Foundry resources, projects and connections
Microsoft Foundry (formerly Azure AI Foundry and Azure AI Studio) is the platform where you deploy models and build agents. The exam checks that you can choose the right resource, wire it up and secure it.
Resources and projects
| Item | Purpose |
|---|---|
| Foundry resource | Top-level Azure resource. Hosts model deployments and Foundry Tools (Speech, Language, Vision, Document Intelligence, Content Safety) behind one endpoint |
| Project | A workspace under the resource. Holds agents, files, evaluations, connections and traces |
| Single-service resource | Use when you want one service only, with its own endpoint and billing |
| Hub-based project | Older model tied to Azure Machine Learning. New work uses Foundry projects |
Choose the multi-service Foundry resource when requirements say “single endpoint and credential” or “may use other services in the future”.
Deployments
A model in the catalog does nothing until you create a deployment. Your code needs three things: the resource endpoint, a credential, and the deployment name.
from openai import AzureOpenAI
client = AzureOpenAI(azure_endpoint=endpoint, api_key=key, api_version="2025-04-01-preview")
resp = client.chat.completions.create(model="my-gpt-deployment", messages=[...])Deployment types decide cost and data location: Standard (pay per token, regional), Global Standard (best capacity), Data Zone, and Provisioned (reserved throughput for predictable latency). If the question says “guaranteed throughput”, pick Provisioned.
Connections
A connection in a project stores the endpoint and authentication of another resource, such as Azure AI Search, Blob Storage or Bing grounding. Define it once and every agent in the project reuses it. This is the answer when many apps or agents need the same search configuration without keys.
Authentication and access
- Prefer Microsoft Entra ID with managed identities over API keys. Disable local (key) auth when policy requires it.
- Assign RBAC roles such as Azure AI User or Cognitive Services OpenAI User for calling models, and Azure AI Project Manager or Owner for management.
- For Azure AI Search, grant the project identity Search Index Data Reader (query) or Search Index Data Contributor (write).
- To block internet access use private endpoints and disable public network access. Foundry can also use a managed virtual network.
Exam traps
- You call the deployment name, not the model name.
- A connection is not a deployment. Connections link other services to the project.
- Disabling keys means every caller needs an Entra identity plus the right role, otherwise you get 401 or 403.
- Single-service resources cannot be used for other services later. Multi-service can.
- Provisioned throughput is for predictable latency. 429 errors on Standard are handled with retry and exponential backoff.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. An app will use Speech, Language and Vision, and you want one endpoint and one credential for all of them. What do you create?
Show answer
Answer: B.A Microsoft Foundry resource (formerly Azure AI services multi-service account) exposes many Foundry Tools behind one endpoint and key.
2. Several agents in one project must use the same Azure AI Search service, and key-based access is disabled. What is the best way to manage this centrally?
Show answer
Answer: B.A project connection holds the endpoint and auth once. Agents reference it, and it can use Entra ID with a managed identity.
3. Which three values do you need to call a model with the Azure OpenAI SDK?
Show answer
Answer: A.You call the deployment name, not the base model name, at the resource endpoint with a key or Entra token.
4. A pipeline must find the endpoint of an existing Azure AI services account with the least effort. Which command do you run?
Show answer
Answer: B.az cognitiveservices account show returns the account properties, including the endpoint.