Azure AI Foundry

Airia connects to your Azure AI Foundry project and enumerates the agents defined there, populating the discovery inventory with each agent's metadata for governance, risk scoring, and optional evaluation runs.

Authentication model

A Microsoft Entra ID service principal with a client secret. Airia requests tokens for the https://ai.azure.com/.default scope and calls Azure AI Foundry's agents API at your project endpoint.

A Foundry or AI Services API key does not work for this connector. The connection must be a service principal.

Required scope and Azure RBAC role

Which role to choose:

• Discovery and inventory only: assign Azure AI User. This is the least-privilege read role; with it, Airia only reads agents from the project and performs no mutations. (There is no separate "AI Reader" role in Azure AI Foundry; Azure AI User is the correct read-only choice. The Microsoft 365 "AI Administrator/Reader" Entra roles are unrelated tenant governance roles and do not grant Foundry access.)
• Evaluations enabled on the Airia connection (Airia registers and runs native Foundry evaluations against agent responses): assign Azure AI Developer instead.

Role assignment at the Cognitive Services account scope also works and covers the project.

Customer-side setup steps

1. In the Azure portal, open Microsoft Entra ID → App registrations → New registration. Name it something like airia-foundry-discovery. Single tenant is fine.
2. In the new app, open Certificates & secrets → New client secret. Generate a secret and copy its value immediately (it is only shown once).
3. From the app's overview page, copy the Application (client) ID and the Directory (tenant) ID.
4. Open the target Azure AI Foundry project → Access control (IAM) → Add → Add role assignment.
5. Select Azure AI User (or Azure AI Developer if you need Evaluations) → Next.
6. Choose User, group, or service principal → Select members, search for your airia-foundry-discovery app, select it, then Review + assign.
7. From the Foundry project's overview, copy the project endpoint URL (for example https://yourfoundry.services.ai.azure.com/api/projects/yourproject).
8. In Airia, go to Discover → Connections → Azure AI Foundry and create a new connection with the four values above. If you plan to use evaluations, turn Enable evaluations on.

Note: a freshly created client secret can take up to a minute to propagate in Entra. If the first connection test fails with an authentication error, wait briefly and retry before suspecting the credentials.

Form fields the Airia UI asks for

Known limitations and optional features

• Evaluations: when the toggle is on, Airia uses Foundry's evaluators API to register and run native evaluations against your agents, which requires the Azure AI Developer role. If the toggle is on but the service principal only has Azure AI User, the evaluation calls fail with Azure permission errors; discovery itself continues to work.
• Read-only by default: with Azure AI User, Airia only reads agents from the project endpoint.
• Agents created through the classic assistants API can appear twice in discovery: once from the Persistent Agents surface (with the model populated) and once from the newer project-agents registry (without the model). If you see duplicate entries for the same agent, this is the cause; keeping agents on one surface avoids it.

Multiple environments

Multiple Azure AI Foundry connections per tenant are supported: typically one per Foundry project or subscription. Each connection can use its own service principal, or the same service principal granted the role on multiple projects.

Relationship to the AI Gateway provider

Azure AI Foundry is also an AI Gateway model provider, and a Foundry discovery connection can feed automatic gateway routing-rule generation. The gateway provider is configured separately from the discovery connection; provision both if you want discovery plus routing.