v7.1.0

Changed

• Add optional Hosted service-identity authentication while keeping user-delegated OBO as the default. Both modes retain authenticated UI admission and conversation, citation and download ownership.
• Use the official managed Foundry knowledge Toolbox with request-local call context. Sources enforce their own authorization without a Blob-only or capability allowlist.
• Fail explicitly when source delegation is unavailable or a tool fails. Never fall back to another identity or automatically replay consent.
• Adopt the exact published UI and orchestrator commits recorded in the platform manifest and bundled application definition. Authentication-mode changes require coordinated redeployment and new native sessions. Roll back the complete prior component/configuration combination.

Component versions

Component	Version
agent-app-mcp	v2.0.0
agent-app-ui	v3.6.0
agent-app-orchestrator	v7.1.0
agent-app-ingestion	v3.1.3
infra / AI Landing Zone	v2.7.3

Validation

• Release CI passed Bicep build/lint/offline contracts, deployment and hook contracts, and Terraform contracts on Ubuntu and Windows.
• Focused validation: python -m pytest tests/test_release_contracts.py -q passed 17 tests and 6 subtests against the real loaded bundled application definition and exact published component pins.
• Bicep and Terraform both provision the managed connection, Toolbox endpoint and scoped identity grants. Provider dependency pins and incorporated infrastructure provenance are unchanged.
• No Azure deployment, image publication, live delegation or deployed provider parity is claimed.