Question

Your team deploys a foundation model to a serverless API endpoint in an Azure AI Foundry project. A downstream App Service must call this endpoint. Security policy prohibits storing any long-lived secrets or API keys in application configuration, and all access must be auditable through Microsoft Entra ID. What is the recommended way to configure authentication between the App Service and the Foundry endpoint?

Accepted Answer

Enable a system-assigned managed identity on the App Service, grant it the appropriate Azure RBAC role on the Foundry resource, and authenticate using Microsoft Entra tokens.

Answer

Retrieve the endpoint's primary key and store it in the App Service application settings, rotating it manually every 90 days.

Answer

Store the endpoint API key in Azure Key Vault and reference it from App Service using a Key Vault reference in application settings.

Answer

Configure the App Service to use a shared access signature (SAS) token generated from the Foundry project storage account.