Microsoft Agent Framework python-1.20.0 release

What it claims

Python release 1.20.0 of Agent Framework, dated 2026-10-02 and following python-1.19.0. The release carries three breaking changes. The summary flags only one of them (Foundry hosting). It also contains several security-relevant behaviour changes in approvals and MCP that alter runtime semantics without being labelled breaking.

One correction to the summary: the page does not list a MongoDB vector-store connector. It lists a MongoDB agent RAG sample (#8725). The new native vector-store connectors are DuckDB and SQL Server only.

How to use it

Check these before upgrading:

• Gemini users (breaking): settings now use the GOOGLE_* environment namespace. Gemini Embedding 2, vector task options and operation-specific embedding options in the shared vector APIs also land here (#8798).
• Foundry hosting (breaking): the release adds request-scoped agent factories, persistent sandbox-isolated sessions and durable Invocations runs. Responses history, background execution and options are now configurable. Native workflows can now be hosted over Foundry Responses and Foundry Invocations (#8947, #8966).
• Declarative workflows (breaking, experimental): this release changes state attribute lookup, bounds PowerFx state construction and normalizes workflow HTTP request URLs.
• Approvals now fail closed:
• Local approvals must be session-backed.
• Approval bindings or agent-tool approvals that cannot be resolved now cause failure instead of passing.
• Matched function and tool results are treated as terminal (#8579, #8589, #8750, #8780, #8527).
• Code that relied on permissive approval resolution may now stop.
• MCP security labels: labels are now applied before dynamically discovered or progressively disclosed tools become callable (#8972). In earlier versions such tools could be callable before labelling.
• Foundry telemetry: requires Azure Monitor OpenTelemetry 1.8.10 for trace propagation. Supports Azure AI Projects through 2.7.
• The all extra is now pinned to the current release cohort, to stop pip resolver backtracking.
• Typing: many integration packages now ship py.typed, so type checkers will start checking calls into them.
• New core hooks:
• response-stream gates and buffering
• session-scoped file-access isolation
• a TypedDict for AgentExecutor checkpoint state
• opt-in FunctionInvocationContext injection for skill scripts
• Orchestrations: Magentic managers are now created per workflow. Return-to-previous handoff routing can be disabled. Generated handoffs are validated before routing.

The page gives no install commands.

Limits

• Python 3.15: agent-framework-redis is capped below Python 3.15 because of redisvl. msgspec 0.22 is supported for 3.15 installs. Postgres and Hyperlight dependency resolution on 3.15 was restored in this release. Windows coverage is described only as "bounded" 3.14 meta-package install testing.
• CodeAct (Hyperlight, Monty): this release only clarifies the documentation on guest-package installation and host-network access. Read that documentation before exposing sandboxed code execution.
• Earlier releases had real gaps that this release fixes, so upgrading is advisable if you depend on these areas:
• OpenAI metadata defaults leaking into Azure-routed clients
• Chat Completions streams not closing when a consumer stopped early
• Responses API citations lost through AG-UI
• Telegram bots responding to commands addressed to other bots
• No numbers on performance: the hot-path overhead reduction (#8971) gives no figures.