Azure AI Foundry Agent: Unable to Reassign a Guardrail from the Foundry UI

Hello @Riyazur Razak

Microsoft Foundry actually has two separate paths for creating/updating a Hosted agent's definition:

1. The standard Agents REST API (POST /agents/{name} and POST /agents/{name}/versions) — this is JSON-only. Its request body content type is application/json, and guardrail assignment goes through a rai_config.rai_policy_name property on the agent's definition. This path is used for prompt agents, workflow agents, and image/container-based hosted agents.
2. The source-code deployment path — used specifically for agents deployed from a .zip of code (which is what gives your agent its code_configuration). Because this call has to carry both the code archive and the agent metadata, it's sent as a multipart request rather than plain JSON.

Since your agent was originally deployed from source code, its persisted definition includes code_configuration — and that field only exists on the multipart, code-deployment path, not on the plain-JSON update-agent path. When the Foundry portal's Setup → Guardrail → Save action tries to persist your guardrail selection, it looks like it's calling the generic JSON update endpoint — which has no way to carry code_configuration forward — so the service correctly rejects it rather than silently dropping your code configuration. That's exactly what the error is telling you: it's not that your payload is malformed, it's that the portal picked the wrong endpoint for this agent type.

This also lines up with where things stand generally: guardrail assignment on newer Foundry constructs like Toolboxes is explicitly called out as not yet available through the portal/VS Code UI — the guidance there is to use the REST API or SDK instead. Source-code Hosted agents are still in preview with their own beta API surface, so it's very plausible the portal's Guardrail tab simply hasn't been wired up to route through the code-specific endpoint yet for this agent type.

Workaround: reassign the guardrail via API instead of the portal You can set the guardrail directly by creating a new agent version through the source-code deployment path — re-supplying your existing code zip (unchanged) alongside the updated guardrail reference in the definition:

content = CreateAgentVersionFromCodeContent(
    metadata=CreateAgentVersionFromCodeMetadata(
        definition=HostedAgentDefinition(
            cpu="1",
            memory="2Gi",
            code_configuration=CodeConfiguration(
                runtime="python_3_13",
                entry_point=["python", "main.py"],
                dependency_resolution="remote_build",
            ),
            rai_config=RaiConfig(rai_policy_name="<your-guardrail-name>"),
            protocol_versions=[ProtocolVersionRecord(protocol="responses", version="1.0.0")],
        ),
    ),
    code=(ZIP_PATH.name, code_zip_bytes, "application/zip"),
)

project.beta.agents.create_version_from_code(
    agent_name=AGENT_NAME, content=content, code_zip_sha256=code_zip_sha256,
)

Same code, same runtime settings the only change is rai_config.rai_policy_name. This creates a new version with the guardrail correctly attached, entirely bypassing the portal's Save action. If you're doing this over raw REST rather than the SDK, remember to include the preview feature header on the call: Foundry-Features: CodeAgents=V1Preview,HostedAgents=V1Preview

• Deploy a hosted agent from source code (preview) confirms the multipart contract for code_configuration: https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/deploy-hosted-agent-code
• Microsoft Foundry REST Reference – Agents (confirms rai_config.rai_policy_name and the JSON-only schema for the standard update path): https://learn.microsoft.com/en-us/rest/api/aifoundry/project/agents
• Guardrails and controls overview: https://learn.microsoft.com/en-us/azure/foundry/guardrails/guardrails-overview
• How to configure guardrails and controls: https://learn.microsoft.com/en-us/azure/foundry/guardrails/how-to-create-guardrails

Thanks,
Manish.

Hello Riyazur,

Welcome to MS Q&A

This looks like a portal issue rather than a Content Safety/guardrail limitation. The error indicates the portal is sending the update as application/json, while hosted agents with a code_configuration require multipart/form-data:

As a workaround, try updating the agent using the REST API or SDK. If that succeeds while the portal fails, it strongly suggests a bug in the Azure AI Foundry portal. Consider opening a support ticket with the Request ID and a network trace.

References:

• Add a content safety guardrail to a hosted agent
• Guardrails and controls overview

Pls check and let me know if any questions

Thanks

Deepanshu