How to Run Claude Agent SDK Solutions Securely on Microsoft Foundry

In this blog post How to Run Claude Agent SDK Solutions Securely on Microsoft Foundry we will explain how to combine Anthropic’s agent technology with Microsoft’s cloud controls, without creating an expensive AI experiment that becomes difficult to secure or manage.

Many organisations already have a promising Claude prototype. The problem appears when they try to connect it to company data, let it perform tasks and make it available to employees. Costs become harder to predict, security teams start asking questions, and nobody is quite sure who can see what the agent is doing.

Running a Claude Agent SDK solution through Microsoft Foundry can address that gap. In simple terms, Claude provides the reasoning engine, the Agent SDK controls how work is carried out, and Foundry provides the business environment around it, including identity, deployment, monitoring and access control.

What is the Claude Agent SDK?

The Claude Agent SDK is a development toolkit for building applications that can complete multi-step work rather than simply answer a question. It brings Claude Code-style capabilities into custom Python and TypeScript applications.

For example, an agent could review a folder of documents, compare information, call an approved business system and prepare a report. It could also investigate a software issue, examine relevant files and recommend a fix.

The important difference is action. A chatbot gives an answer. An agent can decide which approved tools it needs, use them in sequence and continue until it reaches a defined outcome.

This power also creates risk. An agent that can read files, execute commands or update systems needs stronger controls than an ordinary chat interface. We covered those design considerations in more detail in our guide to building production AI agents with Claude API and Agent SDKs.

What Microsoft Foundry adds

Microsoft Foundry is Microsoft’s platform for building, deploying and governing AI applications and agents. It allows organisations to deploy approved AI models, manage access through Microsoft Entra ID, monitor usage and connect solutions to existing Azure services.

Microsoft Entra ID is the identity system behind Microsoft 365 and Azure. Using it means your AI solution can recognise employees and applications without relying on shared passwords or API keys stored in source code.

Claude models can be deployed through Foundry and accessed using Anthropic’s Messages API. Depending on the model and deployment selected, processing may use Azure-hosted or Anthropic-hosted infrastructure, so data handling, availability and contractual requirements must be reviewed before production use.

Foundry Hosted Agents can also run your own agent code. Your team packages the application for deployment, while Foundry can provide an endpoint, a dedicated application identity, scaling, version management and operational monitoring.

How the main components fit together

1. The business application receives a request. This might come from an internal portal, Microsoft Teams, a service desk or an automated workflow.
2. The Claude Agent SDK manages the task. It sends instructions to Claude and controls the tools, files and processes available to the agent.
3. Claude performs the reasoning. The model decides what information it needs and which approved step should happen next.
4. Foundry provides the model endpoint and cloud controls. Authentication, permissions, deployment versions, usage and operational data can be managed within the Microsoft environment.
5. Business systems provide the data or action. These connections should be narrow, logged and limited to the minimum access required.

For more complex integrations, Model Context Protocol, or MCP, and OpenAPI can give the agent structured access to approved systems. Our article on connecting Foundry agents to business systems with MCP and OpenAPI explains this layer in more detail.

A simple Python starting point

The following simplified example shows the basic pattern. It directs the Claude Agent SDK to a Foundry resource and creates a read-only document review agent.

import os
import anyio
from claude_agent_sdk import query, ClaudeAgentOptions

os.environ["CLAUDE_CODE_USE_FOUNDRY"] = "1"
os.environ["ANTHROPIC_FOUNDRY_RESOURCE"] = "your-foundry-resource"

options = ClaudeAgentOptions(
 system_prompt=(
 "Review the supplied documents and produce a concise summary. "
 "Do not modify files or execute commands."
 ),
 allowed_tools=["Read", "Glob", "Grep"],
 disallowed_tools=["Write", "Edit", "Bash"],
 max_turns=6
)

async def main():
 async for message in query(
 prompt="Review the documents in the approved working folder.",
 options=options
 ):
 print(message)

anyio.run(main)

For local development, a user can authenticate through the Azure command-line tools. In production, the workload should use its own managed identity, which is a secure application identity controlled by Azure, together with tightly limited permissions.

The example deliberately blocks file changes and command execution. A production agent should not receive powerful tools simply because they are available. Access should be added one business requirement at a time.

Choose the right deployment approach

There are two practical patterns for most organisations.

Use a Foundry Hosted Agent

This is a strong option when you want custom Agent SDK code but do not want to build the entire hosting layer yourself. Foundry can manage the deployed version, runtime endpoint, identity and scaling around your packaged application.

Run the application on another Azure service

Azure Container Apps, App Service or another approved Azure environment may be more suitable when the agent is part of a larger application. The workload can still call the Claude model deployed in Foundry and use Entra ID for authentication.

The choice should be based on support requirements, integration complexity and the skills of your internal team. Technology preference should come second.

Controls to put in place before production

• Start with read-only access. Let the agent find and summarise information before allowing it to update records, send messages or run commands.
• Require human approval for high-impact actions. Payments, account changes, customer communications and production updates should not happen without confirmation.
• Separate test and production environments. Experimental agents should never share unrestricted access with live business systems.
• Use identity instead of stored keys. Entra ID and managed identities reduce the risk of credentials being copied, leaked or forgotten.
• Record actions and outcomes. Your team needs to know which user started a task, which tools the agent called and whether the task succeeded.
• Set budgets and usage limits. Track model tokens, hosting, connected services, logging and storage rather than looking only at the advertised model price.

These controls also support the intent of Essential Eight, the Australian Government’s cybersecurity framework that many organisations use to reduce common security risks. However, using Azure or Foundry does not automatically make an AI solution compliant. Access management, patching, monitoring and incident response still need to be designed properly.

The business case needs to be measurable

Consider a 200-person professional services company where 12 employees each spend 30 minutes per day collecting information for internal reports. That adds up to roughly 120 staff hours every month.

A controlled agent that gathers approved information and prepares a draft could return much of that time without being allowed to send the final report. The business gains productivity while a person remains responsible for accuracy and approval.

That is a more sensible first project than giving an agent broad access and hoping useful automation emerges. Pick a repetitive task, measure the current effort, automate the safest steps and compare the result.

Claude Agent SDK or Microsoft Agent Framework?

The Claude Agent SDK is a good fit when Claude-specific reasoning, file handling and tool-based workflows are central to the solution. Microsoft Agent Framework may be preferable when you want broader model choice or deeper alignment with Microsoft’s agent development approach.

Both can work with Foundry. The right decision depends on the workload, not which framework currently receives the most attention. See our guide to building Microsoft Foundry agents with Microsoft Agent Framework for a useful comparison point.

Turn the prototype into a controlled business service

Claude Agent SDK and Microsoft Foundry can be a practical combination. Claude handles complex reasoning and multi-step work, while Foundry helps your organisation manage identity, deployment, monitoring and access within its Microsoft environment.

The value does not come from deploying the most powerful agent possible. It comes from solving a costly business problem with the smallest set of permissions, tools and data needed to complete the job safely.

CloudProInc brings more than 20 years of enterprise IT experience across Azure, Microsoft 365, cybersecurity and AI, including OpenAI and Claude. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations assess the business case, build the controls and run practical pilots without turning the project into a large, open-ended program.

If you have a Claude prototype but are not sure how to host, secure or govern it in Azure, we are happy to review the design and identify the practical next steps — no strings attached.