Repository navigation
Microsoft 365 Agents SDK for Python - Release Notes v1.9.0
Release Date: 2026-10-19
Previous Version: 1.8.0 (Released 2026-10-01)
Slack
- Slack-Aware Turn Context: Added
SlackTurnContext,SlackActivity, andSlackRouteHandlerso Slack handlers receive a typed context with direct access to Slack channel data and the per-turn API client (#624). - Route Decorators: Added typed
SlackAgentExtension.message()and.event()decorators. Deprecatedon_message()andon_event()while retaining them as backward-compatible aliases (#624, #627). - Slack-Scoped Application Route Hooks: Added
SlackAgentExtension.conversation_update(),.members_added(),.members_removed(), and.installation_update(), which delegate to the matchingAgentApplicationhooks filtered to the Slack channel (#627). - Typed Model Lookups: Added a
type_parameter and typed overloads toSlackModel.get()for converting and validating nested values with Pydantic (#624).
Major Features & Enhancements
- Outbound Host Validation Hardening: Enhanced
OutboundHostValidatorwith HTTPS-only URL enforcement, DNS resolution validation for public and optionally private network addresses, and an SSRF-awareaiohttpconnector that validates resolved IPv4 and IPv6 addresses before connecting (#621). - Channel-Aware Route Selectors: Added reusable route selectors, optional
channel_idfiltering toAgentApplicationroute hooks, and Teams-channel scoping for directTeamsAgentExtensionroutes (#626). - New Application Route Hooks: Added
AgentApplication.event(),.invoke(),.installation_update(),.members_added(),.members_removed(),.end_of_conversation(),.message_reaction_added(), and.message_reactions_removed();message(),event(), andinvoke()accept a string, regex, or list selector, and match everything atRouteRank.LASTwhen the selector is omitted. Added Teams-scopedTeamsAgentExtension.installation_update()and.end_of_conversation(), plus the Slack-scoped hooks listed above (#627). - Copilot Studio Endpoint Discovery: Added automatic discovery, validation, and caching of conversation operation URLs for published agents without a
direct_connect_url, while retaining legacy routing for prebuilt agents and explicit URL overrides (#630).
Deprecation
- Attachment Downloader HTTP Configuration: Replaced custom
client_factoryinjection withclient_session_kwargs; the deprecatedclient_factoryparameter is ignored. This ensures attachment requests always use the validator-managed middleware and connector, preventing custom client sessions from bypassing hostname allowlists, redirect validation, or resolved-address checks while still allowing supportedaiohttp.ClientSessionoptions to be configured (#621).
Bug Fixes
- Connector User-Agent Headers: Added the SDK
User-Agentheader toMCSConnectorClientand ensuredConnectorClient,TeamsConnectorClient, andUserTokenClientapply it to caller-providedClientSessioninstances (#618). - Teams Meeting Event Models: Fixed meeting start and end routes to use
MeetingStartEventValueandMeetingEndEventValue, respectively, instead ofMeetingDetails, ensuring handlers receive correctly typed event data (#619). - Streaming Feedback and AI Labels: Fixed Teams feedback-loop buttons by placing feedback metadata in the final message's
channelData, and ensured the AI-generated label is emitted even when there are no citations (#592).