> ## Documentation Index
> Fetch the complete documentation index at: https://docs.validio.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Foundry

> Configure a Microsoft Foundry credential in Validio to leverage models deployed on Azure AI Foundry for validator recommendations and generating SQL queries in custom validators and filters.

Microsoft Foundry (Azure AI Foundry) hosts models from several families, including OpenAI GPT and Anthropic Claude, as deployments on an Azure resource. By adding a Microsoft Foundry credential to Validio, you can leverage these capabilities to generate validator recommendations for monitoring and SQL queries for custom validation and filtering.

**Use this credential for Azure OpenAI as well.** There is no separate Azure OpenAI credential type in Validio: a Microsoft Foundry credential accepts an Azure OpenAI endpoint (`https://my-resource.openai.azure.com`) in place of a Foundry one, and works the same way. Foundry's OpenAI-compatible API serves the same GPT models, so one credential type covers both kinds of resource.

![The Microsoft Foundry credential configuration form, showing endpoint, authentication type, and model deployment fields](https://mintcdn.com/validio/h4NQPs1kJwlpB1Yj/images/docs/integrations/microsoft-foundry-credential-form.png?fit=max\&auto=format\&n=h4NQPs1kJwlpB1Yj\&q=85\&s=b21dc38eebfb301633a19392decd7546)

Configuration for Microsoft Foundry credential

## Prerequisites

Before setting up your Microsoft Foundry credential, ensure you have:

* Enabled the **Allow LLM credentials** setting in your Validio Workspace. See [Managing Workspace Settings](https://docs.validio.io/v11.1/docs/access-and-settings/settings/workspace-settings.md).
* Appropriate permissions to create credentials (requires `credentials:WRITE` permissions for the Namespace). See [Managing Roles](https://docs.validio.io/v11.1/docs/access-and-settings/settings/managing-roles.md).
* A Microsoft Foundry or Azure OpenAI resource with at least one model deployment.
* The endpoint of that resource, which you can copy from **Keys and Endpoint** in the Azure portal. For example, `https://my-resource.services.ai.azure.com` for a Foundry resource, or `https://my-resource.openai.azure.com` for an Azure OpenAI resource.
* One of the following authentication options:
  * An API key for the resource, found under **Keys and Endpoint** in the Azure portal.
  * A Microsoft Entra ID app registration (service principal) with a client secret, granted the role below on the resource. You need its tenant ID, client ID, and client secret. Refer to [Register an application with Microsoft Entra ID](https://learn.microsoft.com/entra/identity-platform/quickstart-register-app) in Microsoft documentation.

### Entra ID role assignment

Validio authenticates as a service principal and calls the resource's inference API, so the app registration needs a role that grants data-plane inference access at the scope of the resource. Which role that is depends on the resource:

| Resource | Role |
| :- | :- |
| Microsoft Foundry | **Cognitive Services User** |
| Azure OpenAI | **Cognitive Services OpenAI User** |

Both roles also grant read access to the resource's model deployments, which is what lets Validio list them in the credential form. Assign the role at the scope of the resource itself, not the subscription or resource group, and allow up to five minutes for the assignment to propagate.

Refer to [Configure keyless authentication with Microsoft Entra ID](https://learn.microsoft.com/azure/foundry/foundry-models/how-to/configure-entra-id) for the Foundry role, including the Azure CLI commands to create the service principal and assign the role, and [Role-based access control for Azure OpenAI](https://learn.microsoft.com/azure/ai-foundry/openai/how-to/role-based-access-control) for the Azure OpenAI role.

> [!NOTE]
>
> If your resource serves the model through a **managed compute** deployment rather than a standard pay-per-token or provisioned deployment, Microsoft requires the **Foundry User** role (previously named Azure AI User) at the Foundry account scope for inference instead. Refer to [Role-based access control for Microsoft Foundry](https://learn.microsoft.com/azure/foundry/concepts/rbac-foundry).

## Add a Microsoft Foundry credential

> [!NOTE]
>
> Because each Microsoft Foundry credential is tied to one model deployment, you should add a Microsoft Foundry credential for each deployment you want to use in Validio.

To add a Microsoft Foundry credential,

1. Navigate to **Credentials** and click **+ New credential**.

2. **Namespace**: Select the namespace where the resources will be created.

3. **Credential Type**: Select **Microsoft Foundry** from the dropdown.

4. **Configuration**: Complete the required parameters.

   | Parameter | Description |
   | :- | :- |
   | Name | A unique identifier for this credential. |
   | Endpoint | The endpoint of your Microsoft Foundry or Azure OpenAI resource, including `https://`. For example, `https://my-resource.services.ai.azure.com` or `https://my-resource.openai.azure.com`. Below the field, Validio reports whether the host is recognized as a Microsoft Foundry endpoint, an Azure OpenAI endpoint, or a custom endpoint. |
   | Authentication type | Select **API Key** or **Entra ID**. The fields shown below depend on the selected authentication type. |
   | API key | (API Key authentication) A key for the resource, from **Keys and Endpoint** in the Azure portal. |
   | Tenant ID | (Entra ID authentication) The Azure tenant ID that the app registration belongs to. |
   | Client ID | (Entra ID authentication) The application (client) ID of the app registration. |
   | Client secret | (Entra ID authentication) A client secret for the app registration. |
   | Model | The name of the model deployment on the resource. Once the endpoint and authentication details are filled in, Validio lists the deployments it finds and shows each one with the model it was created from, such as `my-deployment (gpt-5.5)`. Select one, or type the deployment name if it is not in the list. |

   > [!NOTE]
   >
   > **Choosing an authentication type**
   >
   > * **API Key** authenticates with a key issued for the resource, and is the quickest option to set up.
   > * **Entra ID** authenticates as a service principal, using the tenant ID, client ID, and client secret of an app registration. Use this option when your organization disables key-based access or requires resource access to be granted through Azure role assignments.

   > [!NOTE]
   >
   > **About model deployments**
   >
   > A deployment name is chosen when the deployment is created in Azure and does not have to match the model behind it, which is why Validio shows both. The model determines which of the resource's two APIs serves the deployment: `gpt-*` deployments are served by the OpenAI-compatible API, and `claude-*` deployments by the Anthropic Messages API. Selecting a deployment from the list records the endpoint of the matching API, so no further configuration is needed.
   >
   > If the deployments cannot be listed, because the resource returns an error or the deployment was created moments ago, type the deployment name instead. The message below the field explains what went wrong.

   > [!NOTE]
   >
   > **Custom endpoints and proxies**
   >
   > The endpoint is used exactly as entered, so a proxy, an API Management gateway, or a sovereign cloud host works as well. Because Validio cannot recognize such a host, include the API path in the endpoint: `/openai/v1` for GPT-family deployments and `/anthropic/v1` for Claude deployments. Without a path, Validio infers the API from the deployment name, which only holds if that name mentions the model family.

5. (Optional) Click **Test credential** to validate that Validio can successfully connect to Microsoft Foundry using your configuration. If the test fails, verify your endpoint, authentication details, and that the deployment name matches a deployment on the resource.

6. Click **Create credential** to save your configuration.

## Next steps

With your Microsoft Foundry credential configured, you can leverage the deployed model across various Validio features:

* **[Custom SQL validators](https://docs.validio.io/v11.1/docs/validators/validator-types/custom-sql.md)**: Generate complex validation queries or fix errors in your SQL queries.
* **[SQL filters](https://docs.validio.io/v11.1/docs/filters/filter-types.md#sql-filter)**: Create sophisticated filtering conditions and data selection criteria.
* **[Validator recommendations](https://docs.validio.io/v11.1/docs/ai-features/validator-recommendations.md)**: Profile your data and generate recommendations to quickly set up monitoring.