Question

You are building an Azure AI Foundry agent that must call your company's internal Orders REST API, which is protected by OAuth 2.0 client-credentials flow against Microsoft Entra ID. You register the API as an OpenAPI-specified tool for the agent. When configuring the tool, you must ensure the agent can authenticate to the API without embedding long-lived secrets in the tool definition and while respecting the API's token audience requirements. Which authentication configuration should you use for the OpenAPI tool?

Accepted Answer

Configure the OpenAPI tool with a Managed Identity authentication connection so the agent acquires Entra ID tokens scoped to the API's audience at call time.

Answer

Configure the OpenAPI tool with anonymous authentication and rely on the agent's network isolation to protect the API.

Answer

Configure the OpenAPI tool with an API key connection and store the client secret directly in the OpenAPI specification's securitySchemes section.

Answer

Configure the OpenAPI tool to pass the end user's chat session token directly to the Orders API on each request.