Implement generative AI and agentic solutions 2.1 Build generative applications by using Foundry

You add the Azure DevOps MCP Server to a Foundry agent from the Add Tools catalog.

Study guide skill: Integrate generative workflows into applications by using Foundry SDKs and connectors

Question B8-018

You add the Azure DevOps MCP Server to a Foundry agent from the Add Tools catalog. The agent should be able to use only a few read-only work-item tools, not every tool the server exposes. What should you do?

Select one answer.

  • A Set require_approval to always for every tool, which limits the agent to approved tools
  • B Put an Azure DevOps personal access token in the agent instructions and tell the model which tools to avoid
  • C Select only those tools in the catalog's tool selection, which is equivalent to specifying an allowed_tools list in code ✓ Correct answer
  • D Connect the organization with a broadly privileged account so that the selected tools always work

Answer: C

For catalog MCP servers, selecting a subset of tools in the catalog UI is equivalent to an allowed_tools list, which is the recommended allow list. Requiring approval adds human review for high-risk operations but doesn't restrict which tools the agent can see. The guidance also asks for least-privilege access when connecting the organization and says not to put credentials in prompts.

Deep dive

How it works

The Azure DevOps MCP Server is available as a catalog entry in Foundry's Add Tools catalog. Azure DevOps hosts the remote MCP endpoint, so you don't install or host anything, and the catalog setup creates the MCP tool without code changes.

To limit which tools the agent can use, select only those tools in the catalog. Microsoft states that selecting a subset of tools in the catalog UI is equivalent to specifying an allowed_tools list in code, and for Azure DevOps the tool selection configuration maps to the allowed_tools behavior. An allow list via allowed_tools is the first MCP best practice on the page.

Two related practices: use least-privilege access and review scopes when connecting the organization, and don't include keys, tokens or other credentials in prompts.

The other options, and when you'd use them

  • require_approval always for every tool: Approval is for high-risk operations: a person approves each call. It adds review but doesn't restrict the tool list. The allow list does that.
  • PAT in the instructions + "avoid these tools": Credentials don't belong in prompts, and an instruction isn't an allow list.
  • Broadly privileged account: The guidance is least-privilege access when connecting the organization.

Exam tip

Catalog MCP server, only some tools = select them in the catalog (= allowed_tools). Approval = human review per call, not a filter.

References

Last reviewed:

Ready to test yourself? The quiz asks this and every other AI-103 question, with instant feedback. Practice this in a quiz →

All Generative AI & agents questions · AI-103 study guide

Thanks for your feedback!