Implement generative AI and agentic solutions 2.1 Build generative applications by using Foundry
A Python app uses the AzureOpenAI client and has to be updated whenever a new dated…
Study guide skill: Integrate generative workflows into applications by using Foundry SDKs and connectors
Question B3-009
A Python app uses the AzureOpenAI client and has to be updated whenever a new dated api-version ships. You want to switch to the standard OpenAI() client, stop managing api-version values, and keep keyless Microsoft Entra ID authentication with automatic token refresh. How should you create the client?
Select one answer.
Answer: A
With the v1 Azure OpenAI API, you use the OpenAI() client, append /openai/v1/ to the endpoint as base_url, and no longer need an api-version parameter. For keyless auth, you pass a bearer token provider from DefaultAzureCredential as api_key, and the client retrieves and refreshes tokens automatically. The other options keep dated API versions or keys, and the v1 API explicitly supports token-based authentication in the OpenAI client.
Deep dive
How it works
The v1 Azure OpenAI API (opt-in since August 2025) lets you use the standard OpenAI() client against Azure, with no dated api-version to maintain. Three pieces make up the client:
- base_url: your resource endpoint plus /openai/v1/, for example https://YOUR-RESOURCE-NAME.openai.azure.com/openai/v1/.
- No api-version: you get ongoing access to new features with no need to specify a new api-version each month.
- Keyless auth: build a token provider with get_bearer_token_provider(DefaultAzureCredential(), "https://ai.azure.com/.default") and pass it as api_key.
That last point is the one people miss. The v1 API adds OpenAI client support for token-based authentication and automatic token refresh, without a separate Azure OpenAI client. The token provider goes in the api_key slot, and the client fetches and refreshes Entra tokens as needed.
Then call client.responses.create or client.chat.completions.create as usual, with your deployment name as the model.
The other options, and when you'd use them
- OpenAI() with an API key because it can't use Entra tokens: False premise. The v1 API explicitly adds OpenAI client support for token-based authentication.
- Base endpoint + key + api-version on every call: It keeps keys and dated versions, the two things you're removing. The v1 API removes the need for dated api-version parameters.
- Keep AzureOpenAI() and update api_version monthly: That's the overhead v1 eliminates, with no need to specify new api-versions each month.
Exam tip
v1 API = OpenAI(base_url=".../openai/v1/", api_key=get_bearer_token_provider(DefaultAzureCredential(), "https://ai.azure.com/.default")). No api-version.
References
Last reviewed: