Azure AI Foundry

Airia connects to your Azure AI Foundry project and enumerates the agents defined there, populating the discovery inventory with each agent's metadata for governance, risk scoring, and optional evaluation runs.

Authentication model

A Microsoft Entra ID service principal with a client secret. Airia requests tokens for the https://ai.azure.com/.default scope and calls Azure AI Foundry's agents API at your project endpoint.

A Foundry or AI Services API key does not work for this connector. The connection must be a service principal.

Required scope and Azure RBAC role

Which role to choose:

• Discovery and inventory: assign Foundry User. Microsoft renamed this role from Azure AI User, and the Azure portal may show either name. Discovery uses it to read agent definitions from the project. The Microsoft 365 AI Administrator and AI Reader roles in Entra are tenant governance roles and grant no Foundry access.
• Evaluations enabled on the Airia connection (Airia registers and runs native Foundry evaluations against agent responses): assign Azure AI Developer instead.

Role assignment at the Cognitive Services account scope also works and covers the project.

Customer-side setup steps

1. In the Azure portal, open Microsoft Entra ID → App registrations → New registration. Name it something like airia-foundry-discovery. Single tenant is fine.
2. In the new app, open Certificates & secrets → New client secret. Generate a secret and copy its value immediately (it is only shown once).
3. From the app's overview page, copy the Application (client) ID and the Directory (tenant) ID.
4. Open the target Azure AI Foundry project → Access control (IAM) → Add → Add role assignment.
5. Select Foundry User, shown as Azure AI User in some portal views (or Azure AI Developer if you need Evaluations) → Next.
6. Choose User, group, or service principal → Select members, search for your airia-foundry-discovery app, select it, then Review + assign.
7. From the Foundry project's overview, copy the project endpoint URL (for example https://yourfoundry.services.ai.azure.com/api/projects/yourproject).
8. In Airia, go to Discover → Connect, click the Azure AI Foundry tile, and create a new connection with the four values above. If you plan to use evaluations, turn Enable evaluations on.

Note: a freshly created client secret can take up to a minute to propagate in Entra. If the first connection test fails with an authentication error, wait briefly and retry before suspecting the credentials.

Form fields the Airia UI asks for

Private endpoints via Cloud Connector

If your Foundry project has public network access disabled and is reachable only through a Private Endpoint, Airia's cloud cannot call the project endpoint directly, and the project's agents never reach the discovery inventory. Turning Route through ACC on sends those calls through an Airia Cloud Connector (ACC) running inside your network instead. The connector only makes outbound connections, so you do not need an inbound firewall rule, public network access on the project, or an allowlist entry for Airia's IP addresses.

Prerequisites

• A Cloud Connector inside the VNet that hosts the project's Private Endpoint, or on a network with line of sight to it. Keep the connector up to date.
• Private DNS on the connector host. The host must resolve *.services.ai.azure.com to the Private Endpoint's private IP address, normally through the Azure private DNS zone linked to the VNet.
• The same Azure RBAC role as a direct connection. Routing changes the network path, not the permissions: the app registration still needs Foundry User (or Azure AI Developer for evaluations) on the project, as described in Required scope and Azure RBAC role.
• Access to Cloud Connector settings in Airia. To turn routing on and choose a group, you need to be able to view Cloud Connector settings: the built-in Platform Admin, Admin, Read-Only Admin, and Security Admin roles can, as can a custom role with the Cloud Connector Read permission. Without that access you cannot set up routing on a connection.

Turn routing on

1. In Airia, open Discover → Connect, click the Azure AI Foundry tile, and create or edit the connection.
2. Turn Route through ACC on.
3. In Connector Group, either leave All groups selected or pick a group:
   • All groups routes through any connected Cloud Connector in your tenant. Use it when every connector you run can reach the project.
   • A specific group pins routing to the connectors in that group. Use it when only some of your connectors sit in the VNet that can reach the Private Endpoint.
4. Run Test connection, then save.

With routing on, the connection test adds a connectivity check for the Cloud Connector. It fails if no connector is online in the tenant, or in the selected group when you picked one. A failed check blocks saving, and the remaining checks are skipped.

If a connector is online but cannot reach the project, the connectivity check passes and the agent checks report warnings instead. You can still choose Save anyway, but syncs will fail until the connector can reach the project endpoint.

What is routed and what is not

Two consequences:

• Conditional Access can still block the connection. Because the token request originates from Airia's cloud and not from your network, a Conditional Access policy for workload identities that restricts the app registration to your own IP ranges rejects it. Routing through a connector does not change this.
• Routed calls add volume to the Cloud Connector Activity page. Every call a connector takes is recorded under Settings → Cloud Connector → Activity, and enabling evaluations increases that volume.

Troubleshooting routed connections

Routed connections usually fail in one of two ways, and the fix differs for each. The messages below appear in the connection test results and on a failed sync.

A sync that cannot list the project's agents through the connector fails without removing agents that were already discovered. If only the listing of new Foundry agents fails, the sync completes and keeps the new Foundry agents it already had until a later sync lists them fully. Airia retries on the next scheduled sync, which runs every 30 minutes.

Known limitations and optional features

• Evaluations: when the toggle is on, Airia uses Foundry's evaluators API to register and run native evaluations against your agents, which requires the Azure AI Developer role. If the toggle is on but the service principal only has Foundry User, the evaluation calls fail with Azure permission errors; discovery itself continues to work.

• Discovery reads agent definitions: with Foundry User, discovery reads the project's agents from the project endpoint.

• Hosted agents are listed with their name and kind, but Foundry holds no definition for them: their code lives in your repository. To see which repository a hosted agent comes from, scan that repository with the Airia Code Scanner; the agent's provenance then shows whether this connection lists it.

• Projects with public network access disabled cannot be reached by this connector. The connection test and every refresh fail with "Public access is disabled. Please configure private endpoint."

What you get

Each agent in the project appears in the discovery inventory with the model it uses. To see the model deployments in an Azure subscription and region, including deployments no agent uses yet, connect that subscription and region to an AI Gateway. The gateway's Model Selection list shows the deployments it finds there.

Multiple environments

Create one connection for each Foundry project endpoint. Each connection can use its own service principal, or you can grant the same service principal the role on every project.

Relationship to the AI Gateway provider

Azure AI Foundry is also an AI Gateway model provider. The AI Gateway generates routing rules from its own Azure AI Foundry Connection (subscription and region), which you set in the gateway's Models section. Set up both connections if you want discovery and routing. The same service principal works for both.