Microsoft says the quiet part in a full sentence
On the Foundry Agent Service pricing page: There is no additional charge for creating or running Foundry-native agents using prompts and workflows.
1 You pay for model tokens and for the tools an agent invokes — knowledge connections, search, code interpreter sessions, hosted compute. Anyone comparing against Azure by adding up subscriptions is comparing against something that does not exist.
The sentence worth reading twice
Azure OpenAI On Your Data has a setting for limiting answers to your documents. Microsoft's documentation describes what it does with admirable precision: When this setting is enabled, the model attempts to only rely on your documents for responses.
2 Read that as an engineer rather than as a buyer. It is a description of an intention — the model attempts — and it is competing with the user's phrasing, the retrieved material, the model's priors and the previous eleven turns. It usually wins. Usually is a strange word to find at the centre of a compliance story, and Microsoft deserves credit for wording it honestly rather than as a guarantee.
What a mechanism looks like instead
Our agent can only open a document by naming a path, and the tool that opens paths will only open one that appeared in a listing it was given. Ask for anything else and the call fails — not the model declining, the call failing, in code with no context window and no opinion. That is why declined is a value of a field here rather than a phrase to detect in prose, and why the behaviour does not change with the model, the temperature or how the question was asked.