AI-103: Developing AI Apps and Agents on Azure

By Microsoft · Question Mode

QuestionQ64

VerifiedImplement generative AI and agentic solutions

You have a Microsoft Foundry project containing an agent.

The agent uses tools to retrieve internal content and call external APIs, and it is currently configured to let the model decide when to invoke those tools.

You need to publish the agent for a compliance workflow that meets these requirements:

  • Every workflow run must perform a retrieval step before a response is generated.
  • Tool calls must authenticate using the published agent's own identity.
  • Tool access must use an identity that is isolated from other project resources.
  • Tool access must support audit tracing.

What should you configure?

Select
Set tool_choice to:
Configure the tool to authenticate by:
Explanation

Setting tool_choice to required forces the model to invoke a tool on every run instead of leaving that decision to the model, guaranteeing the retrieval step happens before a response is generated; auto lets the model skip tool calls entirely and none disables tool use. Configuring the tool to authenticate using a distinct agent identity bound to the client application gives the published agent its own dedicated Microsoft Entra ID identity, which is isolated from other resources in the project and whose calls can be individually audit-traced; storing API keys in prompts is an insecure anti-pattern and a shared project agent identity is not isolated to the published agent.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!