[Digvijay (Digvijay)]

What

New MicroHack in 03-Azure/01-04-AI/13_Frontier_Operations: Frontier Operations: Agents That Do the Work.

Participants pick a fictional company (distribution, telco, energy, insurance or retail) and hand its monthly reconciliation to an agent built on the Microsoft Copilot harness in Foundry. Low-code, in the Foundry portal, with a few pasted commands in Cloud Shell.

Challenge	What they build
1	A harness agent that reads files, runs Python in its workspace and returns a finished workbook
2	A skill with the team's reconciliation rules, scored before and after
3	Subagents, one per partner, combined into one workbook
4	An OpenAPI tool to the ERP with the API key kept in a Foundry connection
5	Browser automation in a partner portal with no API, with approval and a check of what the agent submitted
6	Network egress rules (audit, then enforce), the agent's own identity with least privilege, and traces
7	Two models compared on time, accuracy and cost per run, and the business case
8 (stretch)	The same agent, skill and tools as code with the Azure Developer CLI
Finish	A process canvas and a first skill for a process from the participant's own organisation

Contents

• Five fictional industry packs: partner statements, ERP data, a partner portal and expected results, including a hidden instruction for the safety challenge.
• Setup tool (python3 -m frontierops): setup, grant-agent, publish-skill, get-skill, copy-agent, score, download and status. Every command is explained in the challenge where it is used.
• Mock ERP API (API key) and partner web portal (no API) on Azure Functions Flex Consumption.
• Lab automation: infra/main.bicep and labautomation/ (Foundry with gpt-5.4-mini and gpt-5.4, Playwright Workspaces browser connection, Storage, Functions, Application Insights connected to the project).
• Coach walkthroughs with measured results per challenge, expected results per pack and troubleshooting.
• Executive one-pager, Codespaces devcontainer (.devcontainer/03-azure-01-04-ai-13-frontier-operations) and the hack's line in 03-Azure/01-04-AI/Readme.md.

Validation

• Full participant run through the portal on a live lab in uksouth, challenge by challenge; the screenshots come from that run, with personal and tenant details blurred.
• 83 tests (setup tool, scorer, ERP and portal app, content and template checks).
• az bicep build clean; the lab was deployed, used end to end and removed.

Known limits, documented in the challenges and walkthroughs:

• Cloud Shell's built-in sign-in cannot get tokens for Microsoft Graph or Foundry data plane calls, so Challenge 1 starts with az login --use-device-code.
• An agent keeps the skill version it was given; after republishing a skill, remove and add it again.
• Harness agents have no browser Live View; Challenge 5 uses the Playwright browser activity log. Browser sessions are billed until closed, so the instructions tell the agent to close the browser.
• gpt-5.4 needs about 150K TPM per lab for Challenge 7; the lab automation README covers the quota request.

[Digvijay (Digvijay)]

Marco Weber (@qxsch) could you review this when you have time? Hack 13 (Frontier Operations) is complete: every challenge run in the portal with screenshots, 83 tests, and provisioning tested with the helper module from the adminpwsh image and with dev/run-local.ps1. The ERP API key now comes from New-MhhStablePassword. Thank you!