AI and dataAI agents

Foundry Workflows retire on December 1. We'd start moving yours to Agent Framework now

Microsoft drops the Foundry workflow designer on December 1, 2026. Your exported YAML can keep running, but porting it to Agent Framework has a few traps the notice doesn't mention.

Cohash AI Practice October 2026 15 min read 8 chapters 3-question check
part 11 of 25 · Platform releases, explained from scratch
01 Portal workflow 02 Dec 1 retirement 03 Agent Framework

the ideaExport the YAML this week, then run it as a hosted agent.

after reading, you can
  • Plan around December 1. Know what stops and what still runs
  • Pick each workflow's next home by asking who will be fixing it next year
  • Spot the Power Fx and variable gaps before one of them quietly breaks a branch

Microsoft is pulling the visual Workflows designer out of Microsoft Foundry on December 1, 2026. If a Foundry workflow runs part of your business today, export its YAMLdefinitionIt's the text file behind every Foundry workflow. You can read it, diff it and keep it in Git, which is why the export matters. this week and pick where it will live next: Microsoft Agent FrameworkdefinitionMicrosoft's open-source SDK for agents and workflows, in .NET and Python. If you used Semantic Kernel or AutoGen, this is where they went., Azure Logic Apps or a direct agent-to-agent call. This guide explains what retires, what keeps running, and the order we'd move things in.

in plain wordsDeadline: December 1, 2026

You can't edit or run workflows in the portal after December 1, but you don't have to lose them

A Foundry workflow is a chain of steps you drew in Microsoft's portal: ask a question, hand the answer to an AI agent, check the result, maybe wait for a person to approve, then pass it to the next agent. After December 1 you can't edit those drawings in the portal or run them from it any more. Microsoft hasn't said the logic is lost. Each workflow is saved as a YAML file you can export, and Foundry will still run that file once it's packaged and deployed as a hosted agent. Somebody has to do that move, and test it, before the date.

think of it like this

It's a bit like a meal-kit app closing its recipe editor. You can still download every recipe as a card and cook from it at home, or hand it to a caterer. You'd still want to cook it once before the dinner party.

who should care
  • Teams running Foundry workflows, even pilots
  • Owners of approval flows drawn in the portal
  • Developers who will have to port the YAML
  • Cloud teams who look after the Foundry projects
  • Risk owners who signed off on an AI process
chapter 01

Why it matters to you

Dec 1Foundry stops supporting the workflow designer and in-portal runs (2026)
3Migration paths Microsoft lists: Agent Framework, Logic Apps, A2A
PreviewWorkflows never left preview, so there's no SLA behind them today
Mar 31Agents (classic) retire too, the following spring (2027)

Nothing here breaks loudly on day one, and that's the risk. A workflow that triages support tickets or drafts approval packs keeps doing its job right up until the portal can't run it. Then the queue it feeds goes quiet, and the first person to notice is usually whoever was waiting on the output.

Microsoft's own general availability page already lists "building new production dependencies on Workflows" as a rollout pitfall. If an auditor or risk committee approved a process that runs on a preview feature, the retirement is a good reason to put it on supported ground and update the record.

what changesWhat happens to a portal workflow on December 1The logic survives if you export it. The designer and the in-portal run button don't.
  1. 01 Built in the designer

    Someone on your team drew the steps and hit Save. Foundry kept every save as a new version of a YAML file, and that's the part you can take with you.

  2. 02 Export the YAML

    Open the YAML view and you'll see the whole workflow as text. Copy or export it now, because that file is what you carry forward.

  3. 03 Designer retires

    After December 1 Microsoft no longer supports editing the workflow visually or running it from the portal.

  4. 04 Pick a new home

    Most teams pick Agent Framework. Logic Apps suits people who want to keep drawing, and a direct A2A call is enough when one agent just hands work to another.

  5. 05 Runs as a hosted agent

    Once you deploy it as a hosted agent, Foundry runs it again. It gets its own endpoint and its own identity, and you'll have to grant that identity access.

For engineers: workflows stop being their own agent type. Microsoft's migration guide says the patterns you drew (sequential, group chat, branching, human-in-the-loop) all map onto Agent Framework, through declarative YAML or code, and that in many cases the exported YAML runs with minimal changes. Notice the word many. The rest of this guide is about the cases where it doesn't.

chapter 02

What retires, what stays, and the three ways out

tableWhat changes on December 1, piece by piece
PieceBefore Dec 1After Dec 1
Visual designer in the Foundry portalPreview, editableNot supported
Running a workflow from the portalPreviewNot supported
Exported workflow YAMLPortable fileStill runs when deployed as a hosted agent
Workflows in Foundry Toolkit for VS CodeView, test, redeploy, generate codeTesting and redeploying saved workflows ends. Exported YAML and generated code stay yours
Code-based orchestration in hosted agentsSupportedUnaffected
Hosted agents serviceGenerally availableGenerally available

The migration options Microsoft documents

newAgent Framework, recommended

We'd start here for most teams. Load the exported YAML into an Agent Framework project, or rewrite it in Python or C#, then deploy it as a hosted agent and keep editing in VS Code.

changedAzure Logic Apps

If people picked workflows because they could drag boxes around, Logic Apps Standard gives them that back, with 1,400+ connectors, and can call Foundry agents as steps. Its Foundry integration is still preview, though.

changedAgent-to-agent (A2A)

When one agent only needs to hand a task to another, expose the second agent as an A2A endpoint and call it directly. No workflow at all.

deprecatedWorkflow designer

Retires December 1. It never left preview, and Microsoft already advises against building new production work on it.

fixedHosted agents for the runtime

You get a sandbox per session, plus an Entra identity and an endpoint for the agent. The designer never left preview, but hosted agents already have.

Most teams will land on Agent Framework, and that's what Microsoft recommends. Logic Apps makes sense when business analysts own the process and won't touch YAML, or when the workflow mostly calls other systems and only asks an agent to reason in one or two steps. A2AdefinitionAgent-to-agent protocol. If one agent just needs to ask another for help, it calls it directly and you skip the workflow. fits the smallest cases, where the "workflow" was really one agent forwarding questions to a specialist.

side by sideAgent Framework or Logic Apps? Decide by who maintains it after go-live
Microsoft Agent Framework
  • Lives in a Git repo and goes through code review like any other app
  • It runs on hosted agents, which are already out of preview
  • Someone on the team has to be comfortable with code or YAML
  • Declarative YAML packages for .NET are still marked prerelease
Azure Logic Apps
  • People who don't write code can keep dragging boxes around
  • A run can wait days for a manager's approval without anyone babysitting it
  • The Foundry piece is still preview, so you'd be trading one preview for another
  • Means rebuilding the flow on a new canvas, not importing the YAML
chapter 03

Where "minimal changes" stops being minimal

We read the workflow docs, the Agent Framework declarative reference and the hosted agentdefinitionYour own agent code in a container, run by Foundry. You don't manage servers, but you do manage the identity it gets. docs side by side. These are the gaps that turn a quick port into a real project. None of them are in Microsoft's retirement notice.

tableCheck each of these in your exported YAML. Any one of them can change what the workflow does
CheckWhy it bitesWhat to do
Python versionAgent Framework skips the Power Fx engine on Python 3.14 and 3.15. Formulas that start with = log a warning and stay as plain text.Pin Python 3.13 or earlier in the image if the YAML uses formulas
System variablesThe portal lists System.User.Language, Conversation.LocalTimeZone, Bot and Recognizer. Agent Framework's docs list only ConversationId, LastMessage (with .Text) and Timestamp.Search the YAML for System. and Conversation. and test each one
Language choiceConversation actions such as AddConversationMessage are documented as C# only.Pick .NET, or rewrite those steps, before you scaffold
Package maturityThe .NET declarative packages install with --prerelease, and the Python Foundry hosting package is prerelease too.Pin exact versions and retest on every bump
RolloutA hosted agent endpoint sends 100% of traffic to one version. There's no traffic splitting.Canary with a second agent and route at your caller
Private networkingProjects created before June 25, 2026 need a container registry reachable over its public endpoint.Check the project's creation date before promising a private build

The Python one is the nastiest, because nothing fails. A branch condition such as =Local.category = "billing" just stops being evaluated, so every request takes the same path and the logs carry one warning. Your test set has to include a request for every branch, and someone has to read the warnings.

The Copilot conversion is useful for getting started. Microsoft's own page says it doesn't deploy anything and doesn't guarantee the same behavior, and it tells you to keep the original definition until the replacement is proven. We'd treat its output like a pull request from a new hire: read every branch, every variable and every approval step against the YAML.

The dates to put in the plan

  1. Apr 3, 2026
    Agent Framework 1.0

    Microsoft froze the .NET and Python APIs and promised long-term support. That's what you want under something you'll run for years.

  2. Jun 25, 2026
    Private registry cut-off

    Older projects can't use a private container registry for hosted agents. If yours predate this, security will want to know before you plan the build.

  3. This week
    Export and inventory

    Save every workflow's YAML and write down who calls it. Do it while the designer still opens.

  4. Dec 1, 2026
    Workflows retire

    The designer and portal runs lose support. Anything still running there is on its own.

  5. Mar 31, 2027
    Agents (classic) retire

    Agents (classic) are deprecated and go too. Move them in the same project if you have them.

chapter 04

Before and after: where the workflow runs

before

Before: a workflow drawn and run in the portal

Right now the workflow lives in the portal, on a preview feature. Someone starts it from the portal or an app, and it calls prompt agents one after another.

Before: a workflow drawn and run in the portal Right now the workflow lives in the portal, on a preview feature. Someone starts it from the portal or an app, and it calls prompt agents one after another. 01 · CALLERS 02 · FOUNDRY PORTAL 03 · AGENTS AND DATA start run evaluate invoke ask Staff or app chat or API MI Foundry workflow preview, visualdesigner Power Fx formulas branches and variables Prompt agents one per step Approver human in the loop © Cohash · cohash.com
01 · CALLERS02 · FOUNDRY PORTAL03 · AGENTS AND DATA Staff or app: chat or API Staff or app chat or API Foundry workflow: preview, visual designer Foundryworkflow preview, visualdesigner Power Fx formulas: branches and variables Power Fxformulas branches andvariables Prompt agents: one per step Prompt agents one per step Approver: human in the loop Approver human in the loop start run invoke ask © Cohash · cohash.com
after

After: nobody edits it in the portal any more. It ships from Git

The YAML or code sits in a repo, ships as a container and runs as a hosted agent with its own Entra identity, endpoint and tracing.

After: nobody edits it in the portal any more. It ships from Git The YAML or code sits in a repo, ships as a container and runs as a hosted agent with its own Entra identity, endpoint and tracing. 01 · CALLERS 02 · YOUR REPO AND FOUNDRY 03 · AGENTS AND DATA request deploy invoke telemetry Staff or app Responses or A2A call Agent Framework workflow YAML or Python / C# MI Hosted agent own identity andendpoint Prompt agents same agents, reused Application Insights traces per run © Cohash · cohash.com
01 · CALLERS02 · YOUR REPO AND FOUNDRY03 · AGENTS AND DATA Staff or app: Responses or A2A call Staff or app Responses or A2A call Agent Framework workflow: YAML or Python / C# Agent Frameworkworkflow YAML or Python /C# Hosted agent: own identity and endpoint Hosted agent own identity andendpoint Prompt agents: same agents, reused Prompt agents same agents,reused Application Insights: traces per run ApplicationInsights traces per run request invoke telemetry © Cohash · cohash.com

The agents themselves don't have to move. A workflow node invokes a Foundry agent by name, and the declarative YAML in Agent Framework does the same with an InvokeAzureAgent action. What changes is the box around them: a container you build, a version you deploy and an identity you have to grant access to.

Hosted agents also change the bill. You pay for CPU and memory per active session, and every session gets its own sandbox. The smallest size is half a vCPU with 1 GiB, and an idle session shuts down after 15 minutes unless you change it. We'd start small and size up only when the tests say so, because oversizing gets multiplied by every concurrent user.

How we'd move a workflow, start to finish

  1. 01
    Inventory and export

    List every workflow in every Foundry project with its owner, its callers and the agents it invokes. Export each saved version's YAML into a repo, named like support.workflow.yaml.

  2. 02
    Record what it does today

    Run a set of real requests through the saved workflow in the Foundry Toolkit playground. Cover every branch, a missing input and each approval step, and keep the outputs as your baseline.

  3. 03
    Choose the target per workflow

    Most go to Agent Framework. If non-developers own the process, we'd use Logic Apps, and if one agent only calls another, A2A is plenty.

  4. 04
    Port and fix the gaps

    Load the YAML into Agent Framework, or start from whatever Generate Code produced. Pin Python 3.13 if there's Power Fx in it, and replace the system variables Agent Framework doesn't know about.

  5. 05
    Deploy as a hosted agent

    Scaffold with azd ai agent init, then provision and deploy. Grant the new agent identity the access the old workflow had, and nothing more.

  6. 06
    Compare and cut over

    Replay the baseline requests against the deployed version and compare. Move callers one at a time, and keep the original YAML until the last caller has moved.

chapter 05

What to do now, by role

What to do now, by who you are

Business owner or product leadthis week
  • Ask one question: which of our processes run on a Foundry workflow, and who owns each one?
  • Decide which ones matter enough to move, and retire the experiments nobody uses.
  • Book engineering time for November, so the cut-over isn't squeezed into the last week.
Developersthis month
  • Export every workflow version's YAML into Git before you change anything.
  • Port one workflow end to end on Agent Framework to learn the gaps on something small.
  • If the YAML has Power Fx in it, pin Python 3.13 or earlier. If it uses conversation actions, you'll be writing .NET.
Platform and cloud teamthis month
  • Look up the region each project sits in. Hosted agents only run in some of them.
  • Find out when each project was created. If it's older than the June 25 cut-off, a private container registry is off the table.
  • Turn on Application Insights and put a budget alert on hosted agent CPU and memory before real traffic arrives.
Security and riskbefore cut-over
  • Look at what each new agent identity can reach, and cut anything the old workflow never used.
  • Update the risk record for any approved process that moved off a preview feature.
  • Check that nobody left secrets in the exported YAML, the container images or environment variables.
chapter 06

Set it up so the next retirement hurts less

This is the second Foundry retirement in a few months, with classic agents leaving next spring and model versions retiring on their own schedule. The teams that cope best treat the portal as a test bench and keep anything that matters in their own repo.

Durable fixes, tied to this move

  1. 01
    Keep definitions in Git

    Workflow YAML, agent instructions and tool configs live in a repo with code review. The portal becomes a place to try things, and nothing lives only there.

  2. 02
    Keep a regression set

    The baseline requests you recorded for the move become a test suite you run on every model or package upgrade.

  3. 03
    One identity per agent, least privilege

    Each hosted agent has its own Entra identity. Grant it only the data and tools that workflow uses, and review it like any service account.

  4. 04
    Track preview dependencies

    Keep a short register of every preview feature in production, with an owner and a planned exit, so a retirement notice is a ticket and not a fire drill.

  5. 05
    Watch the lifecycle pages

    Give one person the job of reading Foundry's lifecycle pages each month. When a new retirement date shows up, they open a ticket that day.

chapter 07

If the cut-over goes wrong

If the new version gets it wrong, or you're still porting on December 1

Before December 1, the old workflow is your rollback. After it, your rollback is the last good hosted agent version, so keep both until you're sure.

  1. 01Stop the damagefirst hour
    • Point callers back at the original workflow if it's still before December 1, or redeploy the last good hosted agent version.
    • Pause anything downstream that acts on the output, such as ticket updates, emails or approvals.
  2. 02Find the step that changedfirst day
    • Run the baseline requests again and compare them one branch at a time. That tells you which branch changed.
    • Read the traces in Application Insights and the container logs for Power Fx warnings, missing variables and permission errors from the agent identity.
  3. 03Fix and redeployfirst days
    • Fix the YAML or code, deploy a new version and rerun the full baseline before moving callers back.
    • If the date has passed and the fix will take time, run the process by hand or through a short Logic Apps flow until it's ready.
  4. 04Tell peopleas soon as you know
    • Tell whoever owns the process what broke and for how long.
    • If it touched customer data or regulated decisions, your risk and compliance people need to hear it too.
  5. 05Learnnext sprint
    • Add the failing request to the regression set.
    • Write the gap into the migration checklist, so the next workflow you port doesn't hit it.
chapter 08

Three situations you might recognise

We made these up to show common setups. None of them is a Cohash client or a real incident.

Three Foundry estates, and what we'd do in each

01 New ticket 02 Portalworkflow 03 Hosted agent 04 Draft reply
scenario 01High risk
A support team's triage workflow
the setup
A software company built a sequential workflow that reads each new ticket, classifies it with one agent and drafts a reply with another. Support leads use it every day.
what happens
Nobody owns the move. On December 1 the portal stops running it and drafts stop appearing, and the backlog grows before anyone links the two.
what to do
Export the YAML now, port it to Agent Framework declarative YAML and deploy it as a hosted agent. Replay a week of tickets and compare the classifications before switching.
01 Invoice overlimit 02 Summary agent 03 Logic Appsapproval 04 Managerdecides
scenario 02Medium risk
A finance approval flow owned by analysts
the setup
An insurer's finance analysts drew a human-in-the-loop workflow that summarizes invoices over a limit and asks a manager to approve. Nobody on that team writes code.
what happens
Engineering ports it to Python, and the analysts can no longer change a threshold without filing a ticket. On Python 3.14 the limit check stops evaluating and every invoice takes the same branch.
what to do
Rebuild it in Logic Apps Standard, calling the existing Foundry agent for the summary, so analysts keep a visual designer. Or keep the YAML and pin Python 3.13.
01 Old project 02 Privateregistry plan 03 Date check 04 New project
scenario 03High risk
A bank with private networking and old projects
the setup
A bank set up its Foundry projects early in 2026, all behind private endpoints. One group-chat workflow pulls data from an internal API, and nobody wants that traffic going public.
what happens
The team plans a fully private hosted agent build. The projects predate the June 25 cut-off, so the container registry has to stay reachable over its public endpoint, and the security review stalls a week before the date.
what to do
Check project creation dates now. Either approve a public registry endpoint with controls, or create a new project for the hosted agents and move the agents into it.

If you want a hand, we can sit with your team, port the first workflow together and build the regression set you'll reuse for the rest. The Microsoft Foundry page shows the wider platform work. You can also hire Foundry engineers for the busy weeks, or start with an assessment of what still runs on preview features.

key takeaways

What to take from this

  1. 01

    Foundry stops supporting the workflow designer and in-portal runs on December 1, 2026. Export every workflow's YAML before then.

  2. 02

    You don't lose the logic. Deploy the exported YAML as a hosted agent and Foundry runs it again, on a service that's out of preview.

  3. 03

    Microsoft points most teams at Agent Framework. If your people need a visual designer, look at Logic Apps, and if one agent just hands off to another, A2A is enough.

  4. 04

    Power Fx formulas don't run on Python 3.14 or 3.15, and some portal system variables aren't in Agent Framework's list. Test every branch.

  5. 05

    Generated code is a starting point. Keep the original workflow until the last caller has moved to the tested replacement.

  6. 06

    Classic agents go next spring, on March 31. If you have both, plan the two moves as one project.

platforms in this noteMicrosoft Foundry →
fact-checked October 2026 against vendor and official documentation · where to go next
  1. How Cohash delivers Microsoft Foundry: scope, roles and architecture
  2. Hire vetted Microsoft Foundry engineers
  3. Generative AI and agents
  4. Book a 30-minute working session with a senior engineer
01Will our Foundry workflows just stop on December 1? What actually happens?

The portal side does. After that date you can't edit them in the portal or run them from it. Microsoft says Foundry still runs YAML workflow definitions you deploy as a hosted agent, so export the YAML and move it before then.

02What replaces Foundry Workflows?

Microsoft's answer for most teams is Agent Framework, deployed as a hosted agent. If the people who own a workflow want to keep a visual designer, it points them to Azure Logic Apps. And if one agent only hands work to another, a direct agent-to-agent (A2A) call is enough.

03Can we just load our workflow YAML into Agent Framework? Or is it a rewrite?

Often you can. Microsoft says many exported workflows run with minimal changes. Before you trust it, check the Power Fx formulas, the system variables and any C#-only actions. Then run a request through every branch and compare it with the original.

04Do my Foundry agents have to be rebuilt?

No. The agents a workflow calls stay in your project. Agent Framework's declarative YAML invokes them by name, so what you rebuild is the orchestration around them.

05Is Microsoft Agent Framework production-ready?

The core is. Version 1.0 for .NET and Python came out in April with stable APIs and long-term support. A few pieces you'll touch here are still prerelease, like the .NET declarative workflow packages and the Python Foundry hosting package, so pin your versions.

06How are hosted agents billed?

You pay for the CPU and memory your active sessions use, and for model calls on top. Each session gets its own sandbox, so if you oversize it, you pay that extra for every person using it at once.

07We use Power Automate and Copilot Studio too. Are those affected?

This retirement is about workflows in Microsoft Foundry. Microsoft's notice doesn't mention Copilot Studio or Power Automate, even though the formulas use the same Power Fx language.

up next in this track

Keep the thread going.

What shipped, what changed underneath, and what it means for your upgrade.

  1. 01HashiCorp Vault 2.2 explained: TPM login, post-quantum PKI and the October fixes
  2. 02Upgrading to SailPoint IdentityIQ 9.0: what breaks and what to fix first
  3. 03Terraform 1.17 explained: what's new, who it touches and how we'd upgrade
  4. 04BeyondTrust Remote Support zero-day: patch it, then check who got in
  5. 05Patch PHP and Node.js this week: what broke and who's exposed
  6. 06OpenShift support dates through 2027: which clusters run out first and how to plan the upgrades
  7. 07Oracle's October security patches: what to fix first in EBS, PeopleSoft and Access Manager
  8. 08Oracle Java drops four root certificates over eMudhra: patch, then test what breaks
  9. 09Delinea Secret Server auth bypass: why the FIDO2 hotfix isn't enough
  10. 10IBM Verify Access flaws let attackers run code without a login: patch to 11.0.3.2
  11. 11Foundry Workflows retire on December 1. We'd start moving yours to Agent Framework now
  12. 12Vertex AI is retiring text-embedding-005 and three other embedding models: how to re-embed before search breaks
  13. 13dbt drops v1.3 to v1.7 from its platform on January 31, 2027: get pinned jobs onto a release track before they're deleted
  14. 14Brotli CVE-2026-111497 is now on CISA's exploited list, and you probably run more copies than you think
  15. 15Auth0 moved the Rules and Hooks deadline: Hooks stop on 30 April 2027, Rules on 31 January 2028
  16. 16Still on Okta Classic Engine? Three features stop working on March 5, 2027, and two of them block the upgrade
  17. 17Patched GitLab, still exposed: the CI regex bug CISA lists as exploited, and the Ruby step people miss
  18. 18Patched Ivanti Connect Secure in October? Two more exploited bugs, and the AD cleanup
  19. 19Patch roundup, week of Oct 26: upgrade Secret Server today, then work down the list
  20. 20UiPath 2023.10 support has run out and 2024.10 is next. What we'd upgrade first
  21. 21Password Safe 24.3 runs out of support in December, and 26.3 is still one upgrade away
  22. 22Upgrade Entra Connect Sync before April 2027 and move users off Microsoft's SMS codes
  23. 23Chrome drops XSLT on 17 November. What breaks in InterSystems, and the fix for your version
  24. 24Agent Builder, Evals and saved prompts shut on 30 November. Here's what to pull out first
  25. 25BeyondTrust Remote Support and PRA 24.3 lose support in November, and there's no one-step upgrade
all learning tracks →
01 Old model retires 1 Apr 02 Re-embed new index 03 Relevancetest 04 Switch bothsides
AI and data · 18 minVertex AI is retiring text-embedding-005 and three other embedding models: how to re-embed before search breaks

Re-embed into a fresh index first. Switch both sides once it tests well.

read next
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it