Are AI Agents breaking how we design Azure networking?

Your concern is valid: an agent that can choose tools and act on data should not be treated exactly like a conventional stateless application tier. Keep the hub-and-spoke foundation, but classify each agent by the sensitivity and impact of its tools, then isolate higher-risk agents in dedicated project or network boundaries. For Foundry Agent Service, choose private networking when you need both private inbound access and controlled outbound access; a private endpoint alone protects inbound traffic, not egress. Put databases and storage behind private endpoints, deny broad Internet access, and explicitly allow only documented dependencies and approved tool destinations. Test every required tool because support differs under network isolation. Use Microsoft Entra Agent ID for a distinct agent identity, audit trail, and least-privilege downstream RBAC, with managed identity for the blueprint. Finally, log tool calls, apply approval gates to destructive actions, and review network, identity, data, and audit controls separately.