Does Azure AI Foundry Hosted Agent support outbound IPv6 connectivity?

Hello @June

Thank you for reaching out to Microsoft Q&A.

Based on the provided docs, there isn’t any explicit statement that confirms (or denies) outbound IPv6 connectivity support for Azure AI Foundry Hosted Agents / Agent Service.

Outbound connectivity is effectively IPv4-based today.

1. Can a Hosted Agent reach an IPv6‑only endpoint?

There is no official documentation stating support for IPv6 egress from Hosted Agents.

The documented architecture shows outbound traffic flowing via a platform-managed data proxy and Azure networking constructs (VNet, private endpoints, Azure Firewall, FQDN rules).

These Azure networking components primarily operate with IPv4 addressing unless explicitly stated otherwise, and no IPv6 capability is described.

If the endpoint is IPv6-only, it is very unlikely to be reachable from a Hosted Agent today.

2. For dual‑stack endpoints (IPv4 + IPv6)

Since IPv6 egress is not documented as supported, and outbound traffic is routed via managed components (data proxy, managed VNet, or BYO VNet paths),

The runtime will resolve and use IPv4 where available.

Dual‑stack endpoints will be accessed over IPv4, not IPv6.

3. Does region, managed network, or deployment type affect this?

The networking model (Managed VNet, BYO VNet, or default platform networking) governs:

• egress control (allow internet vs. allow approved outbound)
• routing via data proxy / private endpoints

However:

• None of these configurations mention IPv6 enablement or dual‑stack behavior
• No region-specific documentation indicates IPv6 support differences.

This behavior is not configurable per region or deployment type it’s a platform-level limitation (or at least undocumented capability).

4. Is there official documentation stating this limitation?

I did not find any official Microsoft Learn documentation explicitly stating:

• “IPv6 outbound is unsupported” OR
• “IPv6 outbound is supported”

This is a documentation gap, not a confirmed feature statement.

Observations from Architecture

• Hosted Agents run on Microsoft-managed compute (micro VMs / container apps) and
• All outbound calls are funneled through a single‑tenant data proxy or managed network boundary

Since:

• No IPv6 routing or address allocation is described
• No IPv6-related configuration knobs exist

This indicates the service is IPv4 egress–only in current implementation

Please refer this

https://learn.microsoft.com/azure/foundry/agents/concepts/agents-networking-deep-dive (Hosted agents traffic flow / outbound connectivity)

https://learn.microsoft.com/azure/ai-foundry/agents/faq (virtual network isolation context)

https://learn.microsoft.com/azure/ai-foundry/agents/how-to/virtual-networks (referenced indirectly via troubleshooting/FAQ pages above)

I Hope this helps. Do let me know if you have any further queries.

If this answers your query, please do click Accept Answer and Yes for was this answer helpful.

Thank you!

Hello June,

Greetings! Thanks for raising this question in Q&A forum.

This is a great and very specific question. Let me address each of your points directly based on what the current platform documentation and architecture tell us.

The short answer is: Azure AI Foundry Hosted Agents do not currently support outbound IPv6 connectivity. The managed agent runtime operates over IPv4 only for outbound traffic, and there is no documented IPv6 egress capability at this time. Here is a breakdown of each scenario you asked about:

Can a Hosted Agent reach an IPv6-only external endpoint?

No. Each Hosted Agent runs in a Micro VM attached to your delegated subnet with a dedicated network interface and uses its own IP for outbound communication. These IPs are standard IPv4 addresses allocated from your subnet. IPv6-only endpoints would therefore not be reachable from the agent runtime.

For dual-stack endpoints, can the runtime prefer IPv6 egress?

No. Public IP ranges are not supported for agent subnets, and the recommended delegated agent subnet size is /24. The subnet model used by Foundry Hosted Agents is IPv4-based, meaning even for dual-stack destinations, the outbound connection will always originate from an IPv4 address.

Is this behavior affected by region, network config, or deployment type?

The behavior is consistent regardless of region or deployment type. Hosted agents support deployment within network-isolated Foundry resources and can use a customer-provided Azure Virtual Network for outbound traffic. However, even when you bring your own VNet, the subnet delegation and IP allocation remain IPv4. Configuring a BYO VNet with dual-stack addressing does not change the outbound protocol used by the agent runtime.

Is there official documentation stating this IPv6 limitation?

There is no explicit statement in the current documentation that says "IPv6 is not supported." However, the limitation is implicit throughout the networking architecture. The entire subnet delegation model, IP allocation guidance, and outbound routing documentation reference only IPv4 constructs. You can confirm this by reviewing:

• Hosted Agents networking deep dive: https://learn.microsoft.com/en-us/azure/foundry/agents/concepts/agents-networking-deep-dive
• Configure virtual networks for Foundry Agent Service: https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/virtual-networks

What you can do right now

If your external endpoint supports dual-stack (both IPv4 and IPv6), the agent will connect over IPv4 and this will work fine.

If your endpoint is IPv6-only, you will need to place a dual-stack proxy or load balancer in front of it that accepts IPv4 connections and forwards them over IPv6 to the backend. This is the most practical workaround today.

To formally request IPv6 outbound support, raise a feature request through the Azure Feedback portal at https://feedback.azure.com/d365community/forum/a09a6912-ee25-ec11-b6e6-000d3a4f0789 or open an Azure Support ticket referencing your specific use case. This helps the product team prioritize the capability.

Since Hosted Agents are currently in preview and approaching general availability, upcoming focus areas include Managed virtual network support being extended for Hosted Agents, so it is worth monitoring the What's New blog for any IPv6 announcements: https://devblogs.microsoft.com/foundry/

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.