Question

Your team deploys a chat application in Azure AI Foundry that uses a serverless API endpoint for a GPT model. The application must retrieve grounding documents from an Azure Blob Storage account. Security policy forbids storing account keys or connection strings anywhere in the application or in Foundry connections. You need to allow the Foundry project to read the storage account securely. What should you do?

Accepted Answer

Enable the Foundry project's system-assigned managed identity and assign it the Storage Blob Data Reader role on the storage account.

Answer

Create a Foundry connection to the storage account using a shared access signature (SAS) token scoped to read-only access.

Answer

Store the storage account key in Azure Key Vault and reference it from the serverless endpoint's environment variables.

Answer

Configure the storage account firewall to allow all traffic from the Foundry project's public IP range.