AI-103: Developing AI Apps and Agents on Azure

By Microsoft · Question Mode

QuestionQ101

VerifiedImplement generative AI and agentic solutions

You are creating a Microsoft Foundry project named Project1 that will contain an agent and use an Azure key vault named KV1. You need to configure a connection from Project1 to KV1. How should you complete the Bicep code?

Question Image

Select
resource existingKeyVault 'Microsoft.KeyVault/vaults@2024-11-01' existing = {
    name: 'KV1'
    scope: resourceGroup()
}
resource connection 'Microsoft.CognitiveSevices/accounts/connections@2025-04-01-preview' ={
    name: '${aiFoundryName}-keyvault'
    parent: aiFoundry
    properties: {
        category: 
        target: existingKeyVault.id
        authType: 
        isSharedToAll:
        metadata: {
            ApiType: 'Azure'
            ResourceId: existingKeyVault.id
            location: existingKeyVault.location
        }
    }
}
Explanation

To connect a Microsoft Foundry (Azure AI Foundry) resource or project to a customer-owned Azure Key Vault using Bicep, the Microsoft.CognitiveServices/accounts/connections resource must specify category: 'AzureKeyVault', which tells Foundry this connection targets a Key Vault rather than an AI service or Azure OpenAI resource. The authType must be set to 'AccountManagedIdentity' so that the Foundry resource authenticates to the Key Vault using its managed identity instead of a stored key or API key; the managed identity is then granted an RBAC role (for example, Key Vault Secrets Officer) on the vault so Foundry can read and write secrets. This is the exact pattern documented by Microsoft for bringing your own Key Vault to a Foundry resource, and it also aligns with the best practice of using Microsoft Entra ID–based (managed identity) authentication rather than key-based authentication for Key Vault access.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!