Microsoft Agent Framework 1.25: Python 3.11 and scoped sessions

Microsoft's Agent Framework now refuses to let one customer's agent session run under another customer's identity. Version 1.25.0 for Python, released today, ships seven breaking changes. Most of them close gaps where agent state could leak between users or workflows. If you serve more than one customer from the same agent code, this release is about you.

What actually happened

Microsoft published agent-framework python-1.25.0 on GitHub on November 7. The changes that matter most:

• Python 3.11 or later. Every package drops Python 3.10. Old environments won't install the release.
• Sessions bound to one authorization scope. Live workflow executors and their sessions now belong to one caller. Cross-scope reuse fails with WORKFLOW_SCOPE_CONFLICT before any model call. Microsoft's migration note: use a factory that builds a fresh workflow and session for each call, and set single_user=True only when every caller is the same person.
• No shared MCP sessions. Declarative workflows now open and close a new MCP protocol session for every handler call. The release notes call this a security fix that stops MCP state from crossing between workflows.
• Limits on MCP discovery. Tool and prompt discovery stops at 100 pages and 1,000 items per catalog. Framework-owned requests time out after 30 seconds by default.
• Tighter approvals. A bare approve-for-session on a URL prompt in the GitHub Copilot integration now means one-time approval, not a whole hostname. The MCP hosting package validates tool arguments before it calls the tool. Sandboxed code no longer sees raw host exception details by default.
• Renamed telemetry. Workflow spans now follow the OpenTelemetry GenAI conventions: workflow.run filters become gen_ai.operation.name == "invoke_workflow".

Why scoped agent sessions matter for your business

A small business with an agent usually means one agent serving many people: customers in a support chat, staff in a portal, clients in a dashboard. The bug this release blocks is easy to write. You build the workflow once at startup, cache it, and every request shares it. Then one user's context, tools or MCP state ends up in another user's run.

Microsoft's fix is the right default: one session per customer, built per request. The framework guard covers live executors and sessions. It does not cover state you load from shared storage or custom tools that call workflows, so check those yourself.

Before you upgrade:

1. Move to Python 3.11+ in every environment, CI included.
2. Find any cached workflow shared across users and switch it to a workflow_factory.
3. Fix your dashboards. Alerts that filter on workflow.run span names will go quiet without an error.
4. Check big MCP servers. Raise max_discovery_items if a trusted server lists more than 1,000 tools.

Sources: Microsoft Agent Framework python-1.25.0 release notes, Microsoft Agent Framework repository.