---
title: Configuring AI Foundry
description: Connect PingOne Privilege to Azure AI Foundry so AI discovery can review its agent inventory.
component: privilege
page_id: privilege:agent-privilege:configuration/workload-agent-apps/ai-foundry
canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/configuration/workload-agent-apps/ai-foundry.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: October 21, 2026
---

# Configuring AI Foundry

Connect Azure AI Foundry as a workload agent application so AI discovery for workload agents can review the agents running in the subscription. Learn more in [Discover and manage workload agents](../../use-cases/workload-agents.html).

1. In the PingOne Privilege admin console, go to **AI Security > Workload Agents**.

2. Click the **Add Application** tab.

3. In the list of available applications, find **AI Foundry** and click **[icon: plus, set=fa]Integrate**.

4. Enter a **Name** for the connection.

5. (Optional) Enter a **Description**.

6. Click **Next**.

7. Create an Entra ID App Registration and assign to it the following Azure role-based access control (RBAC) *(tooltip: \<div class="paragraph">
   \<p>Also known as non-discretionary access control, this authorization strategy bases user access on assigned roles.\</p>
   \</div>)* roles:

   * `Reader (Subscription)`

   * `Foundry User (Subscription)`

   * `Foundry Project Manager (Subscription)`

   * `Cognitive Services Contributor (AI Services account)`

   * `User Access Administrator (Subscription)` or `Custom role (roleAssignments/read + roleAssignments/delete)`

8. Click **Next**.

9. Enter your **Tenant ID**, **Client ID**, **Client Secret**, and **Subscription ID**, then click **Next**.

10. Review the summary, then click **Add Connection**.

You can now validate that the connection is active in the **Active Applications** tab.