Hosted Agent publish to Teams/M365 appears successful but agent is unreachable until separate Deploy step; flow ambiguity + Docker-only deploy blocker

Summary

Using Foundry Toolkit Hosted Agents (public preview / RC Agent Framework), local validation succeeds and Publish to Teams / M365 Copilot completes with success confirmation, but the agent is not visible/reachable in Teams or M365 surfaces, and endpoint calls fail from Azure Bot Service web channel.

This appears to be a workflow gap where publish and runtime deployment are separate but not clearly communicated in the UI.

---

Environment

• OS: Windows
• VS Code Foundry Toolkit: latest available at time of report
• Agent Framework stack: RC/public preview path
• Deployment target: Microsoft Foundry Hosted Agent + Teams/M365 channel

---

What I did

1. Built and tested hosted agent locally in VS Code (works as expected).
2. Used Foundry Toolkit publish wizard to publish to:
   • Microsoft Teams
   • Microsoft 365 Copilot
3. Wizard completed successfully and showed confirmation.
4. Tried to use the agent from channel surfaces / endpoint.

---

Actual behavior

• Agent does not appear or is not reachable in Teams/M365 agent surfaces.
• Direct API/channel calls fail.
• Foundry side shows no active hosted deployment (or no live backend behind endpoint).
• Agent identity provisioning can remain pending.

---

Expected behavior

After “Publish to Teams/M365” completes (or at least via a clearly guided flow), I should either:

1. Have a fully live, reachable hosted agent endpoint, or
2. Be explicitly blocked with a clear message that runtime is not deployed yet and provide one-click next step.

---

Root cause analysis (observed)

There are two distinct steps that currently feel coupled in UX but are separate in runtime effect:

1. Publish to Teams/M365

   • Registers bot channel/app artifacts and shell
   • Registration-only; does not create live hosted runtime

2. Deploy Hosted Agent

   • Builds Docker image, pushes to ACR, creates hosted runtime deployment
   • This is required for endpoint to actually respond

If step #2 is not completed, endpoint exists but no running backend is available.

---

Current blocker

I cannot complete Deploy Hosted Agent in this environment because:

• Deployment requires local Docker image build
• Docker Desktop is unavailable
• No cloud-side build/deploy fallback is offered in this flow

---

Additional auth observation

Azure Bot Service sends Bot Framework JWTs (iss=https://api.botframework.com) to messaging endpoint.
Current Foundry AI Services gateway path appears to reject this token shape in this setup, resulting in failed requests when backend/runtime is not correctly provisioned or auth expectations differ.

(If this portion belongs to another service/component, please route accordingly.)

---

Impact

• Publish success gives impression that deployment is complete, but agent is non-functional.
• High confusion and time loss during workshop/onboarding scenarios.
• Blocks Teams/M365 channel validation without Docker availability.

---

Requested improvements

1. UX clarity: Explicitly separate “Publish Channel Registration” vs “Deploy Runtime” in wizard and success messages.
2. Post-publish guardrails: Show health check status and “No active deployment” warning before concluding success.
3. Actionable next step: One-click “Deploy Hosted Agent now”.
4. Dockerless option: Provide cloud-side build/deploy path when local Docker is unavailable.
5. Docs/tooltip update: Clarify that publish alone does not create a live runtime.
6. Token/auth guidance: Document supported token expectations for Teams/Bot channel integration with hosted agents.

Start with the Publish to Teams/M365 wizard and the Deploy Hosted Agent flow, then trace how hosted deployment status and Azure Bot Service channel authentication are surfaced. Done means publish clearly distinguishes registration from runtime deployment, warns when no deployment is active, provides the next action, and documents Docker and token requirements.