Each customer request requires three independent agent runs. Dequeuing ten requests and launching a concurrent three-agent workflow for each request creates at most 30 simultaneous agent runs, exactly meeting the concurrency ceiling. Because the three agents execute in parallel and one run takes about five seconds at the 95th percentile, ten requests can complete in roughly five seconds, which corresponds to 120 requests per minute. Microsoft Agent Framework ' s ConcurrentBuilder performs a fan-out to independent participants and a fan-in that can produce one consolidated response, solving the downstream partial-message problem. Sequential workflows would require roughly three agent durations per request and miss the throughput target. A 90-participant workflow violates the concurrency limit. Therefore C is the only option that satisfies the numerical and orchestration constraints together. The implementation should also preserve clear inputs and outputs around this step so that later agents receive only the information they require. This improves debuggability and keeps token, permission, and state growth under control as the workflow becomes more complex.

Official Microsoft reference: Microsoft Agent Framework - Concurrent orchestration

============================================================

A shared single-tenant application registration combined with subscription-wide role assignments creates an excessively broad trust and authorization boundary. It also does not, by itself, guarantee elimination of stored credentials because an app registration can still authenticate with a client secret or certificate unless federation is configured. More importantly, compromise of any agent using the shared identity could expose resources well beyond that agent ' s assigned Storage container. Microsoft guidance favors distinct workload/agent identities and the narrowest practical Azure RBAC scope, ideally at the resource or data-resource level required by each agent. Because the proposed design uses both a shared identity and subscription-level access, it fails the blast-radius requirement and least-privilege principle. Therefore B, No, is correct. Least privilege remains the governing principle: grant only the identity, data, tool, or deployment access required for the specific operation. The selected answer preserves that boundary while still allowing the workflow to satisfy its functional requirement.

Official Microsoft reference: Microsoft Foundry agent identity

============================================================

The malicious text is contained in an uploaded email rather than being typed directly as the user ' s prompt. Microsoft classifies malicious instructions embedded in external or retrieved content as an indirect prompt-injection attack. Prompt Shields for documents is designed to detect those attacks in document content before the content can steer the model away from its system instructions. Prompt Shields for user prompts addresses direct attacks originating in the user ' s prompt and therefore targets the wrong attack surface here. Groundedness evaluates whether a response is supported by context; it does not prevent an injected instruction from changing agent behavior. Task Adherence can assess whether an agent follows its task constraints, but it is not the primary control for document-borne prompt injection. Because the source of the attack is the uploaded email, the document-oriented Prompt Shields control is the technically aligned guardrail. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.

Official Microsoft reference: Microsoft Foundry guardrails - intervention points and indirect attacks

============================================================