Question

You are building an Azure AI Foundry agent for a logistics company. The agent must be able to call an existing internal REST API that returns real-time shipment tracking data. The API is documented with an OpenAPI 3.0 specification and is secured behind Microsoft Entra ID. You need the agent to invoke this API as a tool while authenticating without storing any secrets in the agent configuration. Which approach should you use?

Accepted Answer

Register the API as an OpenAPI specified tool on the agent and configure it to authenticate using the agent's managed identity via Microsoft Entra ID.

Answer

Wrap the API in an Azure Function and expose it to the agent as a code interpreter tool, embedding an API key in the function's app settings.

Answer

Add the API as a knowledge source in the agent's vector index so the agent can retrieve shipment data during grounding.

Answer

Configure the API as an OpenAPI tool and supply a long-lived Entra ID access token as a connection string in the agent's tool definition.