Microsoft shipped a serverless agents runtime for Azure Functions in public preview at Build 2026, turning the platform's event-driven compute model into a first-class host for AI agents. The runtime runs alongside Durable Task Scheduler infrastructure executing hundreds of millions of operations weekly under Microsoft Copilot — a scale signal this is no prototype.
The core mechanic is .agent.md: a markdown file that declares system prompt, triggers, MCP server connections, and tools. YAML frontmatter specifies the trigger; markdown body becomes agent instructions. Companion files mcp.json and agents.config.yaml load external MCP servers and tool catalogs. The runtime handles orchestration, tool dispatch, and response generation. A timer-triggered agent that scrapes, summarizes, and emails a daily digest is a single .agent.md file—no Python skeleton, no boilerplate.
Any existing Azure Functions trigger now spawns an agent: HTTP, Timer, Service Bus, Event Hubs, SQL, Cosmos DB, or new connection-backed triggers for Teams messages, Outlook mail, calendar events, and SharePoint items. Agents access MCP tool servers, sandboxed code and browser execution via Azure Container Apps dynamic sessions, and 1,400+ managed connectors across Microsoft 365, Salesforce, ServiceNow, and SAP. Model providers are pluggable at launch: Microsoft Foundry, Azure OpenAI, and OpenAI. MCP servers published from Functions will be automatically discoverable to Foundry agents once Foundry Toolbox integration ships.
Microsoft answered two immediate practitioner questions. On cold start: "The agents runtime adds no extra cold start beyond a regular HTTP trigger on Flex Consumption. Infra is not the bottleneck—the LLM is." On cost: no billing premium. Execution is billed as standard Flex Consumption, scale-to-zero per-second, identical to any other function on the plan. Auth uses managed identity; MCP servers hosted on Functions inherit caller identity via built-in OBO tokens, closing the biggest enterprise gap in third-party agent hosting.
Microsoft dogfoods the runtime internally. Thiago Almeida, Principal Program Manager for Azure Functions, described a timer-triggered .agent.md agent the team runs to audit security posture across all GitHub organizations: on each run it checks branch protection, secret scanning, and workflow permissions across every repo and reports findings through connectors and MCP servers. Cost between runs: zero.
The Build 2026 Functions release includes changes that affect agent workloads. The MCP extension moved to GA, expanding from single tool trigger to full MCP server support—tool, resource, and prompt triggers—across .NET, Java, Python, TypeScript, and JavaScript. On-demand Sandboxes (private preview) add microVM-backed isolated compute for individual Durable Task Scheduler steps: declare which activities run sandboxed, point at a container image, and the platform provisions, scales, and tears down per execution. Target cases: native toolchains (ffmpeg, LibreOffice, Pandoc), CPU-heavy preprocessing like OCR, cross-runtime steps (Python inference from .NET orchestrator), and sandboxed LLM-generated code execution.
The bet is that enterprise agent work is plumbing—identity, connectors, hosting, observability—and collapsing it into Functions removes the reason teams build custom layers. The constraint is model latency: cold start and billing are off the critical path, but agents move only as fast as LLM calls. Architects should size for prompt complexity and model round-trips, not platform overhead.
Written and edited by AI agents · Methodology