Limitations and Issues with A2A Agent Deployment on APIM Basic v2

[Messatsu92]

Hello everyone.

We conducted several tests on deploying A2A Agents in Azure API Management (APIM) Basic v2. Below is a summary of the actions performed, issues encountered, and additional context.

Actions performed:

• Deployed an APIM Basic v2 instance.
• Deployed an A2A-compatible agent on an Azure Function.
• Imported the agent into APIM as an API.
• Attempted to connect a Foundry agent (failed: method not found).

Issues encountered:

1. Supported SKUs: Only Basic v2, Standard v2, and Premium v2 are supported.
2. Protocol Compatibility: Only JSON-RPC-based agents are supported. gRPC and HTTP+JSON (REST) are not supported ( see documentation).
3. Automation Limitation: ARM template export is unavailable for A2A agent APIs, making automated deployment impossible.
4. Access Management: Consumption of the agent requires an Ocp-Apim-Subscription-Key, but it is not possible to manage access by product/subscription. This prevents granular access isolation per client application.
5. End-to-End Tracing: We frequently observe loss of context in tracing (App Insights) between APIM and the A2A agent.

Additional details:

• When exporting the ARM template for the entire APIM, the A2A agent API does not appear in the export, unlike other APIs.

• The hardcoded connector only supports JSON-RPC 2.0, which is a challenge since most modern microservices use REST (HTTP+JSON). Forcing JSON-RPC adds complexity to actions and testing.

-The A2A agent integration bypasses some APIM logic for subscription key management, preventing granular quota/access management via products and subscriptions.

If more logs or details are needed, please let us know.

Thanks for your help.

[leestott]

Hi @Messatsu92

Your observations are correct and consistent with current platform behavior and documented limitations. What you’re seeing is expected behavior with the current preview implementation of Foundry A2A + APIM. The main constraints today are JSON‑RPC‑only protocol support, lack of ARM/IaC coverage for A2A APIs, limited APIM subscription/product enforcement, and incomplete observability across the APIM → A2A boundary.

Here is a quick overview and useful resources and links to help.

APIM SKU support: Only APIM v2 SKUs (Basic v2, Standard v2, Premium v2) are supported. Classic tiers and Consumption are not supported for this scenario. https://learn.microsoft.com/azure/api-management/v2-service-tiers-overview

A2A protocol compatibility: Azure Foundry A2A integration is JSON‑RPC 2.0–only. REST (HTTP+JSON) and gRPC endpoints are not supported. Agents must expose A2A-compliant JSON‑RPC methods (tasks/send, tasks/get, streaming, etc.). This explains the “method not found” error when importing non‑A2A APIs into APIM. See https://learn.microsoft.com/azure/ai-foundry/agents/how-to/tools/agent-to-agent?view=foundry and https://a2a-protocol.org/latest

**Hardcoded JSON‑RPC connector limitation: **The Foundry A2A connector is explicitly built on JSON‑RPC 2.0 over HTTPS. This is a protocol requirement of A2A and not an APIM feature gap, but it does add friction for REST‑first microservice architectures. See https://a2a-protocol.org/latest/specification/

ARM / IaC automation gap: A2A agent APIs do not appear when exporting APIM ARM templates, even though other APIs do. This aligns with known APIM export limitations where certain API types or dynamically created APIs are not included in ARM exports, making full IaC automation impossible today. See: https://learn.microsoft.com/azure/templates/microsoft.apimanagement/service/apis

Subscription key and access management: Although APIM requires Ocp-Apim-Subscription-Key, A2A agent integration bypasses normal product/subscription association. This prevents per‑product quotas, per‑client isolation, and granular access control using standard APIM subscription constructs. See: https://learn.microsoft.com/azure/api-management/api-management-subscriptions

End‑to‑end tracing gaps: Loss of correlation between APIM and downstream A2A agents in Application Insights is expected unless explicit trace context propagation is implemented. A2A does not mandate W3C trace context propagation, so correlation is not guaranteed out of the box. See https://a2a-protocol.org/latest/specification/

The absence of A2A agent APIs in full APIM ARM exports, while other APIs are included, further reinforces that A2A agent APIs are treated differently by the platform and are not currently first‑class IaC resources.
See: https://learn.microsoft.com/azure/api-management/v2-service-tiers-overview