Agent Identity And Skills

Download a blob (CSV, JSON, or any file) from Azure Blob Storage using the caller's (agent's) managed identity via AAD — no account key or SAS. Use when an agent needs to read input data a user placed in their own blob container, including from inside a managed harness or sandbox where DefaultAzureCredential resolves to the agent identity. Requires the identity to hold the 'Storage Blob Data Reader' role on the container or account.

Fetch the user's financial profile (risk tolerance, investable cash, horizon, goals, current holdings, constraints) from the profile API while keeping the API credential secret. Use when an investment or planning agent needs the user's financial profile before producing analysis or a plan. Composes a Key Vault read (agent identity) with a profile-API call so the credential never enters the model context. Returns only the profile JSON.

Read a named secret from Azure Key Vault using the caller's (agent's) managed identity, without ever placing the secret value in a prompt or tool argument. Use when an agent needs a credential, API key, connection string, or `sig` held in Key Vault — including from inside a managed harness or sandbox where DefaultAzureCredential resolves to the agent identity. Requires the identity to hold the 'Key Vault Secrets User' role on the vault.

List, upload, download, get, and delete files in an Azure AI Foundry project via its data-plane Files API. Use when an agent needs to manage project files (list files, upload a file, download file content, get file metadata, delete a file) against a project endpoint such as an ai.azure.com services projects URL, including from inside a managed harness or sandbox.