Microsoft Agent Framework Production Guide for A2A MCP Governance

In this blog post Microsoft Agent Framework Production Guide for A2A MCP Governance we will explain what the latest releases change for businesses moving AI agents into production, where the new risks sit, and what technology leaders should review now.

Many organisations have an AI agent that works well in a controlled demonstration. The trouble begins when it must access live data, hand work to another agent, wait for an approval, recover from a failure and explain exactly what it did.

At a high level, Microsoft Agent Framework is an open-source foundation for building and running AI agents. It provides the structure around an AI model so the agent can use approved tools, remember its work, follow defined processes and cooperate with other agents.

We previously covered the broader business case in what Microsoft Agent Framework means for real-world AI delivery. The important question now is what the current production releases mean for reliability, integration and governance.

The release shift leaders need to understand

Microsoft Agent Framework reached version 1.0 for .NET and Python in April 2026. That provided a stable core for agents, workflows and integrations, rather than another short-lived experimental toolkit.

As of 27 August 2026, the current release train includes .NET 1.19.0 and Python 1.15.0. Recent improvements focus less on impressive chatbot features and more on the operational details that determine whether an agent can be trusted in a real business.

• More reliable state and session persistence, so work can continue after a restart.
• Better support for long-running and recoverable hosted agents.
• Updates to A2A communication between separate agents.
• Support for the latest MCP approach to long-running tasks.
• Stronger middleware and interception options for enforcing policy.
• Improved monitoring of agent and workflow activity.

These are not glamorous features. They are, however, the difference between a useful production service and an AI pilot that requires constant supervision.

A2A is becoming a practical service boundary

A2A, short for Agent-to-Agent, is an open communication standard that lets separate AI agents discover one another, exchange messages and coordinate work. Think of it as a standard language for digital workers built by different teams or on different technology platforms.

The latest .NET release includes a fix for A2A streaming artefact updates. In plain English, this helps an agent reliably receive files, structured results or partial outputs while another agent is still working.

That matters when a task takes several steps. A compliance agent might progressively return findings to a purchasing agent rather than making the entire process wait for one final response.

However, A2A should not be used for every interaction. If two agents sit inside the same application and are maintained by the same team, a direct internal workflow is usually simpler, faster and cheaper.

Use A2A when you are crossing a genuine boundary between systems, teams, programming languages or organisations. Our guide to building interoperable agents with A2A explores that architecture in more detail.

MCP can now handle work that does not finish immediately

MCP, or Model Context Protocol, is a standard way for an agent to connect to business tools and data. It can give an approved agent controlled access to a document system, service desk, finance platform or security tool without building a new custom connector for every project.

The July 2026 MCP specification introduced a Tasks extension for operations that may take minutes or hours. Instead of holding a connection open and hoping it does not time out, the system creates a durable task that can be checked, updated and resumed.

Microsoft Agent Framework .NET 1.19.0 moves its long-running MCP support to this newer Tasks model. This is a breaking change, which means existing implementations should be tested rather than upgraded automatically.

For businesses, the upside is more dependable automation for processes such as document analysis, batch reporting, approval workflows and security investigations. The risk is that a long-running task can continue consuming money or accessing systems after the original user has moved on.

This is why identity, time limits, cost limits and cancellation controls must be part of the design. The connection improvements covered in our enterprise MCP security update are increasingly relevant as these integrations become more capable.

Governance is moving into the agent runtime

A written AI policy is useful, but it cannot stop an agent from making an unauthorised tool call at 2am. Production governance needs controls inside the runtime where the agent actually makes decisions and takes actions.

Agent Framework supports middleware, which is a checkpoint that can inspect an agent request before allowing it to continue. Middleware can validate input, block a tool, request human approval, enforce a spending limit or record an audit event.

The latest releases also point towards a common agent-hooks contract for applying controls across model calls, tool use and final output. Some of this work remains experimental, so it should be treated as a direction of travel rather than a reason to replace proven controls immediately.

A simple production control contract might look like this:

Agent: Supplier Invoice Review
Can read: Invoice mailbox and purchase orders
Can propose: Mismatch flags and coding suggestions
Needs approval: Bank detail changes and payment release
Cannot access: Payroll or customer identity records
Must log: Every tool call, A2A hand-off and approval
Stop conditions: Cost limit, timeout or policy failure

The business outcome is accountability. When something goes wrong, you can determine which agent acted, whose identity it used, what information it accessed and which policy allowed the action.

Persistence and recovery are now board-level concerns

Recent releases improve session persistence, including options for storing state in Azure Blob Storage, and strengthen recovery for hosted agents. This allows an agent to resume work after infrastructure failures without starting again or repeating completed actions.

That can reduce wasted AI usage and prevent duplicate business transactions. It also creates a new data-management responsibility because an agent’s stored state may contain customer details, internal documents or commercially sensitive reasoning history.

Australian organisations should decide how long this state is retained, where it is stored and who can retrieve it. The Privacy Act and Notifiable Data Breaches scheme can apply when agents process personal information.

The Essential Eight, the Australian Government’s baseline cybersecurity framework, remains important around the agent. Patching, multi-factor authentication, restricted administration and backups still matter because a well-governed agent is not safe if its MCP server or hosting environment is compromised.

A practical 200-person business scenario

Consider a 200-person distributor introducing an invoice-review agent. The agent uses MCP to read invoices and purchase orders, then uses A2A to ask a separately managed compliance agent to check unusual supplier changes.

It can prepare an exception report, but a finance employee must approve any bank detail change or payment. Its session is stored so interrupted work can resume, while each tool call and agent hand-off is recorded for investigation and reporting.

The value is not simply that the AI can read invoices. The business gains faster exception handling, fewer repeated checks and a clear approval trail without giving one large agent unrestricted access to the entire finance environment.

What technology leaders should do next

1. Inventory every agent and MCP connection. Record its owner, purpose, data access, model, hosting location and business impact.
2. Pin and test framework versions. Do not allow automatic production upgrades when protocols and package dependencies are changing quickly.
3. Separate A2A from MCP use cases. Use A2A for communication between agents and MCP for controlled access to tools and data.
4. Test failure and recovery. Confirm what happens after timeouts, duplicate messages, revoked access, partial results and infrastructure restarts.
5. Add enforceable controls. Use restricted identities, middleware, human approvals, budgets and clear stop conditions.
6. Monitor business outcomes. Measure processing time, error rates, approval delays, AI consumption and incidents rather than counting chatbot conversations.

If you plan to use managed hosting, our overview of Azure AI Agent Server for enterprise agents explains the operational choices. Development teams can also review our practical guide to production agents with Agent Framework and .NET.

The real production milestone is control

The latest Microsoft Agent Framework releases make A2A, MCP and long-running agents more useful. They also make it possible for agents to reach further into business operations, which raises the cost of weak identity, unclear ownership and poor monitoring.

CloudProInc brings more than 20 years of enterprise IT experience to this problem as a Microsoft Partner and Wiz Security Integrator. Our Melbourne-based team works hands-on across Azure, Microsoft 365, Defender, Wiz, OpenAI and Claude environments for organisations in Australia and internationally.

If you are not sure whether your agent architecture is ready for real users, sensitive data and business-critical actions, we are happy to review the design and identify the practical gaps before they become expensive ones.