In this blog post Microsoft Agent Framework Python 1.21 and .NET 1.25 in Production we will explain what the releases mean for organisations moving AI agents from promising trials into real business operations. The biggest risk is no longer whether an agent can answer a question. It is whether that agent behaves safely when an approval is missed, a user lacks permission or sensitive information enters the conversation.
Microsoft Agent Framework provides the building blocks for creating AI agents that can use business systems, complete multi-step work and collaborate with other agents. Python and .NET are its main development environments. In plain English, they give development teams two different ways to build similar agent capabilities while using the skills and applications the organisation already has.
This article builds on our earlier Python 1.21 and .NET readiness review. The important question now is not simply what Microsoft added, but how technology leaders should adjust their production strategy.
The version numbers are not the real story
Python 1.21 was released on 8 October 2026. Microsoft followed with .NET 1.25 on 15 October, while Python 1.22 also arrived that day.
That timing highlights an important point. The Python and .NET editions do not always move together, and a version can be overtaken within days. Your production standard should therefore be based on testing and business requirements, not on installing whichever package has the highest number.
For a CIO or CTO, this means treating the framework like any other fast-moving business platform. Versions should be approved, recorded and tested before they reach employees or customer data. Our guide to Agent Framework version governance explains how to manage that release pace without blocking useful improvements.
What Python 1.21 changes for production agents
Compliance checks can see the complete streamed answer
AI agents often display answers a few words at a time. This makes the experience feel faster, but it can create a compliance gap because information may appear before the complete response has been assessed.
Python 1.21 improves integration with Microsoft Purview, which applies data protection and information-handling policies. Responses can be buffered and checked as a complete message rather than assessed only as disconnected fragments.
The business outcome is stronger control over sensitive content. This is particularly relevant for Australian organisations handling personal, financial, health or legal information under privacy and contractual obligations.
Better separation between agent sessions
Many organisations are beginning to let one agent call another agent as a tool. For example, a service desk agent may ask a specialist identity agent to check an employee account.
Python 1.21 improves the isolation of provider-managed session information in these scenarios. Session isolation means keeping one user’s conversation and temporary working data separate from another user’s activity.
This reduces the risk of an agent reusing the wrong context. It also supports clearer audit records when several agents contribute to one business process.
More visibility into changed tool instructions
Agents often pass information into tools such as ticketing systems, databases or approval workflows. Python 1.21 provides more visibility when variable expansion changes those tool arguments before execution.
That may sound technical, but the business issue is straightforward. If an agent changes the department, customer number or requested action sent to a tool, your team needs to know what was changed and why.
What .NET 1.25 adds to the strategy
Unanswered approvals can fail safely
An AI agent may pause before performing a sensitive action, such as disabling an account, issuing a refund or changing a customer record. It then asks an authorised person for approval.
.NET 1.25 can automatically reject approval requests that never receive a response. This supports a safer default: if nobody approves the action, the agent does not proceed.
That reduces the chance of an old or abandoned approval request being executed later without proper review. It also gives operations teams a clearer rule for time-sensitive requests.
Human decisions can be more controlled
The release adds support for workflow questions with a fixed list of answers. Instead of asking an employee to type anything they want, an agent can present options such as approve, reject or escalate.
This makes workflows easier to use and easier to audit. It can also reduce errors caused by vague or inconsistent responses.
Compliance decisions carry more useful context
.NET 1.25 improves the information available from Purview checks, including supporting details and error information. That helps teams understand whether content was blocked because of a policy decision, a system problem or missing context.
The result is faster incident investigation and less guesswork. Your team can distinguish a genuine compliance event from an integration failure before it affects more users.
There are still upgrade risks
The release includes a breaking change affecting how Cosmos-based chat metadata relates to data partitioning. Cosmos DB is Microsoft’s cloud database, and partitioning is how it separates and distributes stored information.
If your agents store conversation history or session data there, upgrading without testing could affect how records are located or separated. This is exactly why production changes need a migration plan and rollback path.
A practical 200-person business scenario
Consider a 200-person professional services firm using an agent to handle internal support requests. The agent can reset access, search knowledge articles and send complex cases to a technician.
In a demonstration, everything works because the requests are simple and a developer is watching. In production, an approval may be ignored overnight, two users may make similar requests at the same time, or a response may contain client information that should not be displayed.
Python 1.21 and .NET 1.25 provide useful controls for these situations. However, the firm still needs separate identities, defined permissions, approval expiry rules, logging and tested recovery procedures.
The real business outcome is not merely a faster support chatbot. It is fewer routine tickets without allowing the agent to become an uncontrolled administrator.
Five actions to take before your next agent release
- Choose a tested baseline for each language. Python and .NET versions do not need to match. Record the approved packages, features and known limitations for each agent.
- Pin production versions. Pinning prevents a package from changing automatically during a build. A simple configuration might include:
pip install "agent-framework==1.21.0"
dotnet add package Microsoft.Agents.AI --version 1.25.0- Test business failures, not just good answers. Check what happens when approvals expire, policies block content, databases are unavailable or a user requests an action outside their authority.
- Separate agent identities and data. Each agent should receive only the access it needs. This follows the same risk-reduction principle as the Essential Eight, the Australian Government’s cybersecurity framework for protecting organisations from common attacks.
- Release gradually and keep a rollback path. Start with a controlled user group, monitor errors and preserve the ability to return to the previous version without losing conversation or workflow state.
If your agents communicate with other agents or use MCP, a standard method for connecting AI systems to tools and data, also review our production guide for A2A and MCP governance.
Your agent strategy needs an operating model
Python 1.21 and .NET 1.25 show that Microsoft is strengthening the controls around approvals, compliance, session separation and workflow reliability. Those improvements are valuable, but no framework release can decide who owns an agent, what data it may access or how quickly a failed process must be restored.
CloudProInc combines more than 20 years of enterprise IT experience with hands-on expertise across Azure, Microsoft 365, OpenAI, Claude, Defender and Wiz. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations connect agent design with identity, cloud security and practical Australian governance requirements.
If you are unsure whether your current agent pilot is ready for real users, we are happy to review the architecture, permissions and release process with you — no strings attached.