Chapter 1 of 6
Session scope#
What we will do#
Objective. Create and pin a versioned prompt agent in the existing Microsoft Foundry project. Its unique Entra Agent Identity identifies the agent and secures the endpoint. The Foundry project managed identity authorizes one approved read-only OpenAPI operation.
The deployed version uses the RAI policy in agent.json, sends server-side traces, and exposes no write tool. We will call get_policy once with synthetic data and confirm that no other tool runs.
Why it matters#
Problem. An agent that drifts after release, or shares its identity with other agents, leaves the release owner unable to say what configuration is live or which identity called a given API.
Solution. Pinning one version gives the release owner a known configuration to operate. Separate identities show which identity protects the endpoint and which one calls the downstream API.
Boundaries#
This session changes one prompt agent in the approved nonproduction Foundry project. Foundry holds the live identity, versions, endpoint routing, and RAI policy. The repository holds the deployment definition.
The direct OpenAPI path is application-only. The downstream API sees the Foundry project managed identity, not a signed-in user or the agent identity. The missing write operation and downstream read authorization constrain the tool path. Instructions add refusal behavior but do not enforce that boundary.
The Microsoft 365 and Teams distribution owner manages this boundary. APIM AI gateway guide adds APIM ingress. MCP tool security guide replaces the direct tool path with MCP controls. Foundry evaluation gate guide adds repeatable evaluations. Use a separately approved delegated-access implementation when the API must authorize the signed-in user.
Session preparation
Who should join
- AI product owners and AI engineers
- Microsoft Foundry platform and identity engineers
- Security, safety, and observability owners
What you need
- The approved nonproduction
AIServicesFoundry resource and project are reachable from the approved execution host. The platform owner confirms the recorded subscription, resource group, resource, project, and private path. (Sessions 01, 02, and 03.) - The agent deployment operator has the time-bound Foundry User role, role ID
53ca6127-db72-4b80-b1b0-d745d6d5456d, on that exact Foundry project. - The Session 03 consolidated approval record links the selected deployment name to its exact model coordinates. The live ARM child deployment has provisioning state
Succeeded. The AI product owner has checked the current Agent Service region-and-model support table for prompt agents and OpenAPI tools in the Foundry project region. - The downstream API resource scope has an approved read-only HTTPS operation, exact Microsoft Entra audience, authorization owner, and exact built-in or custom read role assignment for the Foundry project managed identity. A custom role names the action required by
get_policy. - The exact RAI policy name is recorded for the selected model deployment. The safety owner has approved its input and output filtering settings.
- Application Insights is connected to the Foundry project. The approved operations group has Log Analytics Reader on that resource and, when its Log Analytics tables are protected, Privileged Monitoring Data Reader.