managed requests also receive a 30-second timeout rather than waiting indefinitely.
These limits reduce the risk of a faulty or untrusted tool server consuming excessive time and computing resources. They can also reveal existing integrations that depend on very large catalogues or unusually slow responses.
Do not remove the limits simply to make an error disappear. First determine why the agent needs access to so many tools. Giving an agent hundreds of unnecessary actions increases cost, testing effort and the chance that it selects the wrong one.
3. Permissions are becoming more tightly connected to each session
One of the most important Python 1.25 changes binds live workflow sessions to a specific authorisation scope. In plain English, the framework is less willing to let one user or request reuse an agent session created under different permissions.
This reduces the risk of information or capabilities crossing between users, departments or customers. It is particularly important for shared agents used in finance, human resources, legal services or managed customer environments.
However, older applications may have been designed to reuse the same agent, workflow or session across many requests. Those designs need to be reviewed and, where necessary, changed so each request receives correctly isolated resources.
This supports the access-control principles behind Essential Eight, the Australian Government’s cybersecurity framework that many organisations are expected or required to follow. It does not make an agent Essential Eight compliant by itself, but it can strengthen the technical evidence behind your controls.
4. .NET 1.28 uses safer defaults for file access
In .NET 1.28, file hooks are disabled by default. File hooks allow an agent to react when files are accessed or changed. They can be useful, but they also create a path to sensitive company information if enabled without clear boundaries.
The safer default is good news for risk management. The upgrade risk is that an existing workflow may depend on file hooks without explicitly enabling them. After updating, document processing or automated review tasks could stop working.
Your team should document which agents need file access, which folders they can reach and what actions they may perform. Access to a shared drive should never mean access to every document on that drive.
5. Not every .NET package has the same production status
The core .NET 1.28 packages are stable, but some hosting, declarative and specialised packages remain preview, release candidate or alpha versions. Preview means Microsoft is still changing the feature and does not yet offer the same stability expectations as a completed release.
This distinction is easy to miss when developers add packages directly from NuGet, the standard .NET software package library. A solution can use a stable core package while still depending on an experimental hosting component.
<PackageReference Include="Microsoft.Agents.AI" Version="1.28.0" />
<PackageReference Include="Microsoft.Agents.AI.Workflows" Version="1.28.0" />
<!-- Review preview packages separately before production use -->Ask your team for a package-level register showing the version, release status, purpose and owner of every Agent Framework dependency. This makes support risk visible before an important agent becomes dependent on unfinished software.
A practical production scenario
Consider a 200-person organisation using an AI agent to classify incoming requests, search internal procedures and create tickets. The agent runs on Python 3.10, loads tools from several business systems and shares a long-running workflow session across users.
An uncontrolled upgrade to Python 1.25 could produce three separate failures. The application may not start, tool discovery may hit a limit and shared sessions may be rejected because their authorisation scope is no longer valid.
The result is not merely a technical outage. Staff return to manual triage, response times increase and the IT team spends days investigating several changes at once.
A controlled upgrade would first move the runtime to Python 3.11 or later, test the tool catalogue, create isolated sessions and compare results against an approved test set. The agent could then be released to a small user group before wider deployment.
What to do before approving an upgrade
- Record the current versions. Include Python or .NET, every Agent Framework package, the AI model and connected tools.
- Separate stable and preview components. Preview features should require a documented business reason and an exit plan.
- Test permissions and isolation. Confirm that users cannot access another person’s session, data or tools.
- Test failure conditions. Disconnect a tool, trigger a timeout and provide a damaged session record. The agent should fail safely rather than inventing a result.
- Maintain a rollback path. Keep the previous application image, package versions and configuration ready for restoration.
- Review logs and sensitive data. Check that prompts, files, customer details and credentials are not being recorded unnecessarily.
Our October 2026 Agent Framework changes guide explains the wider governance issues around stored data, integrations and rapid release cycles. The key lesson remains the same: release speed should not determine your production change schedule.
Production readiness is an operating discipline
Python 1.25 and .NET 1.28 provide stronger foundations for secure AI agents. The benefits include clearer permission boundaries, safer file access, more controlled tool discovery and better protection against stalled integrations.
But the framework cannot decide who should approve an action, what customer data an agent may use or how quickly your business must recover from a failure. Those decisions require governance, security testing and accountable ownership.
CloudProInc brings more than 20 years of enterprise IT experience to these decisions. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations connect Azure, Microsoft 365, Defender, Wiz, OpenAI and Claude without treating production AI as an uncontrolled experiment.
If you are unsure whether your agents are ready for Python 1.25 or .NET 1.28, we are happy to review the architecture, dependencies and upgrade plan with you — no strings attached.