Recent Discussions
Searching for a simple guide to index SharePoint and publish an agent in Foundry
Hey all, Does anyone have a good guide or best practices for this setup in Foundry? SharePoint as data source GPT model (document + image indexing, ideally vectorized/embeddings) Create an Agent an Share the Agent Restrict access to Agent to specific users/groups only Looking for tutorials, examples, or real-world setups. Thanks!
Is there a way to connect 2 Ai foundry to the same cosmos containers?
I defined Azure AI Foundry Connection for Azure Cosmos DB and BYO Thread Storage in Azure AI Agent Service by using these instructions: Integration with Azure AI Agent Service - Azure Cosmos DB for NoSQL | Microsoft Learn I see that it created 3 containers under the cosmos I provided: <guid>-agent-entity-store v-system-thread-message-store <guid>-thread-message-store Now I created another AI foundry and added a connection for the same AI foundry, and it created 3 different containers under the same DB. Is there a way that they'll use the same exact containers? I want to use multiple AI foundries, and they will use the same Cosmos containers to manage the data.
New Foundry Agent Issue
Hi all, I’m creating my first agent via New Foundry, so my questions are probably basic. As always, everything seemed straightforward… until deployment. I created an agent using gpt-4.1, added a list of instructions, and then used the Tools → Upload files functionality to attach a selection of reference documents. Everything worked perfectly in Preview mode. I then used the default option to Create a bot service, and it deployed successfully. To test it, I used the Individual Scope option (with the intention to share later with a couple of people — I haven’t worked that part out yet). Like magic, it appeared in my Teams and M365 Copilot, which was amazing… and then I ran my first search. It thought for a long time and then returned an error. In Co-pilot: and Teams: Nothing happens at all I’ve looked around for help but drawn a blank. I’m fairly sure it’s some kind of permissioning / access issue somewhere, but I can’t find where. Any help would be hugely appreciated.o3-mini not returning reasoning tokens
Hi, I work on a service that leverages o3-mini via Microsoft Foundry. In the past few days, I've observed that when calling o3-mini via Microsoft Foundry, that completion_token_details always has the reasoning_tokens value set to 0, regardless of the reasoning setting being used. In my testing, it seems that the reasoning is still occurring, as increasing reasoning value causes the completion_tokens field to increase by a good amount, but none of the reasoning levels cause the reasoning_tokens value to be anything other than 0. Has anyone else encountered this issue? Thanks! Tom
o3-deep-research is failed with the status incomplete with the reason as content filter
I working on an to do an deep research on internal data. I'm using currently the Azure OpenAI Responses API with MCP Tool. The underlying MCP server deployed into ACA with search and fetch tool with signatures in complaint with the specification (https://developers.openai.com/apps-sdk/build/mcp-server#company-knowledge-compatibility). OpenAI client created with 03-deep-research model with MCP tool, in a loop response status being checked. (https://learn.microsoft.com/en-us/azure/foundry/openai/how-to/deep-research#remote-mcp-server-with-deep-research) Deep Research is being carried out for sometime, I could see in the log that handshake has been made, ListTools invoked, search tool is called post that fetch is called for the queries framed by the model.. But intermittently, the response status is becoming "incomplete" with incomplete reason as "content_filter". Otherwise the deep research is working fine. Not able identify the root cause as there is seems to be no way to identify what caused the content filtration whether its the prompt or completion. How to debug and check the root cause and rectify this ? Or is there known issue with the o3-deep-research model's intermediate reasoning completions Or search and fetch tool results are causing this ? I had uploaded a file made it available to MCP server, the search and fetch tool uses an Azure OpenAI agent to search the data using File Search and fetch tool gets the content of the file based on the id passed. For same file and same research topic the issue is not occurring always but intermittently.Microsoft Foundry Agent via Responses API rejects local image input as Base64 data URL / byte array
Hello everyone, we are seeing an issue with the new Microsoft Foundry Agents via the Responses API when sending a local image as part of the user message. What works text-only input image by public URL What fails local PNG passed as Base64 data URL local PNG passed as raw byte array through SDK methods Example failing image part: { "type": "input_image", "image_url": "data:image/png;base64,...", "detail": "auto" } Returned error: { "code": "invalid_payload", "message": "The provided data does not match the expected schema", "param": "/", "type": "invalid_request_error", "details": [] } We reproduced this in: C# Python raw REST So this does not appear to be limited to one SDK. Also important: the same pattern is used in the sample repo for the Foundry Agent Web App, and this scenario worked for us about one week ago: https://github.com/microsoft-foundry/foundry-agent-webapp Could you confirm whether local image input is currently supported for Foundry Agents through the Responses API, or whether this is a regression? Best regards
GPT-5.5-Pro not listed in foundry?
The model is mentioned in this blog post : https://azure.microsoft.com/en-us/blog/openais-gpt-5-5-in-microsoft-foundry-frontier-intelligence-on-an-enterprise-ready-platform/ But it is currently not listed on Foundry. Only latest pro model is 5.4-pro. When will 5.5-pro model be available on azure foundry?
Foundry Toolbox preview not working for hosted agent
Tried calling a hosted foundry agent with calls to Toolbox where I tried both web search and code interpreter. Neither of them work. If i use session.call_tool, I get an error like " meta={'tool_configuration': {'type': 'web_search'}} content=[TextContent(type='text', text='NotFound[404, user=The API deployment for this resource does not exist. If you created the deployment within the last 5 minutes, please wait a moment and try again.]', annotations=None, meta=None)] structuredContent=None isError=True". If i try agent.run asking for latest news on a topic ,I either get a generic pretrained knowledge based response (without reference to web search tool) Or a generic error of the type " I wasn't able to retrieve the latest news at the moment due to a technical issue." I have verified that the code uses the appropriate headers like " headers={"Foundry-Features": "Toolboxes=V1Preview"}" I have verified that a Foundry portal agent calling web search tool works as expected. However when I create a custom tool using MCP Server where I provide the URL of the foundry toolbox and then try to use this tool in a Portal created agent I always get an access issue even if i use project identity as the Entra authentication and despite the fact that Project Identity has Foundry User privilege on Foundry Project. I have also tried the github samples for deploying hosted agents with foundry toolbox without luck. Version of agent-framework as of date that I have tried is 1.4.0. Please advise on a resolution. Thanks!Multiple Fabric Data Agent Tools on a Single Foundry Agent
a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; } We are evaluating the Microsoft Fabric Data Agent integration with Azure AI Foundry Agents and are looking for clarification on the supported architecture. Scenario We would like to create a single Foundry Agent as the orchestrator and attach multiple Microsoft Fabric Data Agents as tools. Each Fabric Data Agent is registered as a separate Foundry tool representing a specific business domain. Executive Assistant Agent (Orchestrator) ├─ Too: Sales Fabric Data Agent ├─ Tool: Finance Fabric Data Agent └─ Tool: HR Fabric Data Agent The expectation is that the Foundry Agent would automatically select the appropriate Fabric Data Agent tool based on the user's request. Examples: "What was our Q2 revenue?" → Sales Fabric Data Agent tool "What is current headcount?" → HR Fabric Data Agent tool "Show budget variance by region." → Finance Fabric Data Agent tool Is it a supported scenario to attach multiple Microsoft Fabric Data Agent tools to a single Foundry Agent? We are unable to find documentation that explicitly states whether: Multiple Fabric Data Agent tools can be attached to the same Foundry Agent. Multiple Fabric tools are supported within a single agent configuration. The error Duplicate tool argument name: 'azure_fabric' indicates a configuration issue, SDK limitation, or unsupported architectureAPIM within Foundry
Dear Azure AI Foundry team at Microsoft, Please reconsider the current architecture and developer experience around AI observability and token analytics. As it stands today, customers are expected to assemble an entire distributed system — APIM, Azure Functions, Static Web Apps, App Insights, Log Analytics, custom SSE parsing, and additional infrastructure — just to answer very basic operational questions: Which users are consuming the most tokens? Which models are being used the most? What are our real-time streaming costs? Which subscriptions/projects are generating spend? Even worse, many of these solutions break down when using streamed/SSE AI responses because APIM policies are not designed to reliably process chunked AI streams and partial JSON bodies. So customers end up building increasingly complicated middleware pipelines for functionality that should already exist natively inside the platform. At the same time: Azure clearly has access to token and billing telemetry internally customers are still billed for usage yet customers themselves are not given equivalent real-time visibility or tooling That creates a frustrating disconnect, making it feel like a money grab when. It's like paying for groceries and not allowing customers to receive a receipt. Another major issue is API key management. Providing effectively a single project-level credential for enterprise AI workloads creates operational and governance limitations that make multi-user auditing unnecessarily difficult. Why in the world, would the foundry team design this with only api key per project? Is there a secret reason for this, other than annoying customers? To be blunt: the current system design feels massively overengineered for customers while simultaneously underdelivering on the core metrics enterprises actually need. AI platform teams should not need to build 10+ supporting Azure services just to approximate token analytics for a single Foundry project. Azure has excellent infrastructure capabilities overall, which is exactly why this experience is so surprising. But if the platform architecture and observability story for AI workloads do not improve soon, many organizations — including ours — will seriously evaluate moving to alternative cloud providers and AI gateway solutions that provide simpler and more transparent operational tooling. Please prioritize: native streaming token telemetry first-class SSE observability proper per-user/per-model analytics better API credential management simpler AI cost governance workflows Right now, the operational overhead compared to the value delivered is far too high.
Data Visualisation / Charting in Azure Foundry
Hi Foundry community, We are working on an agent that can query internal data sources, and are looking for ways that we can visualise data (think pie charts, bar charts, etc.). This would be consumed by end users through Copilot/Teams. However we are unable to find a way to do so, which is surprising given that you easily can create charts through M365 Copilot Chat and through Copilot Studio. We have tried using the 'Code Interpreter' tool, but the Teams/Copilot client UIs just do not render the results inline, either interactive or as an embedded image. They also do not give any option to download them. Has anyone tackled this before? How have you been able generate charts? Many thanks!Foundry Agent deployed to Copilot/Teams Can't Display Images Generated via Code Interpreter
Hello everyone, I’ve been developing an agent in the new Microsoft Foundry and enabled the Code Interpreter tool for it. In Agent Playground, I can successfully start a new chat and have the agent generate a chart/image using Code Interpreter. This works as expected in both the old and new Foundry experiences. However, after publishing the agent to Copilot/Teams for my organization, the same prompt that works in Agent Playground does not function properly. The agent appears to execute the code, but the image is not accessible in Teams. When reviewing the agent traces (via the Traces tab in Foundry), I can see that the agent generates a link to the image in the Code Interpreter sandbox environment, for example: `[Download the bar chart](sandbox:/mnt/data/bar_chart.png)` This works correctly within Foundry, but the sandbox path is not accessible from Teams, so the link fails there. Is there an officially supported way to surface Code Interpreter–generated files/images when the agent is deployed to Copilot/Teams, or is the recommended approach perhaps to implement a custom tool that uploads generated files to an external storage location (e.g., SharePoint, Blob Storage, or another file hosting service) and returns a publicly accessible link instead? I've been having trouble finding anything about this online. Any guidance would be greatly appreciated. Thank you!New AI Foundry not sending refresh tokens to MCP (401 after access token expiration)
Hello, When connecting an MCP server hosted as an Azure Function using OAuth Passthrough in New AI Foundry Playground, the connection is established successfully, the Microsoft login popup appears, authentication succeeds, and the first MCP request returns data correctly. However, once the access token expires, the Playground and deployed AI Foundry agents to Copilot/Teams do not appear to refresh the token, despite offline_access being included in the requested scopes and a refresh URL being configured. All subsequent MCP calls fail with 401 Unauthorized until the connection is manually recreated. For testing, we reduced the token lifetime to 10 minutes to make the issue easier to reproduce. Impact This prevents long-lived or repeated MCP usage in AI Foundry Playground because the connection becomes unusable after token expiry and requires manual reconnection. MCP server host: Azure Function MCP server configuration in New AI Foundry: Endpoint: https://mcp-test-obo-rls-fabric.azurewebsites.net/mcp Client ID: <client_id> (redacted) Auth URL: https://login.microsoftonline.com/tenant_id(redacted)/oauth2/v2.0/authorize Token URL: https://login.microsoftonline.com/tenant_id(redacted)/oauth2/v2.0/token Refresh URL: https://login.microsoftonline.com/tenant_id(redacted)/oauth2/v2.0/token Scopes: openid profile offline_access api://(App ID)/user_impersonation Redirect URI: https://global.consent.azure-apim.net/redirect/(redacted)-fabric-rls-mcp Error returned tool_user_error: Authentication failed when connecting to the MCP server: https://mcp-test-obo-rls-fabric.azurewebsites.net:443/mcp : Response status code does not indicate success: 401 (Unauthorized). Response body: {"code":401,"message":"IDX10223: Lifetime validation failed. The token is expired. ValidTo (UTC): '03/30/2026 08:19:28', Current time (UTC): '03/30/2026 08:29:55'."}. Verify your authentication headers. Suggestions: First verify the required permissions. If the access token is expired or revoked, recreate the connection. If this connection is shared by other users or workflows, recreate it carefully to avoid disruption. Function App / Identity Provider (Entra) The Azure Function authentication configuration: Identity provider: Microsoft (MCP-Fabric-RLS-Server) App registration: MCP-Fabric-RLS-Server Supported account types: Single tenant Application (client) ID: App ID Client secret setting name: MICROSOFT_PROVIDER_AUTHENTICATION_SECRET Issuer URL: https://login.microsoftonline.com/tenant_id(redacted)/v2.0 Redirect URI is added to App Authentication Redirect URI configuration as "Web". Allowed token audiences api://App ID App ID https://mcp-test-obo-rls-fabric.azurewebsites.net Additional checks enabled Allow requests from any application Allow requests from any identity Allow requests only from issuer tenant tenant_id (redacted) Notes The first authenticated call succeeds, so the initial OAuth flow appears to be working. The failure only occurs after the access token expires. Because offline_access is requested and the refresh URL is configured, our expectation is that the client should refresh the token automatically. Our working hypothesis is that either: the refresh token is not being issued, the refresh token is not being stored/used by AI Foundry Playground, or OAuth Passthrough for MCP connections in this scenario does not currently support automatic refresh as expected. Thank you for any assistance provided.Azure AI Foundry Agent Unable to Use Credentials Stored in Key Vault Through Playwright MCP Tool
Hello everyone, I am trying to understand how Azure AI Foundry agents interact with Azure Key Vault when using custom MCP tools, and I would appreciate any guidance from the community. My Setup - Created an Azure AI Foundry agent. - Created an Azure Key Vault and configured all permissions according to Microsoft's official documentation. - Stored the required website credentials (username and password) in the Key Vault. - Deployed the official Playwright MCP Docker image. - Exposed the MCP server using ngrok and verified that the endpoint is accessible. - Connected the MCP endpoint as a Custom MCP Tool in Azure AI Foundry. - Performed all configuration through the Azure portal, Foundry UI, and Playground only (no SDK or custom application code involved). The Issue The agent can access and use the Playwright MCP tool. However, when I ask it to log in to a website using credentials that are already stored in Key Vault, it does not populate the username and password fields. My expectation was that the agent would be able to retrieve the secrets from Key Vault and provide them to the Playwright tool during execution. Questions Is there currently a supported mechanism for Azure AI Foundry agents to automatically retrieve Key Vault secrets and pass them to a Custom MCP tool? Does the Playwright MCP Docker image have any built-in integration with Azure Key Vault? When using only the Foundry UI (without SDK code), can a Foundry agent securely inject Key Vault secrets into MCP tool calls? Are additional configurations required beyond Key Vault permissions and agent connections? Has anyone successfully implemented a similar setup where a Foundry agent uses credentials stored in Key Vault to perform browser automation through Playwright MCP? Any clarification on the expected architecture and whether this scenario is currently supported in Azure AI Foundry would be greatly appreciated. Thank you.
Unable to Connect Localhost MCP Server from Azure AI Foundry Hosted Agent (o4-mini)
I'm using the Azure AI Foundry Toolkit in VS Code and have configured an MCP server running on my local machine (localhost). When I run my Azure AI Foundry-hosted agent (o4-mini), it fails to connect to the MCP server. Based on the error logs, it appears that the hosted agent cannot reach the localhost endpoint. My understanding is that the MCP server is running correctly locally, but the hosted agent seems unable to access services running on my machine. Has anyone successfully connected a locally hosted MCP server to an Azure AI Foundry-hosted agent while using the Foundry Toolkit in VS Code?Failed to add tool to agent - Preview Feature Required?
Hi, We’ve recently run into an issue where we’re no longer able to add tools to our Foundry agent. This was previously working without problems in our development environment, but now every attempt results in the following error: “Failed to add tool to agent Request failed with status code 403.” After inspecting the request in the browser’s developer console, we noticed an additional message: "This operation requires the following opt-in preview feature(s): AgentEndpoints=V1Preview. Include the 'Foundry-Features: AgentEndpoints=V1Preview' header in your request." How can we opt in for this foundry preview feature? and when was this change introduced? We are unsure if the issue is related the the preview feature missing, or some other forbidden issue. Any help would be very much appreciated. Kind regards, ArneAzure AI Foundry HTTP 403 "unusual behavior" block on Elevate-grant resource
SUMMARY Azure AI Foundry resource is returning HTTP 403 with the message "Your resource has been temporarily blocked because we detected unusual behavior" and has remained blocked for 24+ hours with no auto-clear, even at less than 2 RPM with a 10-token probe. The bigger issue: every standard support path is closed because the subscription sits on a Developer support plan — both the Azure Portal ticket form AND the az support REST/CLI API gate on plan tier. Posting here as one of the few remaining surfaces a Microsoft engineer can pick up. RESOURCE DETAILS Resource: bda-ai-foundry Subscription: f60e8dd3-ec1a-42bc-ba90-f79e7e835505 Organization: Bharat Dharma Academy Limited — Australian registered charitable NFP, Sanatan Dharma educational content Grant: Microsoft Elevate AFFECTED DEPLOYMENTS - gpt-5-mini (chat/completions, primary workhorse) - gpt-5-pro (responses endpoint, premium tier) - o4-mini (fast fallback) - text-embedding-3-large - Cohere-embed-v3-multilingual - FLUX-1.1-pro SUSPECTED TRIGGER Per Microsoft Q&A guidance from a volunteer moderator (May 22 2026), the most likely trigger is anomaly detection from: (a) the same API key being used from two geographically distant origins — Render in US East (Virginia) and a Mac workstation in Australia (Sydney); (b) bursty smoke-test calls after long idle periods. That diagnosis is consistent with the symptom: a 403 that does NOT auto-clear, and is NOT a traditional 429 quota error. SUPPORT PATHS ATTEMPTED (ALL BLOCKED) 1. Azure Portal -> Help + Support -> New Support Request -> redirects to Q&A / support-plan gate. 2. Direct support-request URL (typed manually in browser) -> same redirect / gate. 3. Microsoft Support virtual agent (contact page) -> loops back to Q&A. 4. Azure CLI in Cloud Shell — full az support in-subscription tickets create command with all required parameters populated (service classification, severity, contact details). Returned: (InvalidSupportPlan) Your support plan type is Developer. To create and update support tickets, and add communication operations, you need access to our high tier-support plans. 5. Microsoft for Nonprofits contact form — submitted in parallel. 6. Microsoft Q&A — root cause confirmed by volunteer moderator, awaiting MS engineer pickup. MITIGATIONS ALREADY IMPLEMENTED ON OUR SIDE To demonstrate this is not a runaway script: - All Azure traffic PAUSED — we are NOT retrying (we understand retries worsen the anomaly signal). - Async rate limiter + circuit breaker shipped on every Azure caller; any 403 immediately opens a 6-hour circuit so the resource cannot be hammered. - Going forward: * separate API keys per origin (Render in Virginia and Mac in Sydney) * separate deployments per workload (web vs batch) * Diagnostic Settings routed to Log Analytics WHAT I AM ASKING FOR 1. Manual review and clearance of the block on bda-ai-foundry. 2. The specific trigger reason if visible internally, so we can confirm our preventive mitigations are correct. 3. Guidance for the community: should grant-funded Microsoft Elevate / Nonprofit subscriptions have an alternative support escalation path that does not require a paid plan upgrade? The current state — every standard channel closed for Developer-plan subscriptions — is a significant gap for charitable projects that, by design, run on Microsoft's grant credits and do not maintain paid support contracts. This is a live charitable educational workload (Sanatan Dharma content serving the global Hindu community). Happy to provide any further diagnostic information. Thank you. Parag Srivastava Founder, Bharat Dharma Academy Limited Contact email available via my Tech Community profile.Date extraction regression: 2025-05-01-preview vs 2025-11-01 (GA) in Azure Content Understanding
Issue: When using the documentFieldExtraction scenario in Azure Content Understanding, the GA version (2025-11-01) produces significantly worse results compared to the preview version (2025-05-01-preview) for date field extraction on scanned (Dutch) medical documents. Observed behavior: With 2025-05-01-preview: all date fields are extracted correctly, including dates that are split across three separate handwritten fields (day, month, year). With 2025-11-01 (GA): multiple date fields are either not found, returned as null, or extracted with day and year swapped (e.g. 2027-12-01 instead of 2001-12-27). Document characteristics: Scanned PDF (not native digital) Dutch language 4-16 pages Dates are handwritten and split across three separate labeled fields: dag (day), maand (month), jaar (year) Year is written as 2 digits (e.g. "26" for 2026, "01" for 2001) Schema used: documentFieldExtraction with type: date fields and explicit descriptions instructing the model to read day → month → year in order and expand 2-digit years to 4 digits. Expected behavior: The GA version should perform at least on par with the preview version when using the exact same prompts. Is this a known regression? Any recommended workarounds while waiting for a fix?
Recent Blogs
- Recurring Failure We are entrusting AI agents with an increasing range of tasks, from preparing briefs to scheduling meetings, and from filing tax returns to building and debugging production syste...Jul 16, 2026
- 22 MIN READChoose the right speech and voice model in Microsoft Foundry The practical approach to selecting the right model is simple: do not ask which speech model is best. Ask what the speech system must gu...Jul 16, 2026
