foundry-cross-resource

What problem does it solve?

It enables a Foundry project to invoke AI models deployed in a different Azure OpenAI / AI Services account by routing calls through an Azure API Management (APIM) AI Gateway, without sharing backend API keys.

Core Features & Use Cases

• Cross-resource invocation via APIM: Calls models on a backend account using the Foundry-native model string format connectionName/deploymentName.
• Dual authentication options: Supports APIM gateway authentication using either ApiKey or ProjectManagedIdentity (PMI) paths.
• APIM inbound policy wiring: Provides the exact policy approach for set-backend-service plus managed-identity token exchange and Authorization header injection, including required metadata quirks.

Quick Start

Configure your APIM API to forward Foundry requests to the backend model endpoint, then create a Foundry ApiManagement connection whose metadata uses JSON-stringified models and the correct deploymentInPath value, and finally call the model using model="yourConnection/yourDeployment" with the Responses API.