--- title: Azure AI Foundry connector description: "Reference for the Azure AI Foundry connector: discover AI agents, tools, knowledge bases, guardrails, service accounts, and identity bindings." component: openicf page_id: openicf:connector-reference:azure-ai-foundry canonical_url: https://docs.pingidentity.com/openicf/connector-reference/azure-ai-foundry.html llms_txt: https://docs.pingidentity.com/openicf/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md section_ids: azure_ai_foundry_requirements: Azure AI Foundry requirements register_an_app_in_microsoft_entra: Register an app in Microsoft Entra install_the_azure_ai_foundry_connector: Install the Azure AI Foundry connector configure_the_azure_ai_foundry_connector: Configure the Azure AI Foundry connector connection_details: Connection details example_azure_ai_foundry_configuration: Example Azure AI Foundry configuration test_the_azure_ai_foundry_connector: Test the Azure AI Foundry connector azure_ai_foundry_remote_connector: Azure AI Foundry remote connector use_the_azure_ai_foundry_connector: Use the Azure AI Foundry connector account_attributes: __ACCOUNT__ attributes agenttool_attributes: agentTool attributes agentknowledgebase_attributes: agentKnowledgeBase attributes agentguardrail_attributes: agentGuardrail attributes agentidentitybinding_attributes: agentIdentityBinding attributes serviceaccount_attributes: serviceAccount attributes agenttoolcredential_attributes: agentToolCredential attributes agentconnection_attributes: agentConnection attributes implemented-interfaces-org-forgerock-openicf-connectors-azureaifoundry-AzureAIFoundryConnector-1.5.20.33: OpenICF interfaces implemented by the Azure AI Foundry connector config-properties-org-forgerock-openicf-connectors-azureaifoundry-AzureAIFoundryConnector-1.5.20.33: Azure AI Foundry connector configuration basic-configuration-properties-org-forgerock-openicf-connectors-azureaifoundry-AzureAIFoundryConnector-1.5.20.33: Basic configuration properties --- # Azure AI Foundry connector Azure AI Foundry is Microsoft's unified platform for building and deploying AI agents and applications. The Azure AI Foundry connector discovers AI agents created in Azure AI Foundry and governance-relevant objects including tools, knowledge bases, guardrails, connections, service accounts, and identity bindings. It supports `Delete` for agents; all other object classes are read-only. Contact your Ping Identity Customer Success Outcome Manager (CSOM) or Account Executive to obtain this connector. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Retrieval of `agentIdentityBinding`, `serviceAccount`, `agentConnection`, and `agentToolCredential` is enabled through an offline inventory mechanism that requires an Agent Governance license. Contact your CSOM for details. | ## Azure AI Foundry requirements Before you configure the connector, you must register an application with Microsoft Entra and configure the Azure AI Foundry project. You need a Microsoft Azure subscription to complete this procedure. ### Register an app in Microsoft Entra 1. Sign on to the [Azure portal](https://portal.azure.com/) as an administrative user. 2. Select App registrations under Azure services. 3. On the Register an application page, enter a name for the application and select the supported account types. 4. On the new registration page, make a note of the Application (client) ID and the Directory (tenant) ID. 5. Generate a client secret. Select Certificates & secrets > New client secret, enter a description, and click Add. Copy the client secret value. 6. Note the Azure subscription ID and the resource group where your Azure AI Foundry project resides. Before you configure the connector, confirm you have the following: | Requirement | Value | | ---------------------- | -------------------------------------------------------------------------------------------------------------------- | | Tenant ID | Microsoft Entra tenant GUID | | Subscription ID | Azure subscription ID | | Resource Group | Azure Resource Group for the Foundry project | | Project Location | Location of the Foundry project | | Client ID | Service principal (app registration) client ID | | Client Secret | Service principal client secret | | Agent Service Endpoint | Azure AI Foundry project endpoint URL, for example `https://.services.ai.azure.com/api/projects/` | ## Install the Azure AI Foundry connector | | | | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | To check for an Advanced Identity Cloud application for this connector, refer to:- [Application management](https://docs.pingidentity.com/pingoneaic/latest/app-management/applications.html) - [App catalog](https://docs.pingidentity.com/pingoneaic/latest/app-management/app-catalog.html) | To obtain the connector `.jar` file, contact your Ping Identity Customer Success Outcome Manager (CSOM) or Account Executive. * If you're running the connector locally, place the `.jar` file in the `/path/to/openidm/connectors` directory. * If you're using a remote connector server (RCS), place the `.jar` file in the `/path/to/openicf/connectors` directory on the RCS. ## Configure the Azure AI Foundry connector Create a connector configuration using the IDM admin UI: 1. From the navigation bar, click Configure > Connectors. 2. On the Connectors page, click New Connector. 3. On the New Connector page, type a Connector Name. 4. From the Connector Type list, select Azure AI Foundry Connector - 1.5.20.33. 5. Complete the Base Connector Details and any applicable Additional Options. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------ | | | For a list of all configuration properties, refer to [Azure AI Foundry Connector Configuration](#azureaifoundry-config-prop-ezLink). | 6. Click Save. When your connector is configured correctly, the connector displays as Active in the admin UI. Refer to [this procedure](configure-connector.html#connector-wiz-REST) to create a connector configuration over REST. ### Connection details The Azure AI Foundry connector uses the following configuration properties: | Property | Type | Required | Default | Description | | ---------------------------- | ------------- | ----------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `tenantId` | String | Yes | None | Microsoft Entra tenant GUID. | | `subscriptionId` | String | Yes | None | Azure subscription ID. | | `resourceGroupName` | String | No | None | Azure Resource Group for the Foundry project. | | `workspaceName` | String | No | None | Azure AI Foundry workspace name used for agent discovery and operations. | | `defaultLocation` | String | Yes | `eastus` | Azure region where AI Foundry resources are deployed. | | `useManagedIdentity` | Boolean | Yes | `false` | When `true`, uses managed identity for authentication instead of `clientId` and `clientSecret`. | | `clientId` | String | Conditional | None | Service principal (app registration) client ID. Required when `useManagedIdentity=false`. | | `clientSecret` | GuardedString | Conditional | None | Service principal client secret. Required when `useManagedIdentity=false`. | | `agentServiceEndpoint` | String | Yes | None | Azure AI Foundry project endpoint URL, for example `https://.services.ai.azure.com/api/projects/`. | | `agentApiFlavor` | String | No | `classic` | Agent discovery flavor. Use `classic` for the `/agents` API, `new` for the `/assistants` API, or `both`. | | `apiVersion` | String | No | `v1` | API version string used when calling the Azure AI Foundry Agents API, for example `2025-01-01`. | | `identityBindingScanEnabled` | Boolean | No | `false` | Enables offline inventory scan for identity bindings, service accounts, connections, and tool credentials. When `false`, those object classes return no data. | | `toolsInventoryUrl` | String | No | None | HTTPS URL to the tools inventory JSON (Azure Blob SAS URL or Azure Function HTTP trigger URL). Required when `identityBindingScanEnabled=true`. | | `toolsInventoryFilePath` | String | No | None | Local filesystem path to the tools inventory JSON. Alternative to `toolsInventoryUrl`. Intended for development or test use. | | `agentNameFilterRegex` | String | No | None | Optional regular expression to restrict which agents are returned during discovery based on display name. | | `entraAgentIdLookupEnabled` | Boolean | No | `false` | When `true`, queries the Microsoft Graph beta API to resolve Entra agent identity service principals and enrich agents with their Entra object IDs. Requires `Application.Read.All` Graph API permission. Correlation is by agent display name (best-effort). | ### Example Azure AI Foundry configuration ```json { "connectorRef": { "bundleName": "org.forgerock.openicf.connectors.azureaifoundry-connector", "bundleVersion": "[1.5.0.0,1.6.0.0)", "connectorName": "org.forgerock.openicf.connectors.azureaifoundry.AzureAIFoundryConnector" }, "configurationProperties": { "tenantId": "00000000-0000-0000-0000-000000000000", "subscriptionId": "11111111-1111-1111-1111-111111111111", "resourceGroupName": "my-foundry-rg", "defaultLocation": "eastus", "clientId": "22222222-2222-2222-2222-222222222222", "clientSecret": { "$crypto": { "type": "x-simple-encryption", "value": { "cipher": "...", "data": "...", "iv": "...", "key": "openidm-sym-default" } } }, "useManagedIdentity": false, "agentServiceEndpoint": "https://myresource.services.ai.azure.com/api/projects/myproject", "agentApiFlavor": "classic", "identityBindingScanEnabled": false } } ``` ### Test the Azure AI Foundry connector Test that the configuration is correct by running the following command: ``` curl \ --header "X-OpenIDM-Username: openidm-admin" \ --header "X-OpenIDM-Password: openidm-admin" \ --header "Accept-API-Version: resource=1.0" \ --request POST \ "http://localhost:8080/openidm/system/azureaifoundry?_action=test" { "name": "azureaifoundry", "enabled": true, "config": "config/provisioner.openicf/azureaifoundry", "connectorRef": { "bundleVersion": "[1.5.0.0,1.6.0.0)", "bundleName": "org.forgerock.openicf.connectors.azureaifoundry-connector", "connectorName": "org.forgerock.openicf.connectors.azureaifoundry.AzureAIFoundryConnector" }, "displayName": "Azure AI Foundry Connector", "objectTypes": [ "__ACCOUNT__", "__ALL__" ], "ok": true } ``` If the command returns `"ok": true`, your connector has been configured correctly and can authenticate to the Azure AI Foundry API. ### Azure AI Foundry remote connector If you want to run this connector outside of PingOne Advanced Identity Cloud or IDM, you can configure the Azure AI Foundry connector as a remote connector. Java Connectors installed remotely on a Java Connector Server function identically to those bundled locally within PingOne Advanced Identity Cloud or installed locally on IDM. Refer to [Remote connectors](remote-connector.html) for configuring the Azure AI Foundry remote connector. ## Use the Azure AI Foundry connector The Azure AI Foundry connector discovers the following resource types: | ICF Native Type | Azure AI Foundry Resource Type | Naming Attribute | Notes | | ---------------------- | -------------------------------------------------------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `__ACCOUNT__` | Azure AI Foundry agent | `__NAME__` | Represents one AI Foundry agent. UID is the agent ID. Supports `Delete`; the connector calls the Azure AI Foundry agents API to delete the agent. All other object classes are read-only. | | `agentTool` | Agent tool | `__NAME__` | Represents tools attached to an AI Foundry agent. | | `agentKnowledgeBase` | Agent knowledge base | `__NAME__` | Represents knowledge bases attached to an AI Foundry agent. | | `agentIdentityBinding` | Derived IAM-to-agent identity binding | `__NAME__` | Not a native Azure AI Foundry entity. Read from the offline inventory artifact. | | `agentGuardrail` | Agent guardrail (RAI policy) | `__NAME__` | Represents the Responsible AI policy associated with an agent. | | `serviceAccount` | Azure managed identity or service principal associated with an agent | `__NAME__` | Read from the offline inventory artifact. | | `agentToolCredential` | Derived tool credential surface | `__NAME__` | Read from the offline inventory artifact. | | `agentConnection` | Azure AI Foundry project connection | `__NAME__` | Represents connections (such as to Azure OpenAI or storage) configured in the Foundry project. | ### `__ACCOUNT__` attributes | Attribute | Type | Multivalued | Description | | -------------------- | ------ | ----------- | -------------------------------------------------------------- | | `platform` | String | No | Connector platform identifier. | | `agentId` | String | No | Azure AI Foundry agent ID. | | `agentVersion` | String | No | Agent version. | | `description` | String | No | Agent description. | | `foundationModel` | String | No | Foundation model configured for the agent. | | `instructions` | String | No | System prompt / instructions for the agent. | | `createdAt` | String | No | Agent creation timestamp. | | `raiPolicyName` | String | No | Responsible AI policy name applied to the agent. | | `temperature` | Number | No | Model temperature parameter. | | `topP` | Number | No | Model top-P parameter. | | `responseFormat` | String | No | Response format configuration. | | `toolsRaw` | String | No | Raw tools configuration from the agent definition. | | `toolResourcesRaw` | String | No | Raw tool resources configuration. | | `guardrailId` | String | No | Forward pointer to the `agentGuardrail` object. | | `entraAgentObjectId` | String | No | Microsoft Entra object ID associated with the agent. | | `serviceAccount` | String | No | Service account or managed identity associated with the agent. | | `region` | String | No | Azure region where the agent is deployed. | | `toolIds` | String | Yes | Forward pointers to `agentTool` objects. | | `knowledgeBaseIds` | String | Yes | Forward pointers to `agentKnowledgeBase` objects. | | `identityBindingIds` | String | Yes | Forward pointers to `agentIdentityBinding` records. | | `serviceAccountIds` | String | Yes | Forward pointers to `serviceAccount` records. | | `toolCredentialIds` | String | Yes | Forward pointers to `agentToolCredential` records. | | `connectionIds` | String | Yes | Forward pointers to `agentConnection` records. | | `connectedAgents` | String | Yes | IDs of connected agents. | ### `agentTool` attributes | Attribute | Type | Multivalued | Description | | ------------- | ------ | ----------- | --------------------------------- | | `platform` | String | No | Connector platform identifier. | | `description` | String | No | Tool description. | | `toolType` | String | No | Tool type classification. | | `executorArn` | String | No | Executor reference, when present. | | `schemaUri` | String | No | Schema URI, when present. | ### `agentKnowledgeBase` attributes | Attribute | Type | Multivalued | Description | | -------------------- | ------ | ----------- | --------------------------------------------------- | | `platform` | String | No | Connector platform identifier. | | `knowledgeBaseId` | String | No | Knowledge base ID. | | `knowledgeBaseState` | String | No | Knowledge base state. | | `sourceType` | String | No | Knowledge base source type. | | `connectionRef` | String | No | Connection reference for the knowledge base source. | ### `agentGuardrail` attributes | Attribute | Type | Multivalued | Description | | ------------------------ | ------ | ----------- | ---------------------------------------- | | `platform` | String | No | Connector platform identifier. | | `guardrailId` | String | No | Guardrail ID. | | `raiPolicyName` | String | No | Responsible AI policy name. | | `raiPolicyShortName` | String | No | Short name for the RAI policy. | | `agentIdsUsingGuardrail` | String | Yes | Agent IDs that reference this guardrail. | ### `agentIdentityBinding` attributes | Attribute | Type | Multivalued | Description | | ------------------ | ------- | ----------- | --------------------------------------------------------------- | | `platform` | String | No | Connector platform identifier. | | `agentId` | String | No | Agent ID. | | `agentVersion` | String | No | Agent version. | | `kind` | String | No | Binding kind. | | `principal` | String | No | Principal reference. | | `principalId` | String | No | Principal object ID. | | `principalType` | String | No | Principal type, such as `User`, `Group`, or `ServicePrincipal`. | | `roleName` | String | No | Azure role name. | | `roleDefinitionId` | String | No | Azure role definition ID. | | `iamMember` | String | No | IAM member string. | | `permissions` | String | Yes | Permissions associated with the binding. | | `scope` | String | No | Azure RBAC scope. | | `scopeResourceId` | String | No | Resource ID of the scope. | | `scopeType` | String | No | Scope type. | | `tenantId` | String | No | Azure tenant ID. | | `conditionJson` | String | No | Azure RBAC condition, serialized as JSON. | | `sourceTag` | String | No | Source tag from the inventory artifact. | | `confidence` | String | No | Confidence value from the inventory artifact. | | `expanded` | Boolean | No | Whether the principal was expanded by the inventory process. | ### `serviceAccount` attributes | Attribute | Type | Multivalued | Description | | ---------------- | ------ | ----------- | --------------------------------------------------------------- | | `platform` | String | No | Connector platform identifier. | | `identityType` | String | No | Identity type, such as `ManagedIdentity` or `ServicePrincipal`. | | `identityScope` | String | No | Identity scope. | | `principalId` | String | No | Service principal or managed identity object ID. | | `tenantId` | String | No | Azure tenant ID. | | `clientId` | String | No | Client ID of the managed identity or service principal. | | `serviceAccount` | String | No | Service account reference. | | `linkedAgentIds` | String | Yes | Agent IDs linked to this service account. | ### `agentToolCredential` attributes | Attribute | Type | Multivalued | Description | | ------------------- | ------ | ----------- | ------------------------------------------------------ | | `toolId` | String | No | Tool ID. | | `toolType` | String | No | Tool type classification. | | `authType` | String | No | Authentication type. | | `credentialRef` | String | No | Credential reference. Doesn't contain secret material. | | `connectionId` | String | No | Connection ID used by the tool. | | `connectionName` | String | No | Connection name used by the tool. | | `target` | String | No | Target endpoint or resource. | | `backingResourceId` | String | No | Azure resource ID backing the tool credential. | | `agentIds` | String | Yes | Agent IDs that use this tool credential. | ### `agentConnection` attributes | Attribute | Type | Multivalued | Description | | ------------------- | ------- | ----------- | ------------------------------------------------------- | | `platform` | String | No | Connector platform identifier. | | `connectionType` | String | No | Connection type, such as `AzureOpenAI` or `AzureBlob`. | | `credentialsType` | String | No | Credentials type used by the connection. | | `target` | String | No | Connection target endpoint or resource URI. | | `backingResourceId` | String | No | Azure resource ID backing the connection. | | `isDefault` | Boolean | No | Whether this is the default connection for the project. | ## OpenICF interfaces implemented by the Azure AI Foundry connector The Azure AI Foundry connector implements the following OpenICF interfaces. You can find additional details in [ICF interfaces](interfaces.html): * Delete Deletes an object, referenced by its `uid`. * Schema Describes the object types, operations, and options that the connector supports. * Search Searches the target resource for all objects that match the specified object class and filter. * Test Tests the connector configuration. Testing a configuration checks all elements of the environment that are referred to by the configuration are available. For example, the connector might make a physical connection to a host that is specified in the configuration to verify that it exists and that the credentials that are specified in the configuration are valid. This operation might need to connect to a resource, and, as such, might take some time. Do not invoke this operation too often, such as before every provisioning operation. The test operation is not intended to check that the connector is alive (that is, that its physical connection to the resource has not timed out). You can invoke the test operation before a connector configuration has been validated. []() ## Azure AI Foundry connector configuration The Azure AI Foundry connector has the following configurable properties: ### Basic configuration properties | Property | Type | Default | Encrypted(1) | Required(2) | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- | --------- | ------------------------ | ------------------------- | | `tenantId` | `String` | `null` | | [icon: check, set=fas]Yes | | Microsoft Entra tenant ID (GUID) where Azure AI Foundry resources reside. | | | | | | `subscriptionId` | `String` | `null` | | [icon: check, set=fas]Yes | | Azure subscription ID that contains the Azure AI Foundry workspace. | | | | | | `resourceGroupName` | `String` | `null` | | [icon: times, set=fas]No | | Name of the Azure Resource Group containing the workspace. | | | | | | `workspaceName` | `String` | `null` | | [icon: times, set=fas]No | | Azure AI Foundry workspace name used for agent discovery and operations. | | | | | | `defaultLocation` | `String` | `eastus` | | [icon: check, set=fas]Yes | | Azure region where AI Foundry resources (agents, tools, KBs, guardrails) are deployed. | | | | | | `useManagedIdentity` | `Boolean` | `false` | | [icon: check, set=fas]Yes | | If true, the connector authenticates using a managed identity attached to the runtime environment. If false, a service principal (clientId + clientSecret) is used. | | | | | | `clientId` | `String` | `null` | | [icon: times, set=fas]No | | Client ID (Application ID) of a service principal when managed identity is not used. | | | | | | `clientSecret` | `GuardedString` | `null` | [icon: lock, set=fas]Yes | [icon: times, set=fas]No | | Client secret for the service principal. Required only when useManagedIdentity=false. | | | | | | `identityBindingScanEnabled` | `Boolean` | `false` | | [icon: times, set=fas]No | | Enables scanning Azure RBAC roles to produce identity bindings. Currently optional and may require additional privileges. | | | | | | `agentNameFilterRegex` | `String` | `null` | | [icon: times, set=fas]No | | Optional regular expression used to restrict which agents are returned during discovery. | | | | | | `agentServiceEndpoint` | `String` | `null` | | [icon: check, set=fas]Yes | | Base endpoint for Azure AI Foundry Agents API, for example `https://.services.ai.azure.com/api/projects/`. | | | | | | `toolsInventoryUrl` | `String` | `null` | | [icon: times, set=fas]No | | HTTP(S) URL pointing to the tools-inventory JSON document that includes tools, knowledge bases, guardrails, and agent relationships. | | | | | | `toolsInventoryFilePath` | `String` | `null` | | [icon: times, set=fas]No | | Local filesystem path to the tools-inventory JSON document. Used only if `toolsInventoryUrl` is not provided. | | | | | | `agentApiFlavor` | `String` | `classic` | | [icon: times, set=fas]No | | Agent discovery flavor. Use `classic` for the `/agents` API, `new` for the `/assistants` API, or `both`. | | | | | | `apiVersion` | `String` | `v1` | | [icon: times, set=fas]No | | API version string used when calling the Azure AI Foundry Agents API, for example `2025-01-01`. | | | | | | `entraAgentIdLookupEnabled` | `Boolean` | `false` | | [icon: times, set=fas]No | | When enabled, queries Microsoft Graph beta API to resolve Entra agent identity service principals and enrich agents with their Entra object IDs. Requires `Application.Read.All` Graph API permission. Correlation is by agent `displayName` (best-effort). | | | | | (1) Whether the property value is considered confidential, and is therefore encrypted in IDM. (2) A list of operations in this column indicates that the property is required for those operations.