Forum Discussion
MicrosoftMicrosoft Foundry External MCP Server Traffic Routing via Corporate Firewall
The customer would like to confirm whether traffic from an Azure AI Foundry agent to an external MCP server can be routed through a corporate firewall and whether this scenario is officially supported.
To validate this scenario, I configured the following in my lab:
- Deployed an Azure AI Foundry resource using the Standard Agent Service with network injection.
- Created a dedicated subnet for the Foundry Agent Service and delegated it to Microsoft.App/environments.
- Associated a route table with the Foundry Agent subnet to route outbound traffic through Azure Firewall.
- Configured the required application and network rules on Azure Firewall.
The Foundry agent is able to successfully retrieve data from the external MCP server. However, no corresponding traffic is visible in the Azure Firewall logs.
Could you please confirm whether outbound traffic from the Foundry agent to an external MCP server can be routed through Azure Firewall or a corporate firewall? Also, is this routing scenario officially supported?
Appreciate your support!
1 Reply
You’re confirming whether a Standard Foundry Agent with network injection can route an external MCP tool call through Azure Firewall, because the call succeeds but no firewall event appears. Microsoft’s networking model says tool-server calls use a single-tenant data proxy in the delegated agent subnet; with bring-your-own VNet injection, a firewall can control egress to approved internet endpoints. Custom MCP servers, including private ones, are supported. Confirm the Foundry account was created with network injection, because adding it later is unsupported. Verify the route table is associated with the Microsoft.App/environments delegated subnet and its 0.0.0.0/0 route points to the firewall private IP. Invoke one tool at a UTC timestamp, then query AZFWApplicationRule and AZFWNetworkRule and confirm diagnostic settings are enabled. Avoid TLS inspection for required Foundry endpoints. If logs remain empty, open Microsoft support with the project ID, subnet, route table, firewall policy, MCP FQDN, and timestamp.
