Summary
The Self-host Agent Framework applications doc has full Python coverage but only a "coming soon" stub for C#. The C# pivot should be filled in to match the Python content, and in particular should cover customizing session storage (and the related secure-session-continuation / principal-isolation guidance), which is where that content belongs — it's a general hosting concern, not specific to any one protocol integration.
Source file: agent-framework/hosting/self-hosting/index.md (in MicrosoftDocs/semantic-kernel-pr).
Current state
- C# pivot: "Self-hosting protocol helpers for .NET are coming soon." (stub)
- Go pivot: "not currently available for Go."
- Python pivot: fully documented, including:
- What the hosting helpers provide (
AgentState, SessionStore, WorkflowState)
- Customize session storage — subclass
SessionStore (get/set/delete), store AgentSession in Redis/DB/blob, AgentState(session_store=...), and the SessionStore vs. HistoryProvider distinction
- Secure session continuation — treat protocol-provided IDs as untrusted; authenticate, authorize, and partition durable state per tenant/user
What the C# content should cover
The .NET hosting equivalents already ship and should be documented here:
- Registering a session store:
IHostedAgentBuilder.WithInMemorySessionStore(bool withIsolation = true) and WithSessionStore(...) (namespace Microsoft.Agents.AI.Hosting), plus implementing a custom AgentSessionStore for Redis/DB/blob-backed persistence.
- Principal isolation for multi-user hosts:
SessionIsolationKeyProvider and UseClaimsBasedSessionIsolation(...) (namespace Microsoft.Agents.AI.Hosting.AspNetCore). This is the C# analog of the Python "Secure session continuation" guidance and is a general hosting concern — the same isolation types are used by the AG-UI, A2A, and Foundry hosting integrations.
- Important default behavior to call out (verified):
WithInMemorySessionStore() defaults to withIsolation: true, which requires a registered SessionIsolationKeyProvider. With no provider registered, requests fail closed with an HTTP 500 ("Session isolation key is required..."). Guidance:
withIsolation: false for single-user / local development.UseClaimsBasedSessionIsolation(...) (or a custom SessionIsolationKeyProvider) for multi-user hosts.- Persistence is opt-in; by default a self-hosted agent endpoint is stateless.
Why now / context
While updating the AG-UI C# docs (PR #430), we drafted a "Persisting Sessions" section in the AG-UI getting-started. On review, server-side session storage + principal isolation turned out to be a general MAF hosting concern (shared by AG-UI, A2A, and Foundry hosting), not AG-UI-specific, so we removed it from the AG-UI getting-started. The Python docs already document it in one shared place — the self-hosting doc — and the C# content should live there too.
Summary
The Self-host Agent Framework applications doc has full Python coverage but only a "coming soon" stub for C#. The C# pivot should be filled in to match the Python content, and in particular should cover customizing session storage (and the related secure-session-continuation / principal-isolation guidance), which is where that content belongs — it's a general hosting concern, not specific to any one protocol integration.
Current state
AgentState,SessionStore,WorkflowState)SessionStore(get/set/delete), storeAgentSessionin Redis/DB/blob,AgentState(session_store=...), and theSessionStorevs.HistoryProviderdistinctionWhat the C# content should cover
The .NET hosting equivalents already ship and should be documented here:
IHostedAgentBuilder.WithInMemorySessionStore(bool withIsolation = true)andWithSessionStore(...)(namespaceMicrosoft.Agents.AI.Hosting), plus implementing a customAgentSessionStorefor Redis/DB/blob-backed persistence.SessionIsolationKeyProviderandUseClaimsBasedSessionIsolation(...)(namespaceMicrosoft.Agents.AI.Hosting.AspNetCore). This is the C# analog of the Python "Secure session continuation" guidance and is a general hosting concern — the same isolation types are used by the AG-UI, A2A, and Foundry hosting integrations.WithInMemorySessionStore()defaults towithIsolation: true, which requires a registeredSessionIsolationKeyProvider. With no provider registered, requests fail closed with an HTTP 500 ("Session isolation key is required..."). Guidance:withIsolation: falsefor single-user / local development.UseClaimsBasedSessionIsolation(...)(or a customSessionIsolationKeyProvider) for multi-user hosts.Why now / context
While updating the AG-UI C# docs (PR #430), we drafted a "Persisting Sessions" section in the AG-UI getting-started. On review, server-side session storage + principal isolation turned out to be a general MAF hosting concern (shared by AG-UI, A2A, and Foundry hosting), not AG-UI-specific, so we removed it from the AG-UI getting-started. The Python docs already document it in one shared place — the self-hosting doc — and the C# content should live there too.