Generative AI & agentic solutions · 30–35%

Build agents with Foundry

~4 min read

Agent = model + instructions + tools

An agent is a named AI configuration that bundles a model, instructions (its role and rules), and tools it may call — so it can act, not just chat.

Foundry Agent Service is the managed platform that runs them: it handles the whole tool-calling lifecycle, keeps state via the Responses API, and adds a tool catalog, content safety, and tracing.

Agent type	Defined by
Declarative: prompt-based	Config (portal / YAML in VS Code). Most common.
Declarative: workflow	YAML multi-agent orchestration
Hosted	Code, containerized, platform-hosted

Dev surfaces: Foundry portal (visual, prototyping) · VS Code Foundry extension (Agent Designer, YAML, playgrounds, Git-versioned config).

Tool catalog — 3 buckets

Configured (built-in, ready): Code Interpreter, File Search.
Catalog: Bing Web Search (with citations), Azure AI Search, SharePoint, Fabric, Browser Automation, Computer Use, Image Generation, Deep Research, Agent-to-Agent.
Custom: OpenAPI specs, MCP servers.

File Search vs Azure AI Search: File Search = docs you upload to a vector store; Azure AI Search = your existing enterprise index. If the question mentions an “existing index”, the answer is the AI Search tool.

Custom tool options

Option	When
Function calling	Your code, any logic; agent emits call, schema from your definition
Azure Functions	Event-driven / serverless; queue triggers + bindings
OpenAPI 3.0 tool	Existing REST API + spec. Auth: anonymous, API key, managed identity
Logic Apps	Low-code/no-code workflow connectors

Agent is declarative: you never write code that calls the tool — the agent decides from names + descriptions. Good descriptions = good tool selection.

MCP (Model Context Protocol)

MCP is an open protocol that gives agents a standard way to discover and call external tools at runtime — connect once, and tools can change server-side without redeploying the agent.

The server exposes tools (@mcp.tool, FastMCP); the client discovers them with session.list_tools(). That is dynamic tool discovery: add or update tools without redeploying agents.
Foundry MCPTool params: server_label, server_url, allowed_tools, require_approval (always = default, never), custom headers for auth.
Approval flow: when the agent wants to call a guarded tool, its response contains an mcp_approval_request; you reply with an mcp_approval_response carrying the approval_request_id and an approve boolean.

Foundry IQ (knowledge)

Foundry IQ is a managed knowledge platform built on Azure AI Search: you create knowledge bases once and any agent connects to them via MCP, instead of each team building its own RAG pipeline. Knowledge bases organized by business domain; shared across agents.

Data sources: AI Search index · Blob Storage (direct) · Web via Bing (real-time) · SharePoint Remote (real-time, respects SP permissions, no index) vs SharePoint Indexed (faster, custom pipelines, needs reindex) · OneLake (Fabric).

Retrieval instructions must specify: when to retrieve (always), how to cite (exact format), fallback when not found.

Deploy vs Publish — exam favorite

Deploy = save to your project (internal iteration).
Publish = creates Agent Application Azure resource: stable Responses-API endpoint + own Entra identity + auth policy.
Callers need Azure AI User role; API keys not supported on Agent Applications.

Published agent gets a new identity — dev permissions don’t transfer. Tools that call Azure resources fail with 403 until you re-assign RBAC roles to the new agent identity. Classic exam trap: “works in playground, fails after publishing”.

Microsoft 365 integration

Publish to Teams/Copilot from portal: creates Azure Bot Service + Entra app + publishing package.
Scopes: Shared (immediate, “Your agents”, testing) vs Organization (“Built by your org”, admin approval in M365 admin center).
Complex needs (custom SSO, middleware, CI/CD) call for a Microsoft 365 Agents Toolkit proxy app.
Work IQ is an MCP server that lets agents query Microsoft 365 data (mail, meetings, docs, Teams, people). Permission-based: it only reads what the signed-in user can already see, and stores nothing.

Agent security quick list

Risks: prompt injection, privilege escalation, data leakage/poisoning, over-autonomy. Mitigations: RBAC + least privilege, prompt filtering, human-in-the-loop approvals for sensitive ops, full logging/traceability, audit third-party deps.