The influential Center for Renewing America says that “neo-Marxist progressives and anti-Western Muslims” can’t sincerely swear to protect the Constitution—and shouldn’t be allowed to assume office.

It turns out even bots can’t escape bureaucracy.

AI is changing the work that once helped early-career employees build judgment. Explore five practical ways talent leaders can redesign readiness and development.

The question every talent leader is being asked

AI can now support many of the tasks that once helped early-career employees build judgment through repetition and feedback. For learning and talent leaders, that raises a practical question: How should development change when producing a first draft is easier, but evaluating it is more important?

In one Microsoft business, we addressed this challenge by redesigning the first-year experience for early-career employees around five principles: role-specific mentoring, protected learning time, deliberate practice of human skills, purposeful in-person connection, and evidence-based readiness.

The results were encouraging:

• 91% reported accelerated readiness by week 12, meaning they understood how the business works and what their role owns. 

• 99% felt confident executing their core customer activities independently within six months, cutting the ramp to independent contribution from 12 months to six. 

Here are the five elements participants and program leaders identified as most important, along with ways to apply each one in your organization. 

Why the development model needed rethinking 

Until recently, much of the learning early in a career happened through the work itself: the background research nobody thanked you for or the first-draft deck that came back covered in red. The output was not the point. Judgment was built one unglamorous task at a time. 

AI now supports or accelerates many of those tasks. Early-career employees may have fewer opportunities to build judgment by producing the work themselves, even as they are increasingly expected to evaluate AI-generated drafts. 

Recent research reinforces the challenge. McKinsey notes that many of the routine tasks through which early-career professionals traditionally developed judgment are increasingly being automated, creating new challenges for developing the next generation of talent. PwC found that AI-exposed junior roles are seven times more likely to demand traditionally senior skills such as leadership and strategic thinking. 

The implication is direct: If the work no longer teaches judgment on its own, development must be designed to teach it intentionally. 

Five actions that can guide your talent strategy

1. Assign role-specific mentors

The principle: Task-specific guidance and access to real work matter more than assigning a buddy or general career mentor. Early-career employees need someone who can explain why a customer question was framed a certain way in a specific meeting. 

How we applied it: Each early-career hire was matched from day one with a mentor on their team, in the same role, with at least two years of experience. Managers selected mentors for their interest in developing others, ability to dedicate time, willingness to open real work for shadowing, and capacity to provide role-specific guidance. 

In the post-program survey, role mentor impact scored 97%, making it the highest-rated element of the first-year experience. Mentors also reported learning from the experience. Explaining tacit judgment made it more visible, while mentees’ fluency with new AI tools prompted new ways of working. 

What leaders can do: Select mentors for role proximity and willingness to share real work, not seniority or availability. Protect mentoring time and recognize the experience as development for mentors, too.

 

2. Protect learning time explicitly

The principle: Learning time is easily displaced by immediate business priorities. Unless it is defined and defended, it disappears. 

How we applied it: Early-career employees received 20 hours of protected learning time per week for the first eight weeks, supported by a clear cadence for coaching and job shadowing. The precise number was specific to our program. The transferable principle is that the protection must be explicit, not assumed. 

What leaders can do: Define the time, manager expectations, and learning activities in writing, then put them on the calendar from week one. Assign someone to protect that time when business priorities compete.

 

3. Create space to rehearse human skills

The principle: If early-career roles require judgment, empathy, and collaboration from the start, employees need a low-stakes place to practice. Human skills develop through doing, feedback, and reflection, not through content alone. 

How we applied it: We created a readiness lab with small peer groups where employees practiced skills in a deliberate progression from self, to team, to customer. Each stage paired a concept with live practice and structured peer feedback. 

What leaders can do: Identify the two or three human skills an early-career role needs first. Create a recurring, low-stakes setting where employees can practice those skills and receive structured feedback before applying them with customers.

 

4. Use in-person time intentionally

The principle: Some outcomes are difficult to achieve through virtual interaction alone. The value of in-person time often appears in relationships, trust, and shared identity. 

How we applied it: After several weeks of virtual learning, we brought the cohort together in person. The experience strengthened cross-market peer relationships, built trust with senior leaders, and created a shared cohort identity that supported collaboration across teams. 

What leaders can do: Treat in-person time as a design choice, not a perk. Schedule it after participants have built a foundation virtually, involve senior leaders, and focus the agenda on relationships and shared problem-solving rather than content that could be delivered online.

 

5. Make readiness an evidence-based decision

The principle: Readiness should be demonstrated through evidence, not inferred from time served. The question is not how long someone has been in a role, but what they can do. 

How we applied it: Beginning in month two, early-career employees and their role mentors shared accountability for real business outcomes. Employees built a readiness portfolio with work examples demonstrating customer-facing competence, independent execution, cross-team orchestration, judgment and risk management, and ownership. Managers and mentors could coach and make readiness decisions using evidence rather than a date on the calendar. 

What leaders can do: Define the capabilities that signal independence, ask employees to collect real work examples against them, and use that evidence in coaching and readiness decisions. 

What we learned: readiness has two halves 

Early-career readiness requires both knowledge and applied judgment. Information, role expectations, foundational skills, and credentials can be organized and scaled. Judgment develops through real work, observation, practice, feedback, and reflection. 

The five actions in this article help create those conditions. AI may change the tasks through which early-career employees once developed judgment, but it does not remove the need for judgment. Leaders now have a responsibility to create those experiences intentionally and strengthen the leadership bench for the future. 

Start with one early-career role in your organization. Identify a task AI now supports, name the judgment that task once helped build, and decide where employees will practice that judgment instead. 

 

Ready to start learning? Explore Microsoft AI Skills Navigator for AI-powered learning experiences that helps you build the skills you need whether you're investing in your own development or building capability across your organization. 

 

Sources 

McKinsey & Company, “Building expertise in the age of AI: Who trains the next generation?” 

PwC, “2026 Global AI Jobs Barometer,” 15 June 2026. 

Study and Learn from Microsoft Education is an AI Tutor/Coach that preserves the productive struggle essential for learning with the learner. It does not simply answer questions or do work for students. In response to strong customer demand, we are getting ready to release a new option to lock Copilot Chat down just to Study and Learn!

Coming soon -- An IT controlled locked down learning-only mode that always lands students in Study and Learn. Students can't dismiss the agent, switch back to general Copilot Chat, or use other agents or capabilities. They can still add their own files as references. We're aiming to cover Copilot Chat on web and app, the agent store, direct links, previous chats and more.

Join a webinar session to learn about Study and Learn, and how to activate the locked down mode.

Nov 10, 8 am PST: Webinar option 1

Nov 10, 4pm PST: Webinar option 2

Nov 12, 8 am PST: Webinar option 3

Nov 12, 4pm PST: Webinar option 4

Employees, and now AI agents, need secure access to resources wherever they live: the internet, Microsoft 365 and SaaS, cloud and datacenter workloads, on-premises apps, and AI services. Zero Trust means evaluating every one of those connections against full context, including identity, risk, device, app and data, location, and network, and enforcing the decision continuously, not only at sign-in. Organizations need to do that without stitching together separate tools and policies. 

Today, we’re taking the next step in our Secure Access Service Edge (SASE) journey: customers can now purchase Microsoft Entra Private Access and Microsoft Entra Internet Access together as a single Microsoft Entra Global Secure Access offering. 

This is not a new product; it’s a simpler way to purchase these capabilities together. Microsoft Entra Private Access and Microsoft Entra Internet Access will also continue to be available individually.

How Microsoft Entra Global Secure Access fits 

• Microsoft Entra Global Secure Access offering, available starting November 2, 2026, is for organizations that want identity-aware network access for private and internet traffic as a unified offering. 

• Microsoft Entra Suite includes Microsoft Entra Global Secure Access alongside Microsoft Entra ID Governance, Microsoft Entra ID Protection, and Microsoft Entra Verified ID for organizations that want a broader identity and access offering. 

• Microsoft 365 E7 includes Microsoft Entra Suite and its Global Secure Access capabilities, bringing identity-aware network access alongside Microsoft 365 E5, Microsoft 365 Copilot, and Microsoft Agent 365. Customers can apply consistent Zero Trust access controls across users and AI agents, while bringing identity, security, productivity, and AI capabilities into a more unified experience.

Building your access fabric: identity awareness for every connection 

Most network security tools treat identity as an outside input. They sync users, groups and applications from your identity provider and keep their own policies in a separate console. The result is two systems, two sets of policies, and gaps between them that attackers exploit. 

Entra Global Secure Access takes a different approach. It brings identity and network together into one access fabric, so every connection carries identity awareness: 

• Microsoft Entra is your identity provider, so there are no policy seams. Entra Global Secure Access uses the same users, groups, applications, and Conditional Access policies you already manage in Microsoft Entra. You don't need to sync anything, and you don't need to keep a second set of policies aligned with the first. 

• Conditional Access goes beyond single sign-on to any destination. The same identity, device, and risk conditions that protect sign-in, apply to private apps, internet and SaaS destinations, and AI services. That includes apps and protocols that never sign in through Microsoft Entra. 

• Protection lasts for the entire session, not only at sign-in. With Universal Continuous Access Evaluation, when a device falls out of compliance or a user's risk becomes high, access is reevaluated in near real time. Customers don't have to wait for a token to expire, and the destination app doesn't need to support Continuous Access Evaluation. 

• Agents get the same controls as people. AI agents acting on behalf of users now account for a growing share of traffic. The access fabric applies the same identity-aware controls to agent traffic as to human traffic. 

Continuing to deliver on what customers asked for 

We’re investing heavily in Entra Global Secure Access and moving quickly on what customers tell us they need: broader traffic coverage, easier deployment, stronger data protection, and better operational insight. Here’s what we’ve shipped in just the last two months, with more on the way.

Public preview capabilities 

• Cloud Firewall for client with Microsoft Entra Internet Access extends security beyond web traffic, enabling organizations to control broader TCP and UDP connections with granular Allow and Block rules based on destinations, ports, and protocols, with identity-aware policy assignment through Conditional Access. 

• "Continue" Default Action gives administrators greater flexibility to layer independently managed web content filtering policies across security profiles. When traffic doesn’t match an enabled rule, evaluation continues to the next applicable security profile in priority order. This allows organizations to maintain application-specific exceptions alongside a shared enterprise baseline without creating separate policies for every combination of applications. 

• Home Network Support for Microsoft Entra Private Access enables remote users to access local resources such as printers, routers, and wireless displays without disconnecting Private Access, while giving administrators control over when local subnet traffic can bypass Private Access. 

• Microsoft Entra Health and Alerts for Microsoft Entra Global Secure Access help administrators proactively identify connectivity and deployment issues and accelerate troubleshooting. By bringing health and operational insights into the Microsoft Entra experience, security and network teams can more easily monitor Microsoft Entra Global Secure Access and reduce time spent diagnosing connectivity issues. 

• Multiple Traffic Forwarding Profiles for Microsoft Entra Private Access provide more granular control over traffic acquisition, allowing organizations to tailor Private Access profiles across different users, devices, and applications and support more flexible, phased deployments. 
• Transport Layer Security (TLS) inspection, now easier to deploy with Microsoft-managed certificates, helps organizations gain deeper visibility into encrypted web traffic and apply granular security controls. Microsoft-managed certificates simplify deployment by eliminating the need to provision and manage your own certificate authority (CA) or public key infrastructure (PKI), making it easier to get started with TLS inspection. 

Generally available capabilities 

• Custom headers in Microsoft Entra Internet Access give organizations more flexibility to customize HTTP traffic based on their security requirements. Administrators can apply custom headers for specific applications and services, extending granular controls over internet and SaaS access and supporting application-specific security and access scenarios. 

• Microsoft Entra and Microsoft Purview bring data security to the network, across human actions and on-behalf-of (OBO) agentic traffic, helping organizations stop sensitive data from reaching risky destinations. Context-aware Microsoft Purview classification and policies are enforced by Microsoft Entra at the network layer, helping organizations discover sensitive files and text in real time and block them from being shared to risky destinations, including unsanctioned AI tools.   

• Private Network Connector Smart Load Balancing with Session Affinity keeps requests from the same user and device routed to the same connector throughout a session, helping maintain session continuity and reduce unnecessary reauthentication. 

• New device and risk signals for Universal Continuous Access Evaluation (CAE) help organizations make access decisions more adaptive. When a device is disabled, deleted, or falls out of compliance, or when Microsoft Entra ID Protection detects high user risk, Universal CAE can trigger reauthentication so that Microsoft Entra Conditional Access policies can reevaluate access based on the current security state of the device and user. 

One unified approach to securing access 

Entra Global Secure Access is how we bring the access fabric to life: one identity foundation, one policy engine in Conditional Access, and Zero Trust enforcement on every connection, for employees and AI agents alike. Bringing Private Access and Internet Access together in a single offering makes it simpler to get started, and the capabilities above show how fast we’re moving. This is just the next step. We’re excited to keep building it with you, and we’ll have more to share in the coming weeks. 

Learn more about Microsoft Entra Global Secure Access and try it for free. 

 

Yair Tor | Partner Product Management, Identity and Network Access

Yair Tor | LinkedIn

 

Additional resources

• https://www.microsoft.com/en-us/security/identity-access/microsoft-entra-global-secure-access 
• Secure AI, web, and private apps with Zero Trust | Microsoft Community Hub

 Learn more about Microsoft Entra

Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds.

• ⁠Microsoft Entra News and Insights | Microsoft Security Blog
• Microsoft Entra blog | Tech Community
• Microsoft Entra documentation | Microsoft Learn
• Microsoft Entra discussions | Microsoft Community 

The Model Context Protocol (MCP) helps agentic systems act on and retrieve information from external tools. As applications grow, agents may need to work across many MCP servers and large tool catalogs, making context management harder.

Loading every tool definition upfront wastes tokens on irrelevant schemas and leaves less room for instructions, history, and task data. At enterprise scale, teams need a deliberate way for agents to discover relevant tools while controlling access, credentials, and tool execution.

In this tutorial, we’ll show how to use Postman Fabric Gateway to connect multiple MCP servers through a single endpoint and enable progressive tool search so agents can retrieve tool schemas only when needed.

Prefer to watch? This tutorial is also available as a video walkthrough:

What You’ll Learn

By the end of this tutorial, you’ll know how to:

• Connect multiple MCP servers to Postman Fabric Gateway and manage their upstream credentials securely.
• Create individual and combined routes so clients can access multiple tool catalogs through a single MCP endpoint.
• Enable progressive tool discovery so agents can search for relevant tools, retrieve schemas on demand, and execute tools without loading the full catalog upfront.

Pre-requisites

You’ll need the following before you start:

• A Fabric Gateway account
• A Postman account with access to the workspace where you’ll test the integration.
• A basic understanding of MCP

In this tutorial, we are going to work with two MCP servers. A support MCP server and a banking MCP server. These MCP servers are used by a support agent to manage customer transaction disputes. We won’t go into the technicalities of the agent or the tools that the MCP server exposes.

Step 1: Connect the MCP servers and configure their credentials

In Fabric Gateway, click on MCP servers in the left navigation menu, and select Create connection.

Name the connection banking-mcp and enter the below URL as the banking server’s full MCP endpoint.

In the Upstream auth requirement, select Bearer auth type and toggle the radio box.

Next, you need to provide the required authorization credential to Fabric Gateway.

Copy and paste banking-mcp-demo-key as the API key into the token input box.

This will create a service level credential for the connection. This credential will be stored in a secure vault.

This setup screen allows you to create a connection, and expose that connection on a newly created route in one go. Fill in a preferred name for the new route, and provide a path that you want it exposed on. Toggle the “Gateway Key” option and select “No gateway key”.

Save the connection by clicking on Create Connection.

Repeat this process for the support-mcp connection.

Connection Name	Upstream URL	Credential/API Key
banking-mcp	https://intergalacticbanking-mcp-production.up.railway.app/mcp	Banking MCP Key: banking-mcp-demo-key
support-mcp	https://intergalacticsupport-mcp-production.up.railway.app/mcp	Support MCP Key: support-mcp-demo-key

Step 2: Create a route to combine the tool catalogs

Creating a connection tells Fabric where a service lives. A route gives clients an endpoint through which to use it. You’ve created a route for each service so you can test them independently.

Route path	Connected service
/banking/mcp	Banking MCP
/support/mcp	Support MCP

Navigate to MCP Servers on the left sidebar. Switch to the routes tab and click on the Copy DP URL icon to the right of any of the routes.

In Postman, create an MCP request, and paste the DP URL you just copied. Test any of the MCP tools in the tool list.

Repeat this process for both MCP servers.

Next, we want to be able to combine these two MCP server tools on a single route. Still on the routes tab, click on “Create Route” to create a third route.

Name this route all-mcp, give it a path such as /banking/all, and select both services.

Copy the DP URL, and send an MCP request to it in Postman.

The client now lists tools from both servers through one endpoint. Fabric prefixes and namespaces the tool names so you can identify each tool’s originating service; in this setup, the combined list contains 103 tools.

We’ve consolidated the connection, but the client still receives the full catalog. The next step changes that.

Step 3: Enable progressive tool discovery

Open Plugin, scroll down, and click on Use on the Tool Search option. Give this plugin a name and scope it to the all-mcp route you just created.

Click on the Edit as JSON button and paste the below JSON. Switch back to form mode and confirm that the openai service is indeed selected, then save.

NOTE: You can use any embedding model or service of your choosing here

This plugin introduces an embedding service that makes it possible to search a tool catalog semantically. This means a request such as “list transactions” can return relevant tools without requiring their exact names. This is explained in more detail shortly.

Disconnect and reconnect the combined MCP request in Postman to refresh its tool listing.

Instead of 103 tool definitions, you should now see three tools that perform these jobs:

Capability	Purpose
Search tools	Find relevant tools across the catalog using a natural-language query. This uses the added embedded service in tool search.
Get tool	Retrieve the selected tool’s definition, including its input schema.
Execute tool	Invoke the selected tool with the required arguments.

This means that the Agent can now progressively discover tools rather than load the entire tool schema upfront. The upstream tools have not been deleted or merged into three operations. Instead, the gateway has changed how the client discovers and invokes them.

Test discovery with a simple query: “list transactions.” Run the search tool and review the returned matches. You should see candidates relevant to transaction lookup, rather than the complete banking and support tool catalog.

Copy the name of one of the returned tools e.g ban__banking_list_transactions, and paste that name into the get_tool tool to retrieve the schema definitions of that tool. Then use the execute-tool capability with that tool’s identifier and arguments.

This is the sequence an agent will follow: find a relevant capability, learn how to call it, then act. In the Postman MCP Client, you just walked through each stage manually.

Step 4: Monitor Traces and telemetry

Fabric Gateway automatically collects telemetry across all services and routes. You can view the traces on the Gateway’s dashboard. Click on traces in the left sidebar. This should show you a list of all the requests that have been routed by the Gateway, and you can click on any of them to view the end-to-end trace.

Traces let you examine route matching, plugin execution, and upstream activity where applicable.

This is useful when a call fails: you can investigate what happened at the gateway instead of relying only on the error shown by the client.

What changes for the agent

In this tutorial, we showed how to expose multiple MCP servers through a single MCP endpoint, reduce an agent’s tool surface area, and provide a focused set of tools that are easier for an agent to discover and use.

The result is one MCP endpoint backed by two services, with three tools initially listed instead of 103. That gives a smaller starting point for an application that would otherwise pass the complete catalog to its model. It is not a measured percentage reduction in tokens or cost: search results, retrieved schemas, and tool responses still consume context, and discovery adds requests. Measure the full workflow when comparing performance.

The practical benefit is control over when tool definitions enter the conversation. The agent can request the capability it needs, while the gateway manages credentials, enforces access policies, and inspects traffic.

Resources

• Sign in to Fabric Gateway and configure MCP services, routes, credentials, plugins, and traces.
• Read the Fabric Gateway documentation.
• Learn how to create and test MCP requests in Postman.

 

This was originally posted on fabricgateway.ai/blog

The post Manage MCP context with Postman Fabric Gateway appeared first on Postman Blog.