[Paulo Lacerda (placerda)]

Summary

Scoped documentation follow-up for Azure/agent-landing-zone#695. Changes only:

• docs/agent-landing-zone/build-your-own-app.md
• docs/agent-landing-zone/troubleshooting.md

Clarifies that a selected custom azure.ai.agent component requires hosted foundation preparation even with a classic bundled orchestrator, without deploying the bundled hosted orchestrator or changing topology. Separates the existing foundational Foundry project managed identity's declarative, registry-scoped AcrPull from actual routed per-instance identity verification and exact capability-profile reconciliation before protocol greeting smoke. Documents explicit provision-before-deploy recovery for existing failed environments; refreshing outputs alone is insufficient. Preserves immutable image and protocol-smoke semantics and rejects broad manual grants, registry admin credentials, OIDC workarounds, and delegated-user/OBO service-identity substitution.

Pending platform dependency — do not merge

The new platform selection fix on Azure/agent-landing-zone branch feature/695-hosted-identity-bootstrap is still being implemented/tested. Exact new source commit and PR are pending from the coordinating parent; update this body when supplied. Platform branch base: develop at cf957243164450b33c3e61699d385541b7360231. Historical merged Azure/agent-landing-zone#774 is not the dependency for this correction.

Documentation describes the required corrected behavior, not a verified released/live recovery. This PR remains draft pending source review and dependency follow-up.

Validation

• Repository documentation check: mkdocs build --strict (site output redirected to session artifacts; no publishing) — passed.
• git diff --check — passed.
• Live documentation default/base confirmed as main, commit f8f7e02b4c38498cd55f5deda83a0a22aaec8f42; custom-app source blob d412bc81d5d8b829f5769440afde46247b7a754c.

Acceptance explicitly not claimed

No Azure resources were changed. Existing failed-environment Azure recovery, fresh first-up, and T035 delegated-user/OBO, citations, and document allow/deny acceptance remain pending. A greeting smoke is not document retrieval or authorization acceptance, and runtime profiles are not a per-agent preactivation image-pull phase.

[Paulo Lacerda (placerda)]

Post-merge platform dependency: Azure/agent-landing-zone#779 (Azure/agent-landing-zone#779) is a draft PR targeting develop. The product implementation commit is 0238734d39a7870d4ac9b0b19fe2f8f5e8e634cb; the reported source-plus-acceptance-evidence head is a95784e.

The correction selects hosted foundation preparation for a custom azure.ai.agent independently of classic bundled-orchestrator topology, without deploying the bundled hosted runtime. Foundation project managed identity registry pull preparation remains separate from actual per-instance identity verification and exact capability-profile reconciliation before protocol smoke.

Exact-source Azure preview, foundation reprovisioning, and runtime validation are still in progress. No successful Azure recovery, fresh first-up, delegated-user/OBO, citations, or document allow/deny authorization acceptance is claimed. This comment records the dependency only; no further documentation PR is needed.