Persistent memory in Foundry Agent Service increases user continuity and personalization, but it also turns transient prompt risk into durable state risk. Microsoft’s Zero Trust guidance explicitly warns that persistent memory expands blast radius, while Foundry’s own memory documentation highlights prompt injection and memory corruption as key concerns. Security design therefore has to move from “prompt safety only” to “memory lifecycle safety.”
Architecture & Deep Dive.
A defensible design uses scope isolation, write gating, retrieval risk assessment, and full observability. Scope separation prevents cross-user bleed; write gating prevents untrusted content from landing in memory; retrieval should not blindly treat stored context as trusted truth; and tracing must expose tool calls, failures, annotations, and latency across the run. Prompt Shields add security controls for both user prompt attacks and document attacks, and Spotlighting provides an extra defense for low-trust third-party content, albeit with token-cost trade-offs.
Step-by-Step Implementation & Scripts.
Create the memory store explicitly, enable only required memory types, instrument Application Insights tracing, and query correlated request/dependency/exception telemetry via operation_Id. Private networking should include the dependency plane, not only the Foundry project itself.
from azure.ai.projects import AIProjectClient
from azure.ai.projects.models import MemoryStoreDefaultDefinition, MemoryStoreDefaultOptions
from azure.identity import DefaultAzureCredential
client = AIProjectClient(endpoint=os.environ,
credential=DefaultAzureCredential())
definition = MemoryStoreDefaultDefinition(
chat_model=”gpt-5.2″,
embedding_model=”text-embedding-3-small”,
options=MemoryStoreDefaultOptions(
user_profile_enabled=True,
chat_summary_enabled=True,
),
)
store = client.beta.memory_stores.create(
name=”prod-user-memory”,
description=”Scoped persistent memory for production agents”,
definition=definition,
)
AppRequests
| where TimeGenerated > ago(1h)
| project TimeGenerated, OperationId, Name, DurationMs, Success, ResultCode
| join kind=leftouter (AppDependencies | project OperationId, DependencyType, Name, Target, Success, ResultCode) on OperationId
| join kind=leftouter (AppExceptions | project OperationId, ExceptionType, ProblemId) on OperationId
| order by TimeGenerated desc
Troubleshooting Guide & Common Edge Cases.
Look for poisoning when the agent repeats incorrect instructions across sessions, when user behavior appears to “bleed” across identities, or when newly learned procedures become unsafe defaults. Look for observability gaps when traces are missing because Application Insights is not connected or RBAC is incomplete. Look for network misconfiguration when private Foundry projects still time out against Search, Storage, or Cosmos because their private endpoints and DNS plumbing were never finished.
Best Practices.
Treat memory as a governed data plane. Use scoped stores, retention controls, explicit cleanup paths, annotate-before-block guardrail rollout, limited content capture in production, dependency-complete private networking, and least-privilege RBAC on agent identities.