How to Add Human Approval to Microsoft Foundry Agent Workflows

In this blog post How to Add Human Approval to Microsoft Foundry Agent Workflows we will explain how to stop a useful AI automation from turning into an expensive or risky mistake without someone checking it first.

At a high level, human approval creates a controlled pause in an AI workflow. The agent can collect information, prepare a recommendation and propose an action, but it must wait for an authorised person before it sends, changes, purchases, refunds or deletes anything important.

This gives technology leaders a practical middle ground. You can remove repetitive work without giving an AI agent unrestricted authority over customers, company data or financial systems.

Why capable AI agents still need approval points

A Microsoft Foundry agent is more than a chatbot. It can use company information, call approved software tools and complete steps across a business process.

That capability creates value, but it also increases the consequences of a poor decision. An incorrect answer is inconvenient. An incorrect refund, account change or customer email can cost money and damage trust.

Human approval is especially valuable before an agent:

• Commits company funds or approves a refund.
• Sends an external message on behalf of the business.
• Changes user access, security settings or device policies.
• Reads or shares sensitive customer and employee information.
• Deletes records or performs another difficult-to-reverse action.
• Handles an exception outside normal business rules.

The aim is not to have an employee approve every minor step. That simply replaces one slow process with another. The aim is to place approval where the business impact justifies it.

How the approval technology works

Microsoft Foundry Agent Service provides the managed environment for creating and running AI agents. Microsoft Agent Framework provides the building blocks for placing those agents inside controlled, multi-step workflows.

When an agent wants to use a protected tool, Microsoft Agent Framework can return an approval request instead of immediately running the tool. Your application presents the request to an authorised reviewer and passes the decision back to the agent.

1. The agent receives a task and prepares a proposed action.
2. The framework recognises that the requested tool requires approval.
3. The workflow pauses and sends the request to a person or business system.
4. The reviewer sees the action, supporting information and likely impact.
5. The reviewer approves, rejects or requests a change.
6. The workflow records the response and either continues or stops.

For broader human interaction, workflows can use a request-and-response channel. This allows an agent to ask for approval, clarification or missing information without losing its place in the process.

Checkpoints can also save the workflow’s current state. If an approver responds hours later, or the application restarts while waiting, the process can continue from the saved point rather than repeating completed work.

Build new approval workflows in Agent Framework

There is an important platform change to consider. Microsoft has announced that the preview visual workflow capability inside Foundry will be retired on 1 December 2026. Organisations building new workflows should therefore use Microsoft Agent Framework rather than creating a long-term dependency on the retiring workflow designer.

This does not mean moving away from Foundry agents. It means using Foundry Agent Service for the managed agent and Agent Framework for orchestration, approval controls and durable execution.

If you are still moving from a prototype to a controlled business application, our guide to building Microsoft Foundry agents with Microsoft Agent Framework explains the wider architecture.

A simple tool approval pattern

In Microsoft Agent Framework, a developer can mark a function as requiring approval. A function is simply a defined action the agent can request, such as creating a purchase order or issuing a refund.

// Simplified C# example
AIFunction issueRefund =
 AIFunctionFactory.Create(IssueCustomerRefund);

AIFunction controlledRefund =
 new ApprovalRequiredAIFunction(issueRefund);

// Give the agent the controlled function,
// not unrestricted access to the original action.
var tools = new[] { controlledRefund };

This small technical control changes the operating model. The agent may recommend a refund and prepare the details, but the refund function cannot run until the calling application receives a valid approval response.

The approval screen should show more than an Approve button. It should explain the customer, amount, reason, source data, proposed action and what will happen next. A rushed manager should not need to reconstruct the entire case.

Match the approval level to the business risk

Requiring executive approval for every action will frustrate employees and erase the productivity benefit. A better design uses risk-based approval rules.

For example, a customer service agent could automatically prepare replies using approved information. Routine responses could be sent after basic checks, while complaints, legal threats and compensation offers are routed to a team leader.

A finance workflow might allow invoices from known suppliers under $1,000 to continue when the purchase order and amount match. New bank details, duplicate invoices or larger payments could require finance approval.

Approval conditions should be based on clear business rules rather than the agent’s confidence alone. AI confidence can be useful supporting information, but it should not replace controls covering value, data sensitivity, user identity and the reversibility of the action.

Make the pause secure, durable and auditable

An approval step is only useful if the right person is making the decision. Connect approvals to Microsoft Entra ID, Microsoft’s identity and access service, so the workflow can verify the reviewer and apply role-based permissions.

The agent itself should also receive only the access it needs. If it can draft a user account change, it does not automatically need permission to apply every change across the organisation.

Record who approved the request, what information they saw, the exact action proposed and the final result. These records help with internal reviews, incident investigations and Australian Privacy Act obligations where personal information is involved.

Human approval does not automatically deliver Essential 8 compliance, the Australian government’s baseline cybersecurity framework. However, controlled access, clear accountability and reliable audit records support the broader governance needed to protect important systems.

For workflows that may wait overnight or cross several teams, durable execution is equally important. Our article on designing durable and secure Agent Framework workflows covers how to preserve progress and recover safely from failures.

What this looks like in a real business process

Consider a 200-person professional services firm processing 300 supplier invoices each month. Staff currently inspect every invoice, even when the supplier, purchase order and amount all match.

A Foundry agent could extract the invoice details, compare them with purchasing records and prepare the transaction. Straightforward matches could follow an agreed low-risk path, while changed bank details, missing purchase orders and high-value payments pause for finance approval.

If 70 per cent of invoices meet the low-risk rules, employees focus their attention on around 90 exceptions rather than manually handling all 300. The business saves time while keeping people responsible for the decisions most likely to cause financial loss.

Do not stop at the approval button

Monitor how often requests are approved, rejected, changed or left waiting. A high rejection rate may indicate poor instructions or unreliable source data. Long delays may indicate that approval thresholds are too broad or requests are going to the wrong people.

You should also test what happens when an approver is unavailable, a request expires or the underlying data changes while the workflow is paused. Our guide to monitoring and evaluating Microsoft Foundry agents safely provides a practical starting point.

Keep automation fast without giving up control

The strongest agent workflows do not choose between full automation and manual work. They automate the predictable preparation, preserve human judgement for material decisions and keep a reliable record of what happened.

CloudProInc combines more than 20 years of enterprise IT experience with hands-on expertise across Microsoft Foundry, Azure, Microsoft 365 and cybersecurity. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations design approval controls that fit their actual risks rather than adding unnecessary process.

If you are unsure where a Foundry agent should act automatically and where a person should remain responsible, we are happy to review the workflow with you — no strings attached.