Products · Foundry
What's new
Foundry ships continuously - every merged change lands here, newest first, described by what it does for you rather than how it was built. New here? Start with the product tour.
-
Send one message in seconds
Firing a single live message at a queue, topic or subscription is now its own page: pick a target, write the body, add typed application properties, send - no batch counts or randomisation rules to wade through. The powerful batch, randomised and dead-letter workbench keeps all its depth one click away, renamed Manufacture. The everyday "does this even work - let me send one" is now a two-field task; the heavy lifting is exactly where it was.
-
Private by default, production-hardened
Every Foundry environment runs its data stores behind private endpoints with the public internet refused outright, and production adds delete-protection locks, key-vault purge protection and long-retention audit logs - all provisioned in one reproducible deployment. The security posture is the default a new environment is born with, not a checklist someone has to remember to apply.
-
Start from a real JSON shape
The built-in example gallery now includes ready-made JSON messages - an order with a line-item array, a telemetry batch, an event envelope - alongside the XML ones, so a realistic starting point is one click whichever format you work in. And the editor only ever shows the controls that belong to the body you're editing, keeping the surface clean and predictable.
-
A namespace that's gone now says so
When a Service Bus namespace or entity has been deleted or renamed in Azure, Foundry tells you in one plain sentence instead of a wall of connection-retry noise - and it quietly stops a saved destination from reconnecting to something that no longer exists. The failure that used to look like a bug now reads like the fact it is.
-
Sized for the load we measured
Foundry's API tier is now provisioned to the capacity a real load test proved it needs - production runs on warm, horizontally-scaled compute that clears a hundred concurrent users inside the latency targets, while development stays deliberately lean. The sizing is a deployment parameter, so every environment gets exactly the headroom it should and not a cent more.
-
Commercial billing, Stripe-ready
Foundry now carries a complete subscription engine: a signed Stripe webhook endpoint feeds an authoritative, exactly-once inbox, and a validated state machine tracks each account through active, past-due, suspended and cancelled. A missed payment keeps a good customer running through a bounded grace window rather than cutting them off on a transient card decline.
-
An honest subscription ledger
The heart of the commercial layer is a subscription record that refuses illegal transitions, ignores out-of-order provider events, and audits every money-affecting change - so a reordered webhook can never leave an account on the wrong plan, and "what happened to this subscription, and when?" always has an answer.
-
Cross-tenant access, proven end to end
Connecting a Service Bus namespace that lives in a customer's own Entra tenant now runs on a secretless, federated workload-identity bridge - and it is verified against real Azure, not just in theory: a live acceptance run proves the whole path, confirms a send-only credential is refused management operations, and shows a revoked grant stops the next run cold.
-
Every namespace onboarding, tracked
Foundry keeps a durable record of which organisation onboarded which namespace, for which tenant, and where it stands - pending, active, degraded or revoked. A withdrawn onboarding removes the access in the same atomic write, so authorisation can never outlive the decision to revoke it.
-
Secretless cross-tenant RBAC
The provider identity now reaches a customer's namespace through a multi-tenant workload application and the customer's own role assignment - no shared secret exists on either side, and nothing to expire, rotate or leak. It replaces an approach Microsoft's own platform cannot support, so cross-tenant onboarding rests on a foundation that actually holds.
-
Generate typed models from your messages
Point Foundry at a JSON or XML message and it writes you a starter data model in C#, Java or Rust - correct serialisation attributes, sensible optionality, arrays inferred from repeated elements. The message you're manufacturing and the code that consumes it stop drifting apart.
-
The document takes the whole screen
A one-key maximise gives the message editor the full viewport for wrestling a large payload, and Escape puts everything back exactly as it was.
-
Click a value, get its path
Click any value in a message and Foundry hands you the exact path to it - ready to drop into a randomisation rule. No more hand-counting nesting levels to target the one field you want to vary.
-
A body model that tells the truth about the wire
Message bodies now carry their format, content type and value explicitly, application properties carry real types, and the editor shows the exact encoded byte budget as you build - so a template that compiles is a template that will actually send, and a size surprise happens at design time, never mid-run.
-
Generate a starter message from your schema
Hand Foundry an XSD and it produces a valid starter document to manufacture from; hand it a sample document and it infers a schema. A tree outline and an XPath workbench let you find and target any element for randomisation, so building a realistic message from a real contract takes minutes.
-
Your schemas, teaching the editor
Attach an XSD and the editor validates against it as you type, offers schema-aware completion, and quick-fixes the common mistakes - the same intelligence a hand-written integration gets, applied to the test messages that exercise it. Schemas are compiled securely and never fetch anything off the network.
-
A real code editor for your message templates
Message templates gained a proper editor: syntax highlighting, a themed search panel, and a per-format experience for JSON and XML - vendored and pinned, so the editing surface is fast, offline-safe and identical every time.
-
First-class XML message templates
XML is now a first-class body format alongside JSON, with a dedicated compiler: randomise leaves by a restricted XPath, keep mixed content and CDATA byte-exact, and reject anything that can't be safely round-tripped - because manufacturing realistic SOAP, ISO 20022 or industry-XML traffic shouldn't mean giving up validation.
-
A namespace claim that waits for the connection
Claiming a namespace for your organisation now happens only after the connection is actually made and probed - a typo'd or unreachable namespace leaves nothing behind, and the record always describes something that really connected.
-
A message-size promise the wire will keep
Template validation now measures the true encoded byte size, including per-property and envelope budgets, and refuses duplicate, blank or reserved property names up front. Nothing silently retypes your values - what you author is what Service Bus receives.
-
Replays that can't hit the wrong run
An idempotency key is now bound to the exact request it accepted, so a retried submission returns the run you meant - and a key reused with a different payload is refused rather than quietly substituting the wrong work.
-
Whole-namespace seeding respects your quota
Seeding an entire namespace now reserves its exact message count up front and either runs in full or starts nothing - it can no longer overshoot a daily cap mid-run.
-
A usage ledger that stays bounded
Per-account daily usage is now a bounded, transactionally-consistent ledger - accurate under any volume of runs, and incapable of growing until it breaks the very metering it provides.
-
Sealed release evidence
Every release now assembles a tamper-evident evidence bundle - build, test, scan and provenance - so an audit of "what exactly shipped, and how was it verified?" is a file, not an archaeology project.
-
Preview safety, enforced at startup
A customer-facing environment now refuses to start unless its safety rails are actually configured - the namespace allowlist, per-tenant entitlements and finite caps must all be present. The safety net is the startup gate, not a hope that someone remembered.
-
One tenant, one namespace - enforced
Which organisation may use which namespace is now a first-class entitlement checked on every connect and every run, so reachability alone can never grant access to a namespace an account was not granted.
-
Cleanup that can only delete what was approved
A destructive topology cleanup now binds to the exact set of entities that were reviewed and approved: it re-discovers, re-hashes and refuses if anything drifted, then deletes precisely that set and nothing else.
-
Single-use, server-owned cleanup plans
The plan behind a destructive operation now lives on the server, is single-use, and carries an expiry the client cannot forge - so an approval can't be replayed, extended or tampered with.
-
Destructive operations that fail closed
Every path that can create or delete entities now refuses to run without its audit ledger and cooling-off in place - the safe default is to stop, not to proceed and hope. Manufacturing a mess is easy; destroying one now demands a paper trail by construction.
-
Complete tenant offboarding
Removing an organisation is now one operation that stops its work, destroys its credentials, and sweeps its data from every store - while deliberately keeping the immutable audit of what was done in its infrastructure. Leaving is as clean as joining.
-
Metering you can bill on
Usage is now reserved at acceptance and settled exactly once at completion - refunds included, exactly-once across crashes and retries, and honest about the messages whose delivery genuinely cannot be known. It's the difference between an abuse guard and a number you can put on an invoice.
-
The last shared key, gone
The final shared-key credential left the platform - the key ring that protects sign-in now lives in identity-guarded blob storage, wrapped by a vault key. There is no connection string or account key anywhere in Foundry's own deployment to leak.
-
A private data plane
Foundry's data stores answer only inside a private network - the database and vault refuse the public internet outright, reachable through private endpoints alone. Rehearsed in development first, then made the default everywhere.
-
Two-tenant isolation, proven on real Azure
A deployed acceptance matrix runs two organisations in two separate directories against the live service and proves, twenty-one checks deep, that neither can see, follow or cancel the other's runs - isolation demonstrated, not asserted.
-
A measured load baseline
Foundry's own load harness now produces a repeatable pass/fail scorecard against a deployed target, so "can it take the traffic?" is answered with numbers - and the accept path was tuned against it until the latency held under a hundred concurrent users.
-
Runs that survive anything
A submitted run is a durable job: it outlives the browser tab, the network drop and a full service restart, and a reconciler adopts and finishes whatever was in flight when a process died. You start work and walk away - the platform is responsible for finishing it.
-
A real API and a generated client
Everything the console does, an API does too - a versioned, contract-first surface for accepting and following durable runs, with a generated client kept honest against the contract by an automated parity check. Foundry fits into a pipeline, not just a browser.
Manufacture it against your own namespace.
Everything above is real, shipped work. Foundry seeds realistic Service Bus traffic and drives measured load against your own topics and queues - connect with Entra RBAC and start in minutes.