7. Production & Governance

Observability

Monitor your agents in production with Azure Monitor, Application Insights, and MAF's built-in telemetry.

import { TelemetryMiddleware } from "@microsoft/agents";

const agent = new Agent({
  name: "ObservableAgent",
  middlewares: [
    new TelemetryMiddleware({
      connectionString: process.env.APPLICATIONINSIGHTS_CONNECTION_STRING,
      trackConversations: true,
      trackToolCalls: true,
    })
  ]
});

Metrics to Track

Latency — LLM response time, tool execution time
Token Usage — Input/output tokens per conversation
Tool Success Rate — % of tool calls that succeed
Conversation Length — Turns per session
User Satisfaction — Thumbs up/down, feedback

Guardrails

Guardrails enforce safety and compliance policies on agent inputs and outputs.

import { Guardrail, ContentSafetyPolicy } from "@microsoft/agents";

const agent = new Agent({
  name: "SafeAgent",
  guardrails: [
    new ContentSafetyPolicy({
      blockHateSpeech: true,
      blockPersonalInfo: true,
      maxInputLength: 4096,
    })
  ]
});

Security Best Practices

Practice	Description
Managed Identity	Use Azure Managed Identity instead of connection strings
Tool Auth	Validate authentication and authorization in every tool handler
Rate Limiting	Prevent abuse with per-user rate limits
PII Redaction	Configure guardrails to detect and redact PII
Audit Logging	Log all agent decisions and tool calls for audit

Deployment Options

Azure Container Apps — Managed, serverless hosting
Azure Kubernetes Service — Full orchestration control
Azure Functions — Event-driven, cost-effective
Self-hosted — On-premises or any Docker host

📘 Best Practice: Always use Azure RBAC to control which identities can create, update, invoke, or delete agents. Apply least-privilege principles.

✏️ Exercise: Deploy your agent to Azure Container Apps. Configure Application Insights telemetry and verify you can see conversation traces. Set up a guardrail that blocks personally identifiable information (PII) from being shared.