Implement generative AI and agentic solutions 2.1 Build generative applications by using Foundry
A prompt agent uses an OpenAPI tool to call an internal API that authenticates callers…
Study guide skill: Integrate generative workflows into applications by using Foundry SDKs and connectors
Question B4-019
A prompt agent uses an OpenAPI tool to call an internal API that authenticates callers with Microsoft Entra ID. The tool is configured for managed identity authentication, but every call returns 401 Unauthorized. What should you fix?
Select one answer.
Answer: A
With managed identity auth, the Foundry project's managed identity calls the API on behalf of the agent, so it needs the least-privileged RBAC role that permits the required operations on the target service; without it, the agent gets 401 Unauthorized. Credentials don't belong in the OpenAPI specification, and anonymous auth doesn't fit an Entra-protected API. FOUNDRY_PROJECT_ENDPOINT is the Foundry project endpoint, not the external API endpoint.
Deep dive
How it works
A Foundry OpenAPI tool lets an agent call a REST API described by an OpenAPI spec. You pick an auth.type that matches the API's security model: anonymous, a project connection (API key or bearer token), or managed identity (Microsoft Entra ID).
With managed identity, the Foundry project's managed identity calls the API on the agent's behalf. That identity needs permission on the target service, and the page puts it in an Important note: assign only the least-privileged RBAC role that permits the required API operations to the Foundry project's managed identity on the target service. Without that assignment, the agent gets 401 Unauthorized, which is the symptom here.
So the fix is a role assignment on the internal API's side (for example, Reader on an Azure resource when the API only needs read-only Resource Manager access), scoped to the operations in your spec.
The other options, and when you'd use them
- A bearer token in the spec's security section: Avoid putting secrets in an OpenAPI spec file or source code. Bearer tokens belong in a project connection, and this tool is meant to use managed identity anyway.
- FOUNDRY_PROJECT_ENDPOINT set to the API URL: That variable is your Foundry project endpoint, not the external OpenAPI service endpoint.
- Anonymous authentication: Auth must match the API's security model, and this API requires Entra ID.
Exam tip
OpenAPI tool + managed identity + 401 = give the project's managed identity a least-privileged role on the target service.
References
Last reviewed: