Azure AI Foundry connector

Azure AI Foundry is Microsoft’s unified platform for building and deploying AI agents and applications. The Azure AI Foundry connector discovers AI agents created in Azure AI Foundry and governance-relevant objects including tools, knowledge bases, guardrails, connections, service accounts, and identity bindings. It supports Delete for agents; all other object classes are read-only.

Contact your Ping Identity Customer Success Outcome Manager (CSOM) or Account Executive to obtain this connector.

Retrieval of agentIdentityBinding, serviceAccount, agentConnection, and agentToolCredential is enabled through an offline inventory mechanism that requires an Agent Governance license. Contact your CSOM for details.

Azure AI Foundry requirements

Before you configure the connector, you must register an application with Microsoft Entra and configure the Azure AI Foundry project. You need a Microsoft Azure subscription to complete this procedure.

Register an app in Microsoft Entra

Sign on to the Azure portal as an administrative user.
Select App registrations under Azure services.
On the Register an application page, enter a name for the application and select the supported account types.
On the new registration page, make a note of the Application (client) ID and the Directory (tenant) ID.
Generate a client secret. Select Certificates & secrets > New client secret, enter a description, and click Add. Copy the client secret value.
Note the Azure subscription ID and the resource group where your Azure AI Foundry project resides.

Before you configure the connector, confirm you have the following:

Requirement Value

Requirement	Value
Tenant ID	Microsoft Entra tenant GUID
Subscription ID	Azure subscription ID
Resource Group	Azure Resource Group for the Foundry project
Project Location	Location of the Foundry project
Client ID	Service principal (app registration) client ID
Client Secret	Service principal client secret
Agent Service Endpoint	Azure AI Foundry project endpoint URL, for example `https://<resource>.services.ai.azure.com/api/projects/<project>`

Tenant ID

Microsoft Entra tenant GUID

Subscription ID

Azure subscription ID

Resource Group

Azure Resource Group for the Foundry project

Project Location

Location of the Foundry project

Client ID

Service principal (app registration) client ID

Client Secret

Service principal client secret

Agent Service Endpoint

Azure AI Foundry project endpoint URL, for example https://<resource>.services.ai.azure.com/api/projects/<project>

Install the Azure AI Foundry connector

To check for an Advanced Identity Cloud application for this connector, refer to:

To obtain the connector .jar file, contact your Ping Identity Customer Success Outcome Manager (CSOM) or Account Executive.

If you’re running the connector locally, place the .jar file in the /path/to/openidm/connectors directory.
If you’re using a remote connector server (RCS), place the .jar file in the /path/to/openicf/connectors directory on the RCS.

Configure the Azure AI Foundry connector

Create a connector configuration using the IDM admin UI:

From the navigation bar, click Configure > Connectors.
On the Connectors page, click New Connector.
On the New Connector page, type a Connector Name.
From the Connector Type list, select Azure AI Foundry Connector - 1.5.20.33.
Complete the Base Connector Details and any applicable Additional Options.

For a list of all configuration properties, refer to Azure AI Foundry Connector Configuration.
Click Save.

When your connector is configured correctly, the connector displays as Active in the admin UI.

Refer to this procedure to create a connector configuration over REST.

Connection details

The Azure AI Foundry connector uses the following configuration properties:

Property Type Required Default Description

Property	Type	Required	Default	Description
`tenantId`	String	Yes	None	Microsoft Entra tenant GUID.
`subscriptionId`	String	Yes	None	Azure subscription ID.
`resourceGroupName`	String	No	None	Azure Resource Group for the Foundry project.
`workspaceName`	String	No	None	Azure AI Foundry workspace name used for agent discovery and operations.
`defaultLocation`	String	Yes	`eastus`	Azure region where AI Foundry resources are deployed.
`useManagedIdentity`	Boolean	Yes	`false`	When `true`, uses managed identity for authentication instead of `clientId` and `clientSecret`.
`clientId`	String	Conditional	None	Service principal (app registration) client ID. Required when `useManagedIdentity=false`.
`clientSecret`	GuardedString	Conditional	None	Service principal client secret. Required when `useManagedIdentity=false`.
`agentServiceEndpoint`	String	Yes	None	Azure AI Foundry project endpoint URL, for example `https://<resource>.services.ai.azure.com/api/projects/<project>`.
`agentApiFlavor`	String	No	`classic`	Agent discovery flavor. Use `classic` for the `/agents` API, `new` for the `/assistants` API, or `both`.
`apiVersion`	String	No	`v1`	API version string used when calling the Azure AI Foundry Agents API, for example `2025-01-01`.
`identityBindingScanEnabled`	Boolean	No	`false`	Enables offline inventory scan for identity bindings, service accounts, connections, and tool credentials. When `false`, those object classes return no data.
`toolsInventoryUrl`	String	No	None	HTTPS URL to the tools inventory JSON (Azure Blob SAS URL or Azure Function HTTP trigger URL). Required when `identityBindingScanEnabled=true`.
`toolsInventoryFilePath`	String	No	None	Local filesystem path to the tools inventory JSON. Alternative to `toolsInventoryUrl`. Intended for development or test use.
`agentNameFilterRegex`	String	No	None	Optional regular expression to restrict which agents are returned during discovery based on display name.
`entraAgentIdLookupEnabled`	Boolean	No	`false`	When `true`, queries the Microsoft Graph beta API to resolve Entra agent identity service principals and enrich agents with their Entra object IDs. Requires `Application.Read.All` Graph API permission. Correlation is by agent display name (best-effort).

tenantId

String

Yes

None

Microsoft Entra tenant GUID.

subscriptionId

String

Yes

None

Azure subscription ID.

resourceGroupName

String

None

Azure Resource Group for the Foundry project.

workspaceName

String

None

Azure AI Foundry workspace name used for agent discovery and operations.

defaultLocation

String

Yes

eastus

Azure region where AI Foundry resources are deployed.

useManagedIdentity

Boolean

Yes

false

When true, uses managed identity for authentication instead of clientId and clientSecret.

clientId

String

Conditional

None

Service principal (app registration) client ID. Required when useManagedIdentity=false.

clientSecret

GuardedString

Conditional

None

Service principal client secret. Required when useManagedIdentity=false.

agentServiceEndpoint

String

Yes

None

Azure AI Foundry project endpoint URL, for example https://<resource>.services.ai.azure.com/api/projects/<project>.

agentApiFlavor

String

classic

Agent discovery flavor. Use classic for the /agents API, new for the /assistants API, or both.

apiVersion

String

v1

API version string used when calling the Azure AI Foundry Agents API, for example 2025-01-01.

identityBindingScanEnabled

Boolean

false

Enables offline inventory scan for identity bindings, service accounts, connections, and tool credentials. When false, those object classes return no data.

toolsInventoryUrl

String

None

HTTPS URL to the tools inventory JSON (Azure Blob SAS URL or Azure Function HTTP trigger URL). Required when identityBindingScanEnabled=true.

toolsInventoryFilePath

String

None

Local filesystem path to the tools inventory JSON. Alternative to toolsInventoryUrl. Intended for development or test use.

agentNameFilterRegex

String

None

Optional regular expression to restrict which agents are returned during discovery based on display name.

entraAgentIdLookupEnabled

Boolean

false

When true, queries the Microsoft Graph beta API to resolve Entra agent identity service principals and enrich agents with their Entra object IDs. Requires Application.Read.All Graph API permission. Correlation is by agent display name (best-effort).

Example Azure AI Foundry configuration

{
  "connectorRef": {
    "bundleName": "org.forgerock.openicf.connectors.azureaifoundry-connector",
    "bundleVersion": "[1.5.0.0,1.6.0.0)",
    "connectorName": "org.forgerock.openicf.connectors.azureaifoundry.AzureAIFoundryConnector"
  },
  "configurationProperties": {
    "tenantId": "00000000-0000-0000-0000-000000000000",
    "subscriptionId": "11111111-1111-1111-1111-111111111111",
    "resourceGroupName": "my-foundry-rg",
    "defaultLocation": "eastus",
    "clientId": "22222222-2222-2222-2222-222222222222",
    "clientSecret": {
      "$crypto": {
        "type": "x-simple-encryption",
        "value": {
          "cipher": "...",
          "data": "...",
          "iv": "...",
          "key": "openidm-sym-default"
        }
      }
    },
    "useManagedIdentity": false,
    "agentServiceEndpoint": "https://myresource.services.ai.azure.com/api/projects/myproject",
    "agentApiFlavor": "classic",
    "identityBindingScanEnabled": false
  }
}

Test the Azure AI Foundry connector

Test that the configuration is correct by running the following command:

curl \
--header "X-OpenIDM-Username: openidm-admin" \
--header "X-OpenIDM-Password: openidm-admin" \
--header "Accept-API-Version: resource=1.0" \
--request POST \
"http://localhost:8080/openidm/system/azureaifoundry?_action=test"
{
  "name": "azureaifoundry",
  "enabled": true,
  "config": "config/provisioner.openicf/azureaifoundry",
  "connectorRef": {
    "bundleVersion": "[1.5.0.0,1.6.0.0)",
    "bundleName": "org.forgerock.openicf.connectors.azureaifoundry-connector",
    "connectorName": "org.forgerock.openicf.connectors.azureaifoundry.AzureAIFoundryConnector"
  },
  "displayName": "Azure AI Foundry Connector",
  "objectTypes": [
    "__ACCOUNT__",
    "__ALL__"
  ],
  "ok": true
}

If the command returns "ok": true, your connector has been configured correctly and can authenticate to the Azure AI Foundry API.

Azure AI Foundry remote connector

If you want to run this connector outside of PingOne Advanced Identity Cloud or IDM, you can configure the Azure AI Foundry connector as a remote connector. Java Connectors installed remotely on a Java Connector Server function identically to those bundled locally within PingOne Advanced Identity Cloud or installed locally on IDM.

Refer to Remote connectors for configuring the Azure AI Foundry remote connector.

Use the Azure AI Foundry connector

The Azure AI Foundry connector discovers the following resource types:

ICF Native Type Azure AI Foundry Resource Type Naming Attribute Notes

ICF Native Type	Azure AI Foundry Resource Type	Naming Attribute	Notes
`__ACCOUNT__`	Azure AI Foundry agent	`__NAME__`	Represents one AI Foundry agent. UID is the agent ID. Supports `Delete`; the connector calls the Azure AI Foundry agents API to delete the agent. All other object classes are read-only.
`agentTool`	Agent tool	`__NAME__`	Represents tools attached to an AI Foundry agent.
`agentKnowledgeBase`	Agent knowledge base	`__NAME__`	Represents knowledge bases attached to an AI Foundry agent.
`agentIdentityBinding`	Derived IAM-to-agent identity binding	`__NAME__`	Not a native Azure AI Foundry entity. Read from the offline inventory artifact.
`agentGuardrail`	Agent guardrail (RAI policy)	`__NAME__`	Represents the Responsible AI policy associated with an agent.
`serviceAccount`	Azure managed identity or service principal associated with an agent	`__NAME__`	Read from the offline inventory artifact.
`agentToolCredential`	Derived tool credential surface	`__NAME__`	Read from the offline inventory artifact.
`agentConnection`	Azure AI Foundry project connection	`__NAME__`	Represents connections (such as to Azure OpenAI or storage) configured in the Foundry project.

__ACCOUNT__

Azure AI Foundry agent

__NAME__

Represents one AI Foundry agent. UID is the agent ID. Supports Delete; the connector calls the Azure AI Foundry agents API to delete the agent. All other object classes are read-only.

agentTool

Agent tool

__NAME__

Represents tools attached to an AI Foundry agent.

agentKnowledgeBase

Agent knowledge base

__NAME__

Represents knowledge bases attached to an AI Foundry agent.

agentIdentityBinding

Derived IAM-to-agent identity binding

__NAME__

Not a native Azure AI Foundry entity. Read from the offline inventory artifact.

agentGuardrail

Agent guardrail (RAI policy)

__NAME__

Represents the Responsible AI policy associated with an agent.

serviceAccount

Azure managed identity or service principal associated with an agent

__NAME__

Read from the offline inventory artifact.

agentToolCredential

Derived tool credential surface

__NAME__

Read from the offline inventory artifact.

agentConnection

Azure AI Foundry project connection

__NAME__

Represents connections (such as to Azure OpenAI or storage) configured in the Foundry project.

`ACCOUNT` attributes

Attribute Type Multivalued Description

Attribute	Type	Multivalued	Description
`platform`	String	No	Connector platform identifier.
`agentId`	String	No	Azure AI Foundry agent ID.
`agentVersion`	String	No	Agent version.
`description`	String	No	Agent description.
`foundationModel`	String	No	Foundation model configured for the agent.
`instructions`	String	No	System prompt / instructions for the agent.
`createdAt`	String	No	Agent creation timestamp.
`raiPolicyName`	String	No	Responsible AI policy name applied to the agent.
`temperature`	Number	No	Model temperature parameter.
`topP`	Number	No	Model top-P parameter.
`responseFormat`	String	No	Response format configuration.
`toolsRaw`	String	No	Raw tools configuration from the agent definition.
`toolResourcesRaw`	String	No	Raw tool resources configuration.
`guardrailId`	String	No	Forward pointer to the `agentGuardrail` object.
`entraAgentObjectId`	String	No	Microsoft Entra object ID associated with the agent.
`serviceAccount`	String	No	Service account or managed identity associated with the agent.
`region`	String	No	Azure region where the agent is deployed.
`toolIds`	String	Yes	Forward pointers to `agentTool` objects.
`knowledgeBaseIds`	String	Yes	Forward pointers to `agentKnowledgeBase` objects.
`identityBindingIds`	String	Yes	Forward pointers to `agentIdentityBinding` records.
`serviceAccountIds`	String	Yes	Forward pointers to `serviceAccount` records.
`toolCredentialIds`	String	Yes	Forward pointers to `agentToolCredential` records.
`connectionIds`	String	Yes	Forward pointers to `agentConnection` records.
`connectedAgents`	String	Yes	IDs of connected agents.

platform

String

Connector platform identifier.

agentId

String

Azure AI Foundry agent ID.

agentVersion

String

Agent version.

description

String

Agent description.

foundationModel

String

Foundation model configured for the agent.

instructions

String

System prompt / instructions for the agent.

createdAt

String

Agent creation timestamp.

raiPolicyName

String

Responsible AI policy name applied to the agent.

temperature

Number

Model temperature parameter.

topP

Number

Model top-P parameter.

responseFormat

String

Response format configuration.

toolsRaw

String

Raw tools configuration from the agent definition.

toolResourcesRaw

String

Raw tool resources configuration.

guardrailId

String

Forward pointer to the agentGuardrail object.

entraAgentObjectId

String

Microsoft Entra object ID associated with the agent.

serviceAccount

String

Service account or managed identity associated with the agent.

region

String

Azure region where the agent is deployed.

toolIds

String

Yes

Forward pointers to agentTool objects.

knowledgeBaseIds

String

Yes

Forward pointers to agentKnowledgeBase objects.

identityBindingIds

String

Yes

Forward pointers to agentIdentityBinding records.

serviceAccountIds

String

Yes

Forward pointers to serviceAccount records.

toolCredentialIds

String

Yes

Forward pointers to agentToolCredential records.

connectionIds

String

Yes

Forward pointers to agentConnection records.

connectedAgents

String

Yes

IDs of connected agents.

`agentTool` attributes

Attribute Type Multivalued Description

Attribute	Type	Multivalued	Description
`platform`	String	No	Connector platform identifier.
`description`	String	No	Tool description.
`toolType`	String	No	Tool type classification.
`executorArn`	String	No	Executor reference, when present.
`schemaUri`	String	No	Schema URI, when present.

platform

String

Connector platform identifier.

description

String

Tool description.

toolType

String

Tool type classification.

executorArn

String

Executor reference, when present.

schemaUri

String

Schema URI, when present.

`agentKnowledgeBase` attributes

Attribute Type Multivalued Description

Attribute	Type	Multivalued	Description
`platform`	String	No	Connector platform identifier.
`knowledgeBaseId`	String	No	Knowledge base ID.
`knowledgeBaseState`	String	No	Knowledge base state.
`sourceType`	String	No	Knowledge base source type.
`connectionRef`	String	No	Connection reference for the knowledge base source.

platform

String

Connector platform identifier.

knowledgeBaseId

String

Knowledge base ID.

knowledgeBaseState

String

Knowledge base state.

sourceType

String

Knowledge base source type.

connectionRef

String

Connection reference for the knowledge base source.

`agentGuardrail` attributes

Attribute Type Multivalued Description

Attribute	Type	Multivalued	Description
`platform`	String	No	Connector platform identifier.
`guardrailId`	String	No	Guardrail ID.
`raiPolicyName`	String	No	Responsible AI policy name.
`raiPolicyShortName`	String	No	Short name for the RAI policy.
`agentIdsUsingGuardrail`	String	Yes	Agent IDs that reference this guardrail.

platform

String

Connector platform identifier.

guardrailId

String

Guardrail ID.

raiPolicyName

String

Responsible AI policy name.

raiPolicyShortName

String

Short name for the RAI policy.

agentIdsUsingGuardrail

String

Yes

Agent IDs that reference this guardrail.

`agentIdentityBinding` attributes

Attribute Type Multivalued Description

Attribute	Type	Multivalued	Description
`platform`	String	No	Connector platform identifier.
`agentId`	String	No	Agent ID.
`agentVersion`	String	No	Agent version.
`kind`	String	No	Binding kind.
`principal`	String	No	Principal reference.
`principalId`	String	No	Principal object ID.
`principalType`	String	No	Principal type, such as `User`, `Group`, or `ServicePrincipal`.
`roleName`	String	No	Azure role name.
`roleDefinitionId`	String	No	Azure role definition ID.
`iamMember`	String	No	IAM member string.
`permissions`	String	Yes	Permissions associated with the binding.
`scope`	String	No	Azure RBAC scope.
`scopeResourceId`	String	No	Resource ID of the scope.
`scopeType`	String	No	Scope type.
`tenantId`	String	No	Azure tenant ID.
`conditionJson`	String	No	Azure RBAC condition, serialized as JSON.
`sourceTag`	String	No	Source tag from the inventory artifact.
`confidence`	String	No	Confidence value from the inventory artifact.
`expanded`	Boolean	No	Whether the principal was expanded by the inventory process.

platform

String

Connector platform identifier.

agentId

String

Agent ID.

agentVersion

String

Agent version.

kind

String

Binding kind.

principal

String

Principal reference.

principalId

String

Principal object ID.

principalType

String

Principal type, such as User, Group, or ServicePrincipal.

roleName

String

Azure role name.

roleDefinitionId

String

Azure role definition ID.

iamMember

String

IAM member string.

permissions

String

Yes

Permissions associated with the binding.

scope

String

Azure RBAC scope.

scopeResourceId

String

Resource ID of the scope.

scopeType

String

Scope type.

tenantId

String

Azure tenant ID.

conditionJson

String

Azure RBAC condition, serialized as JSON.

sourceTag

String

Source tag from the inventory artifact.

confidence

String

Confidence value from the inventory artifact.

expanded

Boolean

Whether the principal was expanded by the inventory process.

`serviceAccount` attributes

Attribute Type Multivalued Description

Attribute	Type	Multivalued	Description
`platform`	String	No	Connector platform identifier.
`identityType`	String	No	Identity type, such as `ManagedIdentity` or `ServicePrincipal`.
`identityScope`	String	No	Identity scope.
`principalId`	String	No	Service principal or managed identity object ID.
`tenantId`	String	No	Azure tenant ID.
`clientId`	String	No	Client ID of the managed identity or service principal.
`serviceAccount`	String	No	Service account reference.
`linkedAgentIds`	String	Yes	Agent IDs linked to this service account.

platform

String

Connector platform identifier.

identityType

String

Identity type, such as ManagedIdentity or ServicePrincipal.

identityScope

String

Identity scope.

principalId

String

Service principal or managed identity object ID.

tenantId

String

Azure tenant ID.

clientId

String

Client ID of the managed identity or service principal.

serviceAccount

String

Service account reference.

linkedAgentIds

String

Yes

Agent IDs linked to this service account.

`agentToolCredential` attributes

Attribute Type Multivalued Description

Attribute	Type	Multivalued	Description
`toolId`	String	No	Tool ID.
`toolType`	String	No	Tool type classification.
`authType`	String	No	Authentication type.
`credentialRef`	String	No	Credential reference. Doesn’t contain secret material.
`connectionId`	String	No	Connection ID used by the tool.
`connectionName`	String	No	Connection name used by the tool.
`target`	String	No	Target endpoint or resource.
`backingResourceId`	String	No	Azure resource ID backing the tool credential.
`agentIds`	String	Yes	Agent IDs that use this tool credential.

toolId

String

Tool ID.

toolType

String

Tool type classification.

authType

String

Authentication type.

credentialRef

String

Credential reference. Doesn’t contain secret material.

connectionId

String

Connection ID used by the tool.

connectionName

String

Connection name used by the tool.

target

String

Target endpoint or resource.

backingResourceId

String

Azure resource ID backing the tool credential.

agentIds

String

Yes

Agent IDs that use this tool credential.

`agentConnection` attributes

Attribute Type Multivalued Description

Attribute	Type	Multivalued	Description
`platform`	String	No	Connector platform identifier.
`connectionType`	String	No	Connection type, such as `AzureOpenAI` or `AzureBlob`.
`credentialsType`	String	No	Credentials type used by the connection.
`target`	String	No	Connection target endpoint or resource URI.
`backingResourceId`	String	No	Azure resource ID backing the connection.
`isDefault`	Boolean	No	Whether this is the default connection for the project.

platform

String

Connector platform identifier.

connectionType

String

Connection type, such as AzureOpenAI or AzureBlob.

credentialsType

String

Credentials type used by the connection.

target

String

Connection target endpoint or resource URI.

backingResourceId

String

Azure resource ID backing the connection.

isDefault

Boolean

Whether this is the default connection for the project.

OpenICF interfaces implemented by the Azure AI Foundry connector

The Azure AI Foundry connector implements the following OpenICF interfaces. You can find additional details in ICF interfaces:

Delete: Deletes an object, referenced by its uid.
Schema: Describes the object types, operations, and options that the connector supports.
Search: Searches the target resource for all objects that match the specified object class and filter.
Test: Tests the connector configuration.

Testing a configuration checks all elements of the environment that are referred to by the configuration are available. For example, the connector might make a physical connection to a host that is specified in the configuration to verify that it exists and that the credentials that are specified in the configuration are valid.

This operation might need to connect to a resource, and, as such, might take some time. Do not invoke this operation too often, such as before every provisioning operation. The test operation is not intended to check that the connector is alive (that is, that its physical connection to the resource has not timed out).

You can invoke the test operation before a connector configuration has been validated.

Azure AI Foundry connector configuration

The Azure AI Foundry connector has the following configurable properties:

Basic configuration properties

Property Type Default Encrypted⁽¹⁾ Required⁽²⁾

Property	Type	Default	Encrypted⁽¹⁾	Required⁽²⁾
`tenantId`	`String`	`null`		Yes
Microsoft Entra tenant ID (GUID) where Azure AI Foundry resources reside.
`subscriptionId`	`String`	`null`		Yes
Azure subscription ID that contains the Azure AI Foundry workspace.
`resourceGroupName`	`String`	`null`		No
Name of the Azure Resource Group containing the workspace.
`workspaceName`	`String`	`null`		No
Azure AI Foundry workspace name used for agent discovery and operations.
`defaultLocation`	`String`	`eastus`		Yes
Azure region where AI Foundry resources (agents, tools, KBs, guardrails) are deployed.
`useManagedIdentity`	`Boolean`	`false`		Yes
If true, the connector authenticates using a managed identity attached to the runtime environment. If false, a service principal (clientId + clientSecret) is used.
`clientId`	`String`	`null`		No
Client ID (Application ID) of a service principal when managed identity is not used.
`clientSecret`	`GuardedString`	`null`	Yes	No
Client secret for the service principal. Required only when useManagedIdentity=false.
`identityBindingScanEnabled`	`Boolean`	`false`		No
Enables scanning Azure RBAC roles to produce identity bindings. Currently optional and may require additional privileges.
`agentNameFilterRegex`	`String`	`null`		No
Optional regular expression used to restrict which agents are returned during discovery.
`agentServiceEndpoint`	`String`	`null`		Yes
Base endpoint for Azure AI Foundry Agents API, for example `https://<resource>.services.ai.azure.com/api/projects/<project>`.
`toolsInventoryUrl`	`String`	`null`		No
HTTP(S) URL pointing to the tools-inventory JSON document that includes tools, knowledge bases, guardrails, and agent relationships.
`toolsInventoryFilePath`	`String`	`null`		No
Local filesystem path to the tools-inventory JSON document. Used only if `toolsInventoryUrl` is not provided.
`agentApiFlavor`	`String`	`classic`		No
Agent discovery flavor. Use `classic` for the `/agents` API, `new` for the `/assistants` API, or `both`.
`apiVersion`	`String`	`v1`		No
API version string used when calling the Azure AI Foundry Agents API, for example `2025-01-01`.
`entraAgentIdLookupEnabled`	`Boolean`	`false`		No
When enabled, queries Microsoft Graph beta API to resolve Entra agent identity service principals and enrich agents with their Entra object IDs. Requires `Application.Read.All` Graph API permission. Correlation is by agent `displayName` (best-effort).

tenantId

String

null

Yes

Microsoft Entra tenant ID (GUID) where Azure AI Foundry resources reside.

subscriptionId

String

null

Yes

Azure subscription ID that contains the Azure AI Foundry workspace.

resourceGroupName

String

null

Name of the Azure Resource Group containing the workspace.

workspaceName

String

null

Azure AI Foundry workspace name used for agent discovery and operations.

defaultLocation

String

eastus

Yes

Azure region where AI Foundry resources (agents, tools, KBs, guardrails) are deployed.

useManagedIdentity

Boolean

false

Yes

If true, the connector authenticates using a managed identity attached to the runtime environment. If false, a service principal (clientId + clientSecret) is used.

clientId

String

null

Client ID (Application ID) of a service principal when managed identity is not used.

clientSecret

GuardedString

null

Yes

Client secret for the service principal. Required only when useManagedIdentity=false.

identityBindingScanEnabled

Boolean

false

Enables scanning Azure RBAC roles to produce identity bindings. Currently optional and may require additional privileges.

agentNameFilterRegex

String

null

Optional regular expression used to restrict which agents are returned during discovery.

agentServiceEndpoint

String

null

Yes

Base endpoint for Azure AI Foundry Agents API, for example https://<resource>.services.ai.azure.com/api/projects/<project>.

toolsInventoryUrl

String

null

HTTP(S) URL pointing to the tools-inventory JSON document that includes tools, knowledge bases, guardrails, and agent relationships.

toolsInventoryFilePath

String

null

Local filesystem path to the tools-inventory JSON document. Used only if toolsInventoryUrl is not provided.

agentApiFlavor

String

classic

Agent discovery flavor. Use classic for the /agents API, new for the /assistants API, or both.

apiVersion

String

v1

API version string used when calling the Azure AI Foundry Agents API, for example 2025-01-01.

entraAgentIdLookupEnabled

Boolean

false

When enabled, queries Microsoft Graph beta API to resolve Entra agent identity service principals and enrich agents with their Entra object IDs. Requires Application.Read.All Graph API permission. Correlation is by agent displayName (best-effort).

⁽¹⁾ Whether the property value is considered confidential, and is therefore encrypted in IDM.

⁽²⁾ A list of operations in this column indicates that the property is required for those operations.

ICF 1.5.20.35

Azure AI Foundry connector

Azure AI Foundry requirements

Register an app in Microsoft Entra

Install the Azure AI Foundry connector

Configure the Azure AI Foundry connector

Connection details

Example Azure AI Foundry configuration

Test the Azure AI Foundry connector

Azure AI Foundry remote connector

Use the Azure AI Foundry connector

__ACCOUNT__ attributes

agentTool attributes

agentKnowledgeBase attributes

agentGuardrail attributes

agentIdentityBinding attributes

serviceAccount attributes

agentToolCredential attributes

agentConnection attributes

OpenICF interfaces implemented by the Azure AI Foundry connector

Azure AI Foundry connector configuration

Basic configuration properties

`ACCOUNT` attributes

`agentTool` attributes

`agentKnowledgeBase` attributes

`agentGuardrail` attributes

`agentIdentityBinding` attributes

`serviceAccount` attributes

`agentToolCredential` attributes

`agentConnection` attributes