v7.1.0

Added

• Managed Foundry knowledge Toolbox. Use the official FoundryToolbox
  client with request-local Foundry call context. Foundry owns downstream
  knowledge-source delegation rather than a parallel Search-token path.
• Optional native user delegation. Keep user_delegated as the default and
  allow explicit Hosted service_identity. Let sources enforce their supported
  authorization without a source-type or capability allowlist.

Fixed

• Explicit tool failures. Stop model continuation after failed knowledge
  retrieval. Surface delegated consent through the native host, reject
  unavailable delegation at invocation time, and never fall back to another
  identity or start interactive consent in service mode.

Migration and recovery

• Adopt the coordinated platform release and its TOOLBOX_ENDPOINT binding.
  Keep UI admission and owner isolation enabled. Authentication-mode changes
  require coordinated redeployment and new sessions. Roll back the complete
  platform/component combination rather than one component in isolation.

Validation

• All required release PR checks passed.
• No Azure deployment, image publication or live delegation validation was performed.

v7.0.0

Changed

• Generic MCP tool discovery. Register remote tools through MCP_ENABLED;
  MCP is the protocol/server boundary, not the NL2SQL toolset. The orchestrator
  discovers the server's exposed tools without initializing SQL dependencies.
  MCP_AUTH_RESOURCE_SCOPE=api://<MCP API client ID>/.default selects
  request-scoped managed-identity bearer authentication, refreshed before
  expiry without API-key fallback. External API-key MCP remains supported
  when no resource scope is configured. Accept streamable-http and JSON
  trusted-host arrays.
• Invocation-scoped MCP refresh. Refresh MCP enablement, connection and
  authentication settings per native invocation, including activation after
  identity setup and resumed workflows. Other capability redeployment guards,
  native hosts/modes and SDK pins remain unchanged.
• Structured NL2SQL results over MCP. Preserve schema-version-1 source,
  query and metadata IDs, typed columns, rows and count, with text-only JSON
  support and explicit tool errors through the official MCP client.

Removed

• Breaking direct-SQL retirement. Remove direct NL2SQL registration,
  SQL/Fabric/DAX connectors, SQL validation/plugin/result types, SQL prompt
  and exclusive ODBC/sqlparse dependencies. No legacy SQL or GPT-RAG MCP
  fallback is provided.
  NL2SQL_ENABLED, NL2SQL_SOURCE_REGISTRY, NL2SQL_QUERY_TIMEOUT_SECONDS,
  NL2SQL_MAX_ROWS, DATASOURCES_CONTAINER, NL2SQL_STORAGE_CONTAINER,
  SEARCH_TABLES_INDEX_NAME, SEARCH_MEASURES_INDEX_NAME,
  SEARCH_QUERIES_INDEX_NAME, SEARCH_TABLES_INDEX_TOP_K and
  SEARCH_QUERIES_INDEX_TOP_K no longer configure orchestrator SQL.

Migration and recovery

• Coordinated MCP adoption. Adopt the platform manifest's complete component
  combination and central operator guidance together. Configure MCP_ENABLED,
  MCP_APP_ENDPOINT, MCP_TRUSTED_HOSTS and the server's authentication
  settings; move SQL access and Cosmos vector metadata configuration to the MCP
  server. Applications needing NL2SQL use the server's enabled
  nl2sql.list_sources and nl2sql.query tools, not removed orchestrator keys.
• Explicit server toolsets. Set server-side MCP_TOOLSETS to ["nl2sql"]
  only for applications needing SQL. The default [] keeps an authenticated
  MCP server with no tools and no NL2SQL dependency initialization. Keep
  application-specific toolsets and resources in the application definition,
  separate from the reusable foundation. The orchestrator's generic
  enablement, endpoint, scope, transport and discovery contract is unchanged.
• Complete-combination rollback. Preserve the prior compatible platform
  manifest, all component pins, configuration, immutable image digests and
  original state. Restore that complete combination, not only the orchestrator
  or a mix of old direct-SQL settings and the new MCP server. The preceding
  orchestrator source release is immutable v6.0.0
  (8cff5be48d166e3270f874374bd343e7899073ec); it is not proof of the prior
  deployed platform pin. No data migration or rollback automation is added.

Validation

• Focused consumer contracts. Maintained MCP client, native tool and native
  runtime tests cover official in-process MCP discovery/results, scoped bearer
  authentication and refresh, cleanup, trusted hosts and invocation-time
  activation. Release adoption also requires the actual main-target PR's
  required checks and the coordinated manifest's exact integration evidence.
• Source-only release scope. No Azure deployment, live model call, package
  or image publication, deployed identity/RBAC, private-network or complete
  application-combination validation is claimed by this component release.

Release evidence

• Main/tag commit: b89684b67f991b337e3519620210a6469622fc29; its tree exactly matches validated candidate 0c9fa9d5edf189cd85ba353257a89de0e7823e5a.
• Release PR #433 passed all required checks: block-pr, tests, frontend build, and quality-gate. Pipeline run 41384913631 completed successfully.
• Focused MCP client/native tools/native runtime batch: 89 passed. Release identity/history checks and engineering asset validation passed; all 75 external Action references remain pinned to full commit SHAs.
• This is a source-only consumer release. Coordinated platform manifest pins and central operator documentation remain the umbrella release's adoption authority. No package, image or deployment is published here.

v6.0.0

Changed

• Native Microsoft Agent Framework conversations and typed human-reviewed
  workflows through native.hosted / native.durable, registered as
  agent-lz-conversation / agent-lz-research-review.
• Public selection: ORCHESTRATION_HOST=hosted|container_apps and
  APPLICATION_MODE=conversational|workflow|both. Hosted uses one mode per
  publication. both requires separate Hosted publications.
• Explicit ManagedIdentity DTS binding, separate production host dependencies,
  optional NL2SQL/read-only SQL guards, retrieval/MCP and attachment serialization.

Breaking changes

• Classic AGENT_STRATEGY, /orchestrator, /conversations and
  /api/dashboard execution are retired in favor of the native contracts.
  This release targets new native deployments.

Validation

• Main-target run 41314318057,
  attempt 1: 1,230 tests + 10 subtests passed, zero failures/errors/skips.
  All required checks, frontend, five quality checks, real aggregate,
  engineering assets, CodeQL and CLA passed. Quality reports have zero findings.
• Main 8cff5be48d166e3270f874374bd343e7899073ec is entirely tree-identical
  to green candidate c9a3a7d931504a1eb0578ce801e434f1dc9c4e0b.
• Local release checks passed. No native-image build or Azure deployment.
  frontend build is not image-build proof. Live durability/isolation, model
  understanding, private networking, full infrastructure and remote audit
  remain unproven. No whole-platform validation is claimed.
• Native hosts do not supply delegated DAX/multimodal tokens. Those paths
  remain unsupported and fail closed.

Publication scope

• Source tag and GitHub Release only, with no package/image/deployment or
  automatic tag/release deployment.
• Published tags remain immutable. Rollback uses the previous deployment.

v5.3.1

Changed

• Reviewed dependency maintenance. Adopt OpenAI SDK 3.24, pyodbc 5.3 and
  React Refresh lint plugin 0.5.5 with matching dependency manifests and
  generated frontend lock. Retain the compatible Agent Framework, Search,
  Azure Monitor, MSAL and Tailwind dependency families.
• Prompt template escaping. Enable Jinja autoescaping for local prompt
  templates and reusable agent instructions. Substituted markup and special
  characters are now entity-encoded; literal template text and strict missing
  variable checks remain unchanged. Review prompt expectations for those
  values when adopting this security update.
• Shared repository protection standard. Require pull requests and passing
  quality, behavior and frontend checks without mandatory second-person review.
  Restrict the workflow integrity guard to the quality pipeline instead of
  unrelated automations, preserve evaluator and policy protections, and route
  ownership to the maintainer without requesting another reviewer.

Fixed

• Security dependency updates. Upgrade aiohttp and PyJWT to patched
  releases and refresh dashboard tooling and transitive dependencies. Vite 6
  replaces the vulnerable Vite 5 dashboard toolchain. A scoped patched
  selector-parser override removes Tailwind typography's vulnerable pin.
  Pair hosted responses 2.0.0b1 with core SDK 2.2.0 so clean installs retain
  the experimental API required by the pinned response adapter.
• Bounded deletion diagnostics. Log confirmed conversation deletion
  without interpolating user-controlled conversation or principal IDs.
• Explicit deployment workflow permissions. Limit the manual dev workflow's
  GitHub token to repository content read access without changing Azure
  credentials, deployment steps or its manual-only trigger.
• Immutable GitHub Actions references. Pin the remaining workflow actions
  to verified full-length commit SHAs without changing their selected versions,
  and require agents to preserve SHA pinning when editing or regenerating CI.

Validation

• Release PR Azure/agent-app-orchestrator#425 passed all required repository checks and the protected quality gate. The main release tree matches that validated candidate.
• Shared contract files are unchanged from the previous stable release.
• Validation was offline; no Azure deployment or live Azure end-to-end test was performed.

Publication scope and recovery

• This release publishes the source tag and GitHub Release only, not a container image or Python package.
• Prefer a forward corrective patch if an adoption issue appears; preserve immutable published tags. Previous stable reference: v5.3.0.

v5.3.0

Summary

Backward-compatible protected retrieval and explicit authentication recovery,
released as v5.3.0 on 2026-10-28.

Component

Component	Version	Release commit
Agent Landing Zone Orchestrator	v5.3.0	2c0579ef29a15bc862b150c1a6a8387f74de398e

This component release does not change peer-component or umbrella manifest pins.

Added

• Native per-user Search permissions. Protected retrieval forwards the
  delegated Search credential to native permission enforcement for indexed and
  remote knowledge sources, preserving conversation-upload scope without
  constructing manual group authorization or granting blob download access.
• Official hosted forwarded credentials. Both /responses and
  /invocations accept the explicit forwarded Search credential. Work IQ uses
  its separately registered application assertion; platform partition ids,
  request-body identity and Search tokens do not substitute for that assertion.
• Bounded downstream claims recovery. Search authentication challenges
  carry only canonical, validated claims through the existing failed-turn
  contract in both hosted adapters. Ambiguous or malformed challenges do not
  initiate claims recovery, and authentication failures are non-retryable.

Changed

• Request-local credential lifecycle. Immutable delegated credentials are
  isolated across concurrent requests and cleared after the turn. Token-bearing
  hosted Responses requests avoid SDK persistence and resilient replay;
  background execution is rejected, and credential headers are sanitized.
• Manual-only dev deployment. Updating develop no longer deploys to
  Azure. The dev deployment workflow runs only through an explicitly authorized
  manual dispatch.

Validation

• Exact-main post-adoption evidence binds fresh local validation
  to release commit 2c0579ef29a15bc862b150c1a6a8387f74de398e: 2,604 JUnit cases with zero failures/errors
  and four skips, 156 passing focused cases, and all five quality checks
  (lint, typing, architecture, exceptions, policy) passing with zero
  findings. All 92 broad handlers and 92 exact allowances are preserved.

• PR 413 CI
  passed all eight jobs on protected develop.
  Release PR CI
  passed tests, frontend build, lint and typing. Its older-main metadata
  findings remain recorded; the separately authorized one-time main adoption
  and exact protection restoration are documented in the evidence above.

• Offline behavior covers native Search permission requests, official hosted
  forwarded credentials, Work IQ provenance, safe downstream claims through
  both adapters, request-local cleanup, no replay and manual-only dev
  deployment. Azure deployment is not part of this release operation.

• Normal develop synchronization CI passed all eight jobs at 8c1ac1da36c4a5896ea4ba3bfe52687d187e1d16: 2,604 JUnit cases, zero failures/errors, four skips; frontend build, all five quality checks and aggregate passed. Its runtime and protected metadata match the published main commit.

Documentation and compatibility

The service README documents manual-only dev deployment. Published product
documentation and the coordinated peer-component combination are maintained
separately by the Agent Landing Zone release owner.

Recovery

The preceding published orchestrator release is
v5.2.2,
at 243e61191a7fdc5f1cf92f2ac47b779d58be3fa3. Re-select that artifact through
the authorized deployment process if rollback is needed. This release adds no
data migration; do not move a published tag.

Develop synchronization

PR #415 merged normally after all required CI passed. Develop is synchronized at 3a0945a1b514ddfbb0358d7dd2aa144b16bc02e0, with VERSION 5.3.0 and exactly one empty [Unreleased] section. Main/tag remain at 2c0579ef29a15bc862b150c1a6a8387f74de398e.

v5.2.2

Fixed

• Resolve application deployment destinations from AZURE_APP_RESOURCE_GROUP under the agent-lz label.
• Retain AZURE_RESOURCE_GROUP only for confirmed missing or empty application-group settings. Configuration access failures stop deployment.
• Keep runtime APIs, authentication and retrieval contracts unchanged.

Validation

• Python behavior and PowerShell/Bash destination regression tests.
• Frontend build and protected lint, typing, architecture, exception, policy and aggregate quality checks.

v5.2.1

Changed

• Select the explicit null App Configuration label instead of treating None as a wildcard, preserving the existing labeled-setting precedence.
• Add opt-in APP_CONFIG_TLS_COMPATIBILITY for verified App Configuration and Key Vault HTTPS transport; the default remains false, and enabling it requires KEY_VAULT_URI.
• Preserve managed identity, certificate and hostname verification, custom CA trust, and authentication-versus-availability error handling.

Validation

• Offline regression tests, the complete unit suite, frontend build, CodeQL, and all protected quality checks passed for the reconciled release.
• No Azure deployment or environment validation was performed for this release.

v5.2.0

Removed

• Legacy gpt-rag App Configuration label fallback and GPT_RAG_ key fallback (Azure/agent-landing-zone#695). The app now reads only its app label, then agent-lz, then no label.

Validation

• Unit test suite passed locally and in CI.

v5.1.1

Fixed

• Fail early with a clear error when NETWORK_ISOLATION=true, BUILD_MODE=acr-task and ACR_TASK_AGENT_POOL_NAME is missing (Azure/agent-landing-zone#741).

v5.1.0

Added

• Keyless service authentication (ADR-0019). The orchestrator now accepts
  a Microsoft Entra access token in the X-Service-Authorization: Bearer
  header, validated against ORCHESTRATOR_AUTH_AUDIENCE, the tenant issuer,
  and the ORCHESTRATOR_ALLOWED_CALLER_IDS allow list (oid/azp/appid).
  Callers authenticate with their managed identity; no shared secret is
  needed. The Authorization header stays reserved for the user OBO token.
  The Dapr token and X-API-KEY remain as fallbacks.