Question

Your team deploys an Azure AI Foundry agent that calls a third-party payment API requiring a static API key. Security policy mandates that the key never appears in code, configuration files, or the Foundry project settings in plaintext, and that the key can be rotated without redeploying the agent. Which approach best satisfies these requirements while integrating the credential into the agent's tool call?

Accepted Answer

Store the API key as a secret in Azure Key Vault, grant the agent's managed identity the Key Vault Secrets User role, and reference the secret at runtime through a Foundry connection.

Answer

Embed the API key in the agent's OpenAPI tool definition and mark the field as sensitive so Foundry masks it in the portal.

Answer

Add the API key as a plaintext environment variable in the managed online endpoint's deployment configuration.

Answer

Hardcode the API key in the agent's prompt template and enable content filtering to prevent it from being echoed back.