Skip to content

Agent Skills Foundry Tracing: verify optional App Insight tracing across agent workflows - #3447

Merged
anchenyi merged 13 commits into
microsoft:mainfrom
kseager:feat/foundry-agent-default-tracing
Nov 13, 2026
Merged

anchenyi merged 13 commits into
microsoft:mainfrom
kseager:feat/foundry-agent-default-tracing

Conversation

@kseager

@kseager Kayla Seager (kseager) commented Oct 27, 2026 •

Copy link
Copy Markdown
Member

Summary

  • Add shared tracing setup (agent-tracing-setup.md) and fresh stored-trace verification (agent-tracing-verification.md) references, and link them from the native, hosted quickstart/redeploy, project-create and ordinary-prompt workflows.
  • Add a pre-provisioning preflight: check native monitoring capability and opt-out, handle a network: block (private networking is unsupported, so set monitoring.enabled: false), and get billing/privacy approval before creating App Insights. Existing projects only connect a user-supplied component ID.
  • Align with azd: new projects get App Insights and an AppInsights connection by default, and a monitoring failure fails azd provision (reported as a provision failure). Optional access and verification failures still warn and continue.
  • Document that each user needs Log Analytics Reader on the App Insights resource to read traces; azd does not grant it.
  • Preserve working shared/Entra connections, prefer nonsecret resource IDs, and note that ejected Terraform now includes monitoring.
  • Add four offline evals (tracing.eval.yaml): custom IaC failure, query denial, hosted correlation, native provision failure.
  • Unrelated CI fix: raise the telemetry installer digest test timeout to 30s (it exceeds Vitest's 5s default on main too).

Validation

  • npm run references and validate-stimulus pass.
  • All four offline tracing evals (tracing.eval.yaml) pass every trial: 5 trials per case, 20/20, using claude-sonnet-5 as both agent and judge (the default judge model is unavailable). Run against a fresh npm run build output, since evals read output/, not plugins/.
  • Native e2e (new, off, existing-BYO, Bicep, Terraform) was run before the final azd rebase. Traces were seen in the Foundry portal, but post-rebase trace verification is not re-confirmed.
  • The token check still fails on pre-existing oversized files; these edits add small increments.

Companion azd PR: Azure/azure-dev#10743

Share best-effort tracing readiness and fresh invocation verification across prompt and hosted deployment paths. Preserve existing authentication and successful core outcomes when optional monitoring or query access fails.

Authored-by: GitHub Copilot CLI 1.0.100
Model: GPT-6.1 Sol (gpt-6.1-sol)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ebefc78f-0541-4087-837a-f5eeb5a358a5
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

Kayla Ames and others added 2 commits October 27, 2026 14:54
Give the digest-mismatch installer test the adjacent download test's
30-second budget. Both main and this PR exceed Vitest's five-second
default while running the PowerShell installer case.

Preserve every digest-rejection assertion. Runtime behavior and global
CI timeout settings are unchanged.

Authored-by: GitHub Copilot CLI 1.0.100
Model: GPT-6.1 Sol (gpt-6.1-sol)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ebefc78f-0541-4087-837a-f5eeb5a358a5
…ng behavior

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c1d0003f-40c8-481d-92a5-ecb8d7afb491

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Monitoring provisioning occurs before required charges/privacy approval and capability/opt-out checks, and tracing overlooks the starter’s exported resource ID.

3 open issues
What changed in this PR

Adds shared tracing setup and verification guidance to Foundry agent workflows, separating deployment and invocation success from evidence of fresh stored traces.

Changes:

  • Connects project creation, hosted deployment, prompt deployment, and smoke invocation workflows to shared tracing guidance.
  • Preserves existing connections and approval boundaries while preferring nonsecret destination identifiers.
  • Adds three offline tracing evaluations and increases one telemetry-download test timeout.
File Description
scripts/​src/​__tests__/​telemetry-hooks.test.ts Raises checksum-failure test timeout to 30 seconds.
plugins/​azure-skills/​skills/​microsoft-foundry/​SKILL.md Links tracing guidance and documents preferred destination identifiers.
plugins/​azure-skills/​skills/​microsoft-foundry/​references/​agent-tracing-verification.md Defines fresh-trace attribution, bounded retries, and separate outcome reporting.
plugins/​azure-skills/​skills/​microsoft-foundry/​references/​agent-tracing-setup.md Defines provisioning capabilities, approvals, connection preservation, and failure boundaries.
plugins/​azure-skills/​skills/​microsoft-foundry/​project/​create/​create-foundry-project.md Adds monitoring discovery and human-access guidance after project creation.
plugins/​azure-skills/​skills/​microsoft-foundry/​foundry-agent/​trace/​trace.md Prefers resource identifiers and limits connection strings to legacy reads.
plugins/​azure-skills/​skills/​microsoft-foundry/​foundry-agent/​invoke/​invoke.md Adds smoke-invocation trace verification without extra billed calls.
plugins/​azure-skills/​skills/​microsoft-foundry/​foundry-agent/​deploy/​deploy.md Integrates tracing into hosted and prompt deployments; clarifies connection lifecycle.
plugins/​azure-skills/​skills/​microsoft-foundry/​foundry-agent/​create/​quick-start-hosted.md Adds capability-aware monitoring guidance and smoke-trace verification.
plugins/​azure-skills/​skills/​microsoft-foundry/​foundry-agent/​create/​create-hosted.md Links hosted-agent handoffs to shared tracing guidance.
evals/​azure-skills/​microsoft-foundry/​tracing.eval.yaml Covers setup failure, query denial, and hosted request/dependency correlation.

Review effort: Balanced

Kayla Ames and others added 2 commits November 2, 2026 12:57
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c1d0003f-40c8-481d-92a5-ecb8d7afb491
…D output; update tracing evals

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: c1d0003f-40c8-481d-92a5-ecb8d7afb491

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Provisioning can create monitoring resources or write project connections before the required monitoring cost/privacy and connection-write approvals are obtained.

1 open issue
1 previously missed issue

In code that hasn't changed since last review

Low severity Require connection-write approval before provisioning existing projects

plugins/​azure-skills/​skills/​microsoft-foundry/​foundry-agent/​deploy/​deploy.md:113

This preflight covers only new projects, but Step 2 also provisions infrastructure against existing projects. With monitoring.applicationInsightsResourceId configured, the companion native implementation can write the project connection during provisioning, before Step 3 requests approval. Apply the preflight to existing-project provisioning too, requiring connection-write approval naming the project and component before azd provision.

3 resolved since last review

Review effort: Balanced

Kayla Ames added 2 commits November 2, 2026 14:15
…ing verification; fix eval rubric

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: c1d0003f-40c8-481d-92a5-ecb8d7afb491
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: c1d0003f-40c8-481d-92a5-ecb8d7afb491
@anchenyi

anchenyi commented Nov 3, 2026

Copy link
Copy Markdown
Collaborator

The Foundry skill changes can be merged once the azd changes are released. Let me know when azd is ready.

… trace polling in quickstart, drop release-note caveat

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c1d0003f-40c8-481d-92a5-ecb8d7afb491
Kayla Porter and others added 4 commits November 10, 2026 17:03
…ring

A new project with a network: block now gets private monitoring (private App Insights, AMPLS, azuremonitor private endpoint) instead of requiring monitoring.enabled: false. Document in-VNet trace reads, unsupported existing private projects, and update the eval.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c1d0003f-40c8-481d-92a5-ecb8d7afb491
…e/deploy flows

Address review: remove tracing paragraph from SKILL.md, keep only a Yes/No monitoring row in quickstart/create-hosted, drop preflight and polling from deploy/invoke/create-project, move agent-tracing references under foundry-agent/trace/references, and align network: handling and evals with merged azd behavior.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c1d0003f-40c8-481d-92a5-ecb8d7afb491
…rivate monitoring ships

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c1d0003f-40c8-481d-92a5-ecb8d7afb491
…d intentional skip

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c1d0003f-40c8-481d-92a5-ecb8d7afb491
@kseager Kayla Seager (kseager) changed the title feat(foundry): verify optional tracing across agent workflows Agent Skills Foundry Tracing: verify optional App Insight tracing across agent workflows Nov 11, 2026
…e.ai.projects 1.1.0)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c1d0003f-40c8-481d-92a5-ecb8d7afb491
@anchenyi
anchenyi merged commit 19cb61a into microsoft:main Nov 13, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants