Copilot harness enters public preview in Microsoft Foundry ahead of December billing

Microsoft opened a public preview of the Copilot harness in Foundry Agent Service on October 28, giving developers a managed environment for running AI agents. Microsoft operates the loop that coordinates model decisions and tool execution, together with an isolated sandbox. Developers supply instructions, skills and their choice of model, reducing the infrastructure they have to maintain themselves.

Runtime is free until December 1, 2026, when usage billing begins at $0.0994 per vCPU-hour for compute and $0.0118 per GiB-hour for memory. Inference, separately billed tools and connected services retain their charges throughout. Prices vary by region and agreement.

The harness coordinates the software around a model, including tool use and execution. Microsoft said it is expanding the GitHub-built foundation across its Copilot products. Developers can download an SDK to integrate it into their applications or run it through Foundry's managed cloud environment.

Each Foundry conversation has its own workspace for files and execution state. That state survives normal sandbox idling, resumption and replacement. Starting a new conversation creates separate history and a separate workspace. Important outputs belong in Foundry Files or another durable storage service, keeping final deliverables outside the working environment.

Skills hold procedures, scripts and reference material separately from agent code. Foundry stores each update as a new immutable version. An agent can pin a particular skill version in the same project. When no version is specified, Foundry resolves the current default and saves that immutable version on the newly created agent version. This gives repeated tasks, such as research or code review, a separately managed set of instructions. Microsoft says customers are responsible for understanding deployed skills and the data-handling practices of external endpoints that receive their data. Skills follow the Agent Skills format, combining instructions and supporting files in a folder.

Tool approvals and regional limits

New agents have file reading, file writing, shell commands, web fetching and subagent delegation enabled by default, subject to service and organizational policy. Shell commands retain access to permitted files and networks when separate file or web tools are disabled.

External MCP tools can have allowed-tool lists and approval requirements. An empty allowed-tool list gives access to all tools exposed by that server. A call requiring permission returns a request identifying the tool and its arguments; the application sends its decision back in the same conversation to continue. Those settings govern customer-configured MCP tools. During this preview, the service manages approval policy for built-in harness tools. Connected services retain their authentication and permission requirements. The application implements the approval interface, reviewing the proposed operation and arguments before returning a decision.

The harness preview supports nine regions, including Japan East and West US; Korea Central is outside that list. It requires a reasoning and tool-calling model available to prompt agents in the selected region. Bring-your-own-model support is currently unavailable. Agents can reference up to 50 top-level skills, while CPU, memory and sandbox lifecycle settings remain service-managed.

GitHub separately announced that its Copilot SDK is transitioning to Microsoft Copilot SDK. Branding, documentation and the repository's move to Microsoft's organization are proceeding in phases. Existing package names and namespaces can retain GitHub references during the transition. GitHub said current users need no immediate changes and that SDK support remains unchanged.

For Foundry's initial preview, the harness is chosen when a new agent is created. Existing agents cannot switch to it, and creating another version preserves that choice. Microsoft provides this preview without a service-level agreement and advises against using it for production workloads.