{"id":59742,"date":"2026-11-12T11:46:31","date_gmt":"2026-11-12T01:46:31","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/12\/microsoft-agent-framework-mcp-approval-policies-for-production-ai\/"},"modified":"2026-11-12T11:48:35","modified_gmt":"2026-11-12T01:48:35","slug":"microsoft-agent-framework-mcp-approval-policies-for-production-ai","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/12\/microsoft-agent-framework-mcp-approval-policies-for-production-ai\/","title":{"rendered":"Microsoft Agent Framework MCP Approval Policies for Production AI"},"content":{"rendered":"\n

In this blog post Microsoft Agent Framework MCP Approval Policies for Production AI we will explain what the latest approval controls mean, where the risks remain, and what technology leaders should review before allowing AI agents to act across production systems.<\/p>\n\n\n\n\n\n\n\n

The high-level issue is simple. An AI agent that only drafts content creates a manageable risk. An agent that can update customer records, change access permissions, issue refunds or send company information outside the business needs much stronger controls.<\/p>\n\n\n\n

Microsoft Agent Framework provides the software foundation for building and operating these agents. Model Context Protocol, or MCP, is the common connection method that lets an agent use external tools and business systems. Think of MCP as a universal adaptor for AI agents.<\/p>\n\n\n\n

MCP approval policies are the traffic rules around that adaptor. They determine which tools an agent can use automatically, which actions require a person to approve them, and which actions should be blocked completely.<\/p>\n\n\n\n

What changed in Microsoft Agent Framework 1.25<\/h2>\n\n\n\n

Microsoft Agent Framework Python 1.25 introduced callable MCP discovery approval policies. In plain English, organisations can now apply their own decision logic when the framework discovers tools available through an MCP server.<\/p>\n\n\n\n

Earlier approaches often relied on broad settings such as requiring approval for everything or allowing everything. That may be acceptable during a small pilot, but it creates problems in production.<\/p>\n\n\n\n

Approving every action frustrates employees and turns managers into workflow bottlenecks. Approving nothing creates the risk that an agent will perform a sensitive or irreversible action without anyone checking it.<\/p>\n\n\n\n

The new controls allow teams to make more precise decisions based on factors such as the tool name and whether a tool is described as read-only. Microsoft Foundry Toolbox metadata can also influence the approval requirement, while an explicit policy configured by your development team can override that metadata.<\/p>\n\n\n\n

Our earlier MCP approval policies governance guide explains the configuration model in more detail. The important question for leaders now is how these controls should fit into a production governance process.<\/p>\n\n\n\n

Approval policies are not the same as security permissions<\/h2>\n\n\n\n

This is where many AI projects go wrong. An approval policy can pause an action, but it does not replace identity, access and security controls.<\/p>\n\n\n\n

If an agent has administrator-level access to Microsoft 365, Azure or a finance platform, clicking \u201capprove\u201d could still release an unnecessarily powerful action. The agent should operate with the minimum access required, even when a human approval step exists.<\/p>\n\n\n\n

The same principle applies to the approver. Your system should record who approved the action, what they were shown, what data was involved and what happened after approval. A shared approval account or a simple yes-or-no button without identity checks is not enough for a production system.<\/p>\n\n\n\n

For Australian organisations, this supports the intent of the Essential Eight, the Australian Government\u2019s baseline cybersecurity framework. In particular, it complements controls around restricting administrative privileges, multi-factor authentication, application control and timely patching.<\/p>\n\n\n\n

Approval policies do not make an agent Essential Eight compliant by themselves. They are one part of a broader control environment.<\/p>\n\n\n\n

Do not automatically trust a read-only label<\/h2>\n\n\n\n

Microsoft Agent Framework can use MCP metadata indicating that a tool is read-only. This is useful because a tool that retrieves an approved product price is usually less risky than one that changes that price.<\/p>\n\n\n\n

However, the framework does not independently prove that every read-only classification is accurate. It relies on information supplied through the configured Toolbox.<\/p>\n\n\n\n

A poorly designed or compromised MCP server could describe a tool as read-only even though it sends data externally, creates an audit entry or triggers another system. Your team should therefore verify the behaviour of a tool before using its metadata to bypass approval.<\/p>\n\n\n\n

A practical policy model might look like this:<\/p>\n\n\n\n

# Illustrative governance logic rather than SDK configuration\nverified read-only tool = allow automatically\nreversible internal update = require business approval\npayment or identity change = require specialist approval\nunknown or unclassified tool = block\nunapproved MCP server = block\nsensitive data leaving Australia = block or escalate\n<\/code><\/pre>\n\n\n\n
This risk-based approach gives employees speed for low-impact tasks without treating every action as harmless.<\/p>\n\n\n\n
What CIOs and CTOs should review before upgrading<\/h2>\n\n\n\n
1. Decide what happens when information is missing<\/h3>\n\n\n\n
Missing approval metadata can result in a tool not requiring approval by default in some Foundry Toolbox scenarios. Production policy should not depend on every external tool publisher describing risk correctly.<\/p>\n\n\n\n
For sensitive environments, unknown should mean blocked or manually reviewed. That decision reduces the chance of a newly discovered tool becoming available before security and business owners have assessed it.<\/p>\n\n\n\n
2. Test policy refreshes<\/h3>\n\n\n\n
Agent Framework 1.25 can reapply approval policies when MCP tool catalogues are refreshed or connections are restored. This helps policies stay attached as tools change, but it also means discovery is part of your production security boundary.<\/p>\n\n\n\n
Test what happens when a tool is renamed, its metadata changes or the MCP server becomes unavailable during refresh. Your agent should retain a known safe state rather than quietly receiving broader access.<\/p>\n\n\n\n
3. Prepare for the wider 1.25 changes<\/h3>\n\n\n\n
The Python 1.25 release requires Python 3.11 or later. It also introduces default limits for MCP discovery and request timing, helping prevent an unreliable or untrusted server from consuming unlimited resources.<\/p>\n\n\n\n
These are sensible protections, but they can affect existing integrations. Do not push the upgrade directly into production. Pin the version, test it in a non-production environment and confirm that discovery limits, timeouts and approval flows behave as expected.<\/p>\n\n\n\n
4. Separate policy ownership from development<\/h3>\n\n\n\n
Developers can implement approval logic, but they should not decide business risk alone. Finance should define what requires approval in payment workflows, security should control identity and access changes, and data owners should decide how sensitive information may be used.<\/p>\n\n\n\n
Record these decisions in a simple tool register. Include the tool owner, MCP server, data accessed, possible business impact, required approver and review date.<\/p>\n\n\n\n
5. Monitor the outcome, not just the approval<\/h3>\n\n\n\n
An approval record proves that someone clicked a button. It does not prove that the tool performed the expected action.<\/p>\n\n\n\n
Production monitoring should connect the approval request to the resulting tool call, system change and audit record. Alerts should identify repeated denials, unusual approval volumes, new tools and actions occurring outside expected business hours.<\/p>\n\n\n\n
A practical 200-person company scenario<\/h2>\n\n\n\n
Consider an anonymised example based on a common professional services rollout. A 200-person company introduces an AI service desk agent connected to Microsoft 365, Intune, which manages and secures company devices, and its ticketing platform.<\/p>\n\n\n\n
The agent can safely retrieve approved support articles and check device compliance without approval. Resetting a standard user session requires service desk approval, while changing security policies or granting administrator access is blocked from the agent entirely.<\/p>\n\n\n\n
The result is not maximum automation. It is controlled automation.<\/p>\n\n\n\n
Employees receive faster answers, the service desk handles fewer repetitive requests, and high-impact security actions stay with authorised specialists. This is a better business outcome than either approving every minor lookup or giving the agent unrestricted access.<\/p>\n\n\n\n
Make release watch part of AI governance<\/h2>\n\n\n\n
Microsoft Agent Framework is developing quickly. Approval behaviour, hosting options, security fixes and runtime safeguards can change between releases, so agent governance cannot be a one-time project.<\/p>\n\n\n\n
Assign an owner to review release notes and security advisories. Maintain a tested version, document every upgrade decision and rerun approval tests whenever your agent, MCP server, identity model or tool catalogue changes.<\/p>\n\n\n\n
You can also use the checklist in our Microsoft Agent Framework production guide for Australian teams to assess release stability, compliance and operational readiness. For a deeper look at balancing automation with oversight, see our guide to securing AI agent tool use with MCP approvals.<\/p>\n\n\n\n
The business outcome is controlled confidence<\/h2>\n\n\n\n
Flexible MCP approval policies make it easier to move AI agents beyond demonstrations without choosing between slow manual reviews and unsafe automation. The value comes from applying clear risk tiers, minimum permissions, verified identities, audit records and regular release testing.<\/p>\n\n\n\n
CloudProInc brings more than 20 years of enterprise IT experience to this work. As a Microsoft Partner and Wiz Security Integrator, our Melbourne-based team helps organisations connect Agent Framework, Azure, Microsoft 365, Microsoft Defender, Wiz, OpenAI and Claude without losing sight of practical security and business outcomes.<\/p>\n\n\n\n
If you are not sure whether your production AI agents have the right approval boundaries, we are happy to review the setup and identify the highest-priority gaps \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"
Microsoft Agent Framework 1.25 makes MCP tool approvals more flexible. Here is what CIOs and CTOs should change before production agents can act across business systems.<\/p>\n","protected":false},"author":1,"featured_media":59744,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[121,13,68,113],"tags":[],"class_list":["post-59742","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-governance-risk-management","category-blog","category-mcp-server","category-microsoft-agent-framework"],"jetpack-related-posts":[{"id":59726,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/11\/microsoft-agent-framework-mcp-approval-policies-governance-guide\/","url_meta":{"origin":59742,"position":0},"title":"Microsoft Agent Framework MCP Approval Policies Governance Guide","author":"CPI Staff","date":"November 11, 2026","format":false,"excerpt":"Microsoft Agent Framework 1.25 adds more flexible MCP approval controls. Here is what technology leaders should review before allowing AI agents to act across business systems.","rel":"","context":"In "AI Governance & Risk Management"","block_context":{"text":"AI Governance & Risk Management","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-governance-risk-management\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-mcp-approval-policies-governance-guide.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-mcp-approval-policies-governance-guide.png 1x, \/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-mcp-approval-policies-governance-guide.png 1.5x, \/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-mcp-approval-policies-governance-guide.png 2x, \/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-mcp-approval-policies-governance-guide.png 3x, \/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-mcp-approval-policies-governance-guide.png 4x"},"classes":[]},{"id":59674,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/09\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use\/","url_meta":{"origin":59742,"position":1},"title":"How MCP Approval Policies Secure Microsoft AI Agent Tool Use","author":"CPI Staff","date":"November 9, 2026","format":false,"excerpt":"MCP approval policies stop AI agents from taking sensitive actions unchecked. Learn how to apply practical approval controls in Microsoft Agent Framework without creating unnecessary delays.","rel":"","context":"In "AI Governance & Risk Management"","block_context":{"text":"AI Governance & Risk Management","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-governance-risk-management\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use.png 1x, \/wp-content\/uploads\/2026\/11\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use.png 1.5x, \/wp-content\/uploads\/2026\/11\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use.png 2x, \/wp-content\/uploads\/2026\/11\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use.png 3x, \/wp-content\/uploads\/2026\/11\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use.png 4x"},"classes":[]},{"id":59638,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/08\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe\/","url_meta":{"origin":59742,"position":2},"title":"MCP Tool Approval Policies That Keep Microsoft AI Agents Safe","author":"CPI Staff","date":"November 8, 2026","format":false,"excerpt":"MCP tool approvals stop AI agents from taking sensitive actions without oversight. Here is a practical governance model for balancing productivity, security and accountability.","rel":"","context":"In "AI Governance & Risk Management"","block_context":{"text":"AI Governance & Risk Management","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-governance-risk-management\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe.png 1x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe.png 1.5x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe.png 2x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe.png 3x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe.png 4x"},"classes":[]},{"id":59686,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/10\/mcp-tool-approval-policies-every-australian-cio-should-adopt\/","url_meta":{"origin":59742,"position":3},"title":"MCP Tool Approval Policies Every Australian CIO Should Adopt","author":"CPI Staff","date":"November 10, 2026","format":false,"excerpt":"A practical governance model for deciding which MCP tools AI agents may run automatically, which need human approval, and how to reduce risk without slowing useful automation.","rel":"","context":"In "AI Agents"","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-every-australian-cio-should-adopt.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-every-australian-cio-should-adopt.png 1x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-every-australian-cio-should-adopt.png 1.5x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-every-australian-cio-should-adopt.png 2x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-every-australian-cio-should-adopt.png 3x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-every-australian-cio-should-adopt.png 4x"},"classes":[]},{"id":58659,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance\/","url_meta":{"origin":59742,"position":4},"title":"Microsoft Agent Framework Production Guide for A2A MCP Governance","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"The latest Microsoft Agent Framework releases improve long-running work, A2A reliability, MCP support and runtime controls. Here is what technology leaders should review before production.","rel":"","context":"In "AI Governance & Risk Management"","block_context":{"text":"AI Governance & Risk Management","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-governance-risk-management\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 1x, \/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 1.5x, \/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 2x, \/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 3x, \/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 4x"},"classes":[]},{"id":58415,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/mcp-a2a-and-semantic-memory-capabilities-every-cio-should-track\/","url_meta":{"origin":59742,"position":5},"title":"MCP A2A and Semantic Memory Capabilities Every CIO Should Track","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"MCP, A2A and semantic memory could make AI agents more useful and portable. Here is what CIOs should monitor before moving from pilot to production.","rel":"","context":"In "AI Agents"","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/mcp-a2a-and-semantic-memory-capabilities-every-cio-should-track.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/mcp-a2a-and-semantic-memory-capabilities-every-cio-should-track.png 1x, \/wp-content\/uploads\/2026\/08\/mcp-a2a-and-semantic-memory-capabilities-every-cio-should-track.png 1.5x, \/wp-content\/uploads\/2026\/08\/mcp-a2a-and-semantic-memory-capabilities-every-cio-should-track.png 2x, \/wp-content\/uploads\/2026\/08\/mcp-a2a-and-semantic-memory-capabilities-every-cio-should-track.png 3x, \/wp-content\/uploads\/2026\/08\/mcp-a2a-and-semantic-memory-capabilities-every-cio-should-track.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-mcp-approval-policies-for-production-ai.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59742","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59742"}],"version-history":[{"count":2,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59742\/revisions"}],"predecessor-version":[{"id":59745,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59742\/revisions\/59745"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59744"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59742"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59742"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59742"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}