Azure

Copilot Studio vs Azure AI Foundry for Building Agents

Copilot Studio vs Azure AI Foundry (now Microsoft Foundry): identity, billing, limits, testing, and an approval-before-change pattern for IT work.

Published 06 November 2026

Both products build AI agents, but they suit different builders. This comparison of Copilot Studio vs Azure AI Foundry uses Microsoft's documentation to cover identity, billing, limits and testing, and ends with a pattern for IT work that needs human approval. Naming note: Microsoft's Foundry overview lists Azure AI Foundry as a previous brand and Microsoft Foundry as the current name, so this guide says Microsoft Foundry from here on.

Verdict

Verdict: Build in Copilot Studio when a maker can own the agent and its tools are connectors; build in Microsoft Foundry when developers need code, hosting control or network isolation.

Either way, keep infrastructure-changing actions behind a human approval step.

Who this is for

IT teams deciding where to build an internal or customer-facing agent, and who will have to run it afterward. It assumes a Microsoft 365 tenant and, for Foundry, an Azure subscription.

Low-code or pro-code

Copilot Studio is, in Microsoft's words, a graphical, low-code studio for building and managing agents and workflows. Whatever you build runs on a harness: the GitHub Copilot harness for reasoning-heavy multi-step work, the Customer Conversation harness for customer chat and voice, and the standard harness for rule-based, topic-driven agents. You can also attach agent flows, which Microsoft says have an authoring experience similar to Power Automate.

Microsoft Foundry has Foundry Agent Service, which Microsoft describes as a managed platform for building, deploying and scaling agents. Prompt agents are defined by instructions, a model and tools, and Foundry runs them with no code or containers to maintain. Hosted agents are your own code, built with frameworks such as Microsoft Agent Framework or LangGraph, which Foundry runs as a container with a managed endpoint, scaling and a dedicated Entra identity. You can also call the Responses API from an agent you already run elsewhere.

Decision table

Question	Copilot Studio	Microsoft Foundry
Who builds	Makers and power users	Developers
Tools and actions	Connectors (prebuilt or custom), agent flows, prompts, REST API, MCP, computer use	Built-in tools, functions, OpenAPI, MCP servers, toolboxes
Identity	Per-agent authentication setting; tools run as the user or the maker	Entra agent identity per agent, Azure RBAC, optional on-behalf-of
Billing	Copilot Credits	Azure consumption: tokens, tools, and container compute for hosted agents
Governance	Power Platform data policies, environments, Purview audit	Azure RBAC, Azure Policy, networking, content filters
Testing	Test chat and evaluation test sets	Playground, tracing, evaluations
Good first project	Internal helpdesk or onboarding agent	One knowledge source with a prompt agent, then an app

Connectors, tools and actions

In Copilot Studio, tools come from connectors, agent flows, prompts, REST APIs, Model Context Protocol servers and computer use. Admins can block connectors with data policies, in which case the tool appears disabled to makers. With generative orchestration, Microsoft says an agent supports up to 128 tools, and recommends 25 to 30 for best results. Each tool has a description that the agent uses to decide when to call it, so vague descriptions cause wrong calls.

In Foundry, a toolbox groups tools behind one managed MCP-compatible endpoint with centralized authentication, governance and versioning. Remote MCP servers can authenticate with a key, with Entra using the agent's or project's managed identity, with OAuth on-behalf-of, or without authentication. Microsoft tells builders to treat tool descriptions and results from remote MCP servers as untrusted input, because they can carry indirect prompt injection.

Authentication and identity for agents

Copilot Studio. Authentication options are No authentication, Authenticate with Microsoft and Authenticate manually. No authentication means anyone with the link can chat. For each tool you choose whether it runs with the end user's credentials (the default) or the maker's. Microsoft's Entra documentation says that in organizations using Copilot Studio each new agent gets an agent identity in the tenant and the creator is recorded as its sponsor, while the Copilot Studio security page says agents can be represented as Entra identities for organizations that onboard Microsoft Agent 365. Check which applies in your tenant.

Microsoft Foundry. Microsoft says each new agent gets its own agent identity blueprint and identity, which starts without resource permissions; Foundry does not assign roles for you. You grant access through the target service, preferring resource or resource-group scope. Foundry identities appear in the same Entra inventory as Copilot Studio agents, and Microsoft lists Conditional Access, identity protection, network controls and owner, sponsor and expiry governance for them. Acting on behalf of a user is marked preview.

Credits and consumption

Copilot Studio uses Copilot Credits, available through prepaid packs, pay-as-you-go through an Azure subscription, or a one-year prepurchase plan. Microsoft's rate table, dated 30 October 2026, lists 1 credit for a classic answer, 2 for a generative answer, 5 for an agent action, 10 for tenant graph grounding and 13 per 100 agent flow actions. Some employee-facing use by Microsoft 365 Copilot licensed users is not charged. These are credit rates, not prices. Capacity is enforced monthly, unused credits do not carry over, and at 125 percent of prepaid capacity agents are blocked unless a pay-as-you-go plan covers the overage.

Foundry has no single price page. Microsoft says costs come from the Azure services you use, billed pay-as-you-go or with commitment tiers, with model tokens metered by input and output. Hosted agents add container compute. Costs are tracked in Cost Management, and Microsoft notes that Azure OpenAI offers no hard spending limit, so use budgets and alerts.

Monitoring and governance

Copilot Studio reports analytics and agent evaluations, gives admins an agent inventory with role-based access, and sends maker audit logs to Microsoft Purview and agent activity to Microsoft Sentinel. Data policies control authentication, knowledge sources, connectors, HTTP requests, channel publishing and triggers. Admins can also turn off publishing of generative AI agents for the tenant.

Foundry provides tracing of every model call and tool invocation, evaluations, Application Insights integration and built-in dashboards, some marked preview. Entra sign-in and audit logs record which agent identity obtained a token for which resource.

Testing and evaluation

Copilot Studio evaluation uses test sets of questions with optional expected answers, graders, and four safety evaluators. Microsoft says the safety evaluators do not guarantee an agent is safe. Evaluation supports only agents set to No authentication or Authenticate with Microsoft, not manual authentication, and it runs as the signed-in user. Foundry's development lifecycle is create, test in the playground, trace, evaluate, publish and monitor. Voice-agent evaluation is more limited and several voice features are preview.

Limits to design around

Copilot Studio standard-harness agents: 500 knowledge sources, 5 MB connector payload on public cloud, a five-minute model streaming timeout, and generative message limits of 50 requests per minute on 1 to 10 prepaid packs or 100 on pay-as-you-go.
Foundry quota is per Azure subscription in tiers, and the Free tier cannot get quota increases.
Preview features carry no service-level agreement.

IT automation: which platform, and the approval gate

Scenario	Suggested platform	Gate before any change
Answer helpdesk questions from a knowledge base	Copilot Studio	None; read-only knowledge
Create a ticket or onboarding checklist	Copilot Studio agent flow	Confirm with the user before the tool runs
Summarize alerts and propose a fix	Foundry prompt agent	Output is a proposal only
Restart a service, resize a VM or change a firewall rule	Foundry, or a flow Copilot Studio calls	Named human approval, then a separate narrow identity
Bulk or destructive changes	Neither as an unattended agent	Use a reviewed script and change process

Infra automation with human approval

Use one pattern on either platform.

Propose, never execute. The agent's identity has read access and a tool that writes a change request, not the change.
Approve. In Foundry, set an MCP tool's approval to always so each call waits for a human response, and log the approvals. In Copilot Studio, use the agent flow request for information action, which pauses the flow and collects a reviewer's answer. Microsoft documents limits: it is sent through Outlook only, cannot go outside your tenant, and when several people are assigned the first reply is used, so assign a small named approver group and do not let the requester approve.
Execute with a separate identity. A second identity with the narrowest Azure RBAC role, scoped to one resource group, runs the approved change.
Record. Keep the request, approver, change and result for audit.

Our guides on AI PowerShell preview with human approval, agent identity and least privilege and the audit trail cover the same ideas. Microsoft documents the approval controls above but does not publish an end-to-end approval design for infrastructure, so test yours with non-production resources first.

Mistakes that cause problems

Leaving a Copilot Studio agent on No authentication with internal data.
Using maker credentials for a tool that touches sensitive data.
Granting an agent identity subscription-wide roles.
Letting the same identity propose and execute a change.
Trusting tool descriptions from a third-party MCP server.
Building a Foundry hosted agent for a task a maker could finish in a day.
Ignoring credit or token consumption until the invoice.

Checklist

Builder, owner and sponsor named for every agent
Authentication setting and tool credentials chosen deliberately
Data policies or RBAC set before publishing
Budget, alerts and a monthly limit configured
Test set or evaluation run before release and after changes
Approval step and separate executor identity for any change
Logs reviewed: Purview or Sentinel, or Entra and Foundry tracing

Sources

Checked 6 November 2026.