Microsoft Foundry Skill
MANDATORY: Read this skill and the relevant sub-skill BEFORE calling any Foundry MCP tool.
Sub-Skills
| Sub-Skill |
When to Use |
Reference |
| deploy |
Containerize, build, push to ACR, create/update/start/stop/clone agent deployments |
deploy |
| invoke |
Send messages to an agent, single or multi-turn conversations |
invoke |
| observe |
Eval-driven optimization loop: evaluate → analyze → optimize → compare → iterate |
observe |
| trace |
Query traces, analyze latency/failures, correlate eval results to specific responses via App Insights customEvents |
trace |
| troubleshoot |
View container logs, query telemetry, diagnose failures |
troubleshoot |
| create |
Create new hosted agent applications. Supports Microsoft Agent Framework, LangGraph, or custom frameworks in Python or C#. Downloads starter samples from foundry-samples repo. |
create |
| eval-datasets |
Harvest production traces into evaluation datasets, manage dataset versions and splits, track evaluation metrics over time, detect regressions, and maintain full lineage from trace to deployment. Use for: create dataset from traces, dataset versioning, evaluation trending, regression detection, dataset comparison, eval lineage. |
eval-datasets |
| project/create |
Creating a new Azure AI Foundry project for hosting agents and models. Use when onboarding to Foundry or setting up new infrastructure. |
project/create/create-foundry-project.md |
| resource/create |
Creating Azure AI Services multi-service resource (Foundry resource) using Azure CLI. Use when manually provisioning AI Services resources with granular control. |
resource/create/create-foundry-resource.md |
| models/deploy-model |
Unified model deployment with intelligent routing. Handles quick preset deployments, fully customized deployments (version/SKU/capacity/RAI), and capacity discovery across regions. Routes to sub-skills: preset (quick deploy), customize (full control), capacity (find availability). |
models/deploy-model/SKILL.md |
| quota |
Managing quotas and capacity for Microsoft Foundry resources. Use when checking quota usage, troubleshooting deployment failures due to insufficient quota, requesting quota increases, or planning capacity. |
quota/quota.md |
| rbac |
Managing RBAC permissions, role assignments, managed identities, and service principals for Microsoft Foundry resources. Use for access control, auditing permissions, and CI/CD setup. |
rbac/rbac.md |
| faos-optimize |
Optimize agent configuration for FAOS eval sweeps: externalize instructions, model, and temperature for evaluator-driven tuning. Required for RAG accuracy improvement loops (WAF Reliability). |
faos-optimize |
| resource/private-network |
Deploy Foundry with VNet isolation: BYO VNet, Managed VNet, and hybrid topologies with private endpoints for AI Services, AI Search, Cosmos DB, and Storage. |
private-network-standard-agent-setup |
Onboarding flow: project/create → deploy → invoke
Agent Lifecycle
| Intent |
Workflow |
| New agent from scratch |
create → deploy → invoke |
| Deploy existing code |
deploy → invoke |
| Test/chat with agent |
invoke |
| Troubleshoot |
invoke → troubleshoot |
| Fix + redeploy |
troubleshoot → fix → deploy → invoke |
Project Context Resolution
Resolve only missing values. Extract from user message first, then azd, then ask.
- Check for
azure.yaml; if found, run azd env get-values
- Map azd variables:
| azd Variable |
Resolves To |
AZURE_AI_PROJECT_ENDPOINT / AZURE_AIPROJECT_ENDPOINT |
Project endpoint |
AZURE_CONTAINER_REGISTRY_NAME / AZURE_CONTAINER_REGISTRY_ENDPOINT |
ACR registry |
AZURE_SUBSCRIPTION_ID |
Subscription |
- Ask user only for unresolved values (project endpoint, agent name)
Validation
After each workflow step, validate before proceeding:
- Run the operation
- Check output for errors or unexpected results
- If failed → diagnose using troubleshoot sub-skill → fix → retry
- Only proceed to next step when validation passes
Agent Types
| Type |
Kind |
Description |
| Prompt |
"prompt" |
LLM-based, backed by model deployment |
| Hosted |
"hosted" |
Container-based, running custom code |
[!CAUTION]
Deprecated resource type: The Azure AI Foundry Hub (kind: Hub,
Microsoft.MachineLearningServices/workspaces) was deprecated in 2025.
Do not generate it. The current pattern is:
- Resource:
Microsoft.CognitiveServices/accounts with kind: AIServices
- Project: Microsoft Foundry Project linked to the AI Services resource
If existing IaC uses kind: Hub, replace it before deploying.
Agent: Setup Types
| Setup |
Capability Host |
Description |
| Basic |
None |
Default. All resources Microsoft-managed. |
| Standard |
Azure AI Services |
Bring-your-own storage and search (public network). See standard-agent-setup. |
| Standard + Private Network |
Azure AI Services |
Standard setup with VNet isolation and private endpoints. See private-network-standard-agent-setup. |
MANDATORY: For standard setup, read the appropriate reference before proceeding:
- Public network: references/standard-agent-setup.md
- Private network (VNet isolation): references/private-network-standard-agent-setup.md
Tool Usage Conventions
- Use the
ask_user or askQuestions tool whenever collecting information from the user
- Use the
task or runSubagent tool to delegate long-running or independent sub-tasks (e.g., env var scanning, status polling, Dockerfile generation)
- Prefer Azure MCP tools over direct CLI commands when available
- Reference official Microsoft documentation URLs instead of embedding CLI command syntax
References
Dependencies
Scripts in sub-skills require: Azure CLI (az) ≥2.0, jq (for shell scripts). Install via pip install azure-ai-projects azure-identity for Python SDK usage.
Reference Index
Load these on demand — do NOT read all at once:
| Reference |
When to Load |
references/auth-best-practices.md |
Auth Best Practices |
references/private-network-standard-agent-setup.md |
Private Network Standard Agent Setup |
references/standard-agent-setup.md |
Standard Agent Setup |
foundry-agent/faos-optimize/faos-optimize.md |
FAOS Optimization (eval-driven tuning) |
Source: rodanthi-alexiou/sdc-infraops-hack — distributed by TomeVault.
1---2name: rodanthi-alexiou-sdc-infraops-hack-microsoft-foundry3description: Microsoft Foundry Skill4---56# Microsoft Foundry Skill78> **MANDATORY:** Read this skill and the relevant sub-skill BEFORE calling any Foundry MCP tool.910## Sub-Skills1112| Sub-Skill | When to Use | Reference |13| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |14| **deploy** | Containerize, build, push to ACR, create/update/start/stop/clone agent deployments | [deploy](foundry-agent/deploy/deploy.md) |15| **invoke** | Send messages to an agent, single or multi-turn conversations | [invoke](foundry-agent/invoke/invoke.md) |16| **observe** | Eval-driven optimization loop: evaluate → analyze → optimize → compare → iterate | [observe](foundry-agent/observe/observe.md) |17| **trace** | Query traces, analyze latency/failures, correlate eval results to specific responses via App Insights `customEvents` | [trace](foundry-agent/trace/trace.md) |18| **troubleshoot** | View container logs, query telemetry, diagnose failures | [troubleshoot](foundry-agent/troubleshoot/troubleshoot.md) |19| **create** | Create new hosted agent applications. Supports Microsoft Agent Framework, LangGraph, or custom frameworks in Python or C#. Downloads starter samples from foundry-samples repo. | [create](foundry-agent/create/create.md) |20| **eval-datasets** | Harvest production traces into evaluation datasets, manage dataset versions and splits, track evaluation metrics over time, detect regressions, and maintain full lineage from trace to deployment. Use for: create dataset from traces, dataset versioning, evaluation trending, regression detection, dataset comparison, eval lineage. | [eval-datasets](foundry-agent/eval-datasets/eval-datasets.md) |21| **project/create** | Creating a new Azure AI Foundry project for hosting agents and models. Use when onboarding to Foundry or setting up new infrastructure. | [project/create/create-foundry-project.md](project/create/create-foundry-project.md) |22| **resource/create** | Creating Azure AI Services multi-service resource (Foundry resource) using Azure CLI. Use when manually provisioning AI Services resources with granular control. | [resource/create/create-foundry-resource.md](resource/create/create-foundry-resource.md) |23| **models/deploy-model** | Unified model deployment with intelligent routing. Handles quick preset deployments, fully customized deployments (version/SKU/capacity/RAI), and capacity discovery across regions. Routes to sub-skills: `preset` (quick deploy), `customize` (full control), `capacity` (find availability). | [models/deploy-model/SKILL.md](models/deploy-model/SKILL.md) |24| **quota** | Managing quotas and capacity for Microsoft Foundry resources. Use when checking quota usage, troubleshooting deployment failures due to insufficient quota, requesting quota increases, or planning capacity. | [quota/quota.md](quota/quota.md) |25| **rbac** | Managing RBAC permissions, role assignments, managed identities, and service principals for Microsoft Foundry resources. Use for access control, auditing permissions, and CI/CD setup. | [rbac/rbac.md](rbac/rbac.md) |26| **faos-optimize** | Optimize agent configuration for FAOS eval sweeps: externalize instructions, model, and temperature for evaluator-driven tuning. Required for RAG accuracy improvement loops (WAF Reliability). | [faos-optimize](foundry-agent/faos-optimize/faos-optimize.md) |27| **resource/private-network** | Deploy Foundry with VNet isolation: BYO VNet, Managed VNet, and hybrid topologies with private endpoints for AI Services, AI Search, Cosmos DB, and Storage. | [private-network-standard-agent-setup](references/private-network-standard-agent-setup.md) |2829Onboarding flow: `project/create` → `deploy` → `invoke`3031## Agent Lifecycle3233| Intent | Workflow |34| ---------------------- | ------------------------------------ |35| New agent from scratch | create → deploy → invoke |36| Deploy existing code | deploy → invoke |37| Test/chat with agent | invoke |38| Troubleshoot | invoke → troubleshoot |39| Fix + redeploy | troubleshoot → fix → deploy → invoke |4041## Project Context Resolution4243Resolve only missing values. Extract from user message first, then azd, then ask.44451. Check for `azure.yaml`; if found, run `azd env get-values`462. Map azd variables:4748| azd Variable | Resolves To |49| --------------------------------------------------------------------- | ---------------- |50| `AZURE_AI_PROJECT_ENDPOINT` / `AZURE_AIPROJECT_ENDPOINT` | Project endpoint |51| `AZURE_CONTAINER_REGISTRY_NAME` / `AZURE_CONTAINER_REGISTRY_ENDPOINT` | ACR registry |52| `AZURE_SUBSCRIPTION_ID` | Subscription |53543. Ask user only for unresolved values (project endpoint, agent name)5556## Validation5758After each workflow step, validate before proceeding:59601. Run the operation612. Check output for errors or unexpected results623. If failed → diagnose using troubleshoot sub-skill → fix → retry634. Only proceed to next step when validation passes6465## Agent Types6667| Type | Kind | Description |68| ---------- | ---------- | ------------------------------------- |69| **Prompt** | `"prompt"` | LLM-based, backed by model deployment |70| **Hosted** | `"hosted"` | Container-based, running custom code |7172> [!CAUTION]73> **Deprecated resource type:** The Azure AI Foundry Hub (`kind: Hub`,74> `Microsoft.MachineLearningServices/workspaces`) was deprecated in 2025.75> Do **not** generate it. The current pattern is:76>77> - **Resource:** `Microsoft.CognitiveServices/accounts` with `kind: AIServices`78> - **Project:** Microsoft Foundry Project linked to the AI Services resource79>80> If existing IaC uses `kind: Hub`, replace it before deploying.8182## Agent: Setup Types8384| Setup | Capability Host | Description |85| ------------------------------ | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |86| **Basic** | None | Default. All resources Microsoft-managed. |87| **Standard** | Azure AI Services | Bring-your-own storage and search (public network). See [standard-agent-setup](references/standard-agent-setup.md). |88| **Standard + Private Network** | Azure AI Services | Standard setup with VNet isolation and private endpoints. See [private-network-standard-agent-setup](references/private-network-standard-agent-setup.md). |8990> **MANDATORY:** For standard setup, read the appropriate reference before proceeding:91>92> - **Public network:** [references/standard-agent-setup.md](references/standard-agent-setup.md)93> - **Private network (VNet isolation):** [references/private-network-standard-agent-setup.md](references/private-network-standard-agent-setup.md)9495## Tool Usage Conventions9697- Use the `ask_user` or `askQuestions` tool whenever collecting information from the user98- Use the `task` or `runSubagent` tool to delegate long-running or independent sub-tasks (e.g., env var scanning, status polling, Dockerfile generation)99- Prefer Azure MCP tools over direct CLI commands when available100- Reference official Microsoft documentation URLs instead of embedding CLI command syntax101102## References103104- [Hosted Agents](https://learn.microsoft.com/azure/ai-foundry/agents/concepts/hosted-agents?view=foundry)105- [Runtime Components](https://learn.microsoft.com/azure/ai-foundry/agents/concepts/runtime-components?view=foundry)106- [Foundry Samples](https://github.com/azure-ai-foundry/foundry-samples)107- [Python SDK](references/sdk/foundry-sdk-py.md)108109## Dependencies110111Scripts in sub-skills require: Azure CLI (`az`) ≥2.0, `jq` (for shell scripts). Install via `pip install azure-ai-projects azure-identity` for Python SDK usage.112113## Reference Index114115Load these on demand — do NOT read all at once:116117| Reference | When to Load |118| ---------------------------------------------------- | -------------------------------------- |119| `references/auth-best-practices.md` | Auth Best Practices |120| `references/private-network-standard-agent-setup.md` | Private Network Standard Agent Setup |121| `references/standard-agent-setup.md` | Standard Agent Setup |122| `foundry-agent/faos-optimize/faos-optimize.md` | FAOS Optimization (eval-driven tuning) |123124---125> Source: [rodanthi-alexiou/sdc-infraops-hack](https://github.com/rodanthi-alexiou/sdc-infraops-hack) — distributed by [TomeVault](https://tomevault.io).126<!-- tomevault:4.0:skill_md:2026-06-15 -->
tomevault-io