Agent Academy: build a controlled-egress agent on Foundry

This is a hands-on walkthrough. By the end you’ll have built a web-scraping AI agent in Azure AI Foundry that can only reach the one website you allow it to — and nothing else. Every step has a screenshot, with the thing you click or type boxed in red.

It pairs with the AI Governance Journey: that explains why an agent needs controlled egress; this shows how to actually build one.

In plain English

Imagine giving an intern a research task. A careless setup hands them the keys to the whole building and the company credit card. A careful setup gives them one library card, for one library, and a rule: bring back what you read, send nothing out.

A normal AI agent is the careless version — by default Foundry wires it up with web search that quietly sends your text out to Bing, outside the Azure compliance boundary. The agent we build is the careful version. It has no general internet access at all. Its only way out is a single, named tool that can fetch from one allow-listed website. If it tries anything else, it simply can’t.

That pattern — one narrow, named, allow-listed exit and a default-deny on everything else — is controlled egress. It’s the difference between an agent you can put in front of sensitive data and one you can’t.

What you’ll build

The goal

A Foundry agent with one custom OpenAPI tool locked to a single host. No Bing, no open web. The model physically cannot reach anything off the allow-list.

The honest detours

A brand-new subscription can’t deploy a model (quota = 0). Serverless gets past that. And the new Agent Service has no usable model in UK South — a real finding you’ll hit too.

The map

1. Get an Azure subscription — the empty-tenant starting line.
2. Create the Foundry resource — a resource group, the Foundry “building”, and your first project.
3. Switch to the new Foundry experience — the redesigned ai.azure.com portal.
4. Hit the quota wall — why a new subscription can’t deploy a model, and the upgrade that still doesn’t fix it.
5. Deploy a model without quota — serverless / pay-per-token models that skip the wall.
6. Create the agent + remove the Bing leak — and see the egress risk the default ships with.
7. Add the one allowed exit — an allow-listed OpenAPI fetch tool.
8. Instructions, and the moment of truth — the natural-language contract, plus the UK South model-desert finding and the sovereign production path.

Where this was built

On a personal sandbox tenant, free tier only (no £900/month Azure Firewall), region UK South. That keeps it reproducible — and surfaces every real-world wall a beginner will hit. The production-grade, UK-sovereign version is described at the end.

Not legal or compliance advice

This is an engineering walkthrough. For an OFFICIAL-SENSITIVE or regulated deployment, read the Data Controls and Third-party AI Risk stages and talk to your security and compliance owners first.