foundry-cross-resource

Azure Foundry supports cross-resource model invocation by routing requests through an API Management AI Gateway. You can call models deployed in a separate Azure OpenAI or AI Services account using the connectionName/deploymentName model string format with the Responses API.

The correct APIM inbound policy requires set-backend-service to target the backend model endpoint and a managed identity token exchange to inject the Authorization header. This policy wiring ensures the gateway authenticates correctly before forwarding the Foundry request.

Yes, Foundry supports dual authentication paths for APIM gateway routing: ApiKey or ProjectManagedIdentity (PMI). Using PMI avoids sharing backend keys by exchanging a managed identity token for an Authorization header within the APIM inbound policy.

Configure the Foundry ApiManagement connection metadata by JSON-stringifying the models and modelDiscovery fields, and setting the correct deploymentInPath and inferenceAPIVersion values. This ensures the runtime resolves the gateway alias correctly during cross-resource inference.

Cross-resource model invocation through APIM requires using the Responses API. The Responses API is necessary so the Foundry runtime correctly resolves the gateway alias defined in your JSON-stringified connection metadata model string.

Yes, Foundry enables cross-resource inference without exposing backend keys by routing through an APIM AI Gateway. The gateway uses either ApiKey or ProjectManagedIdentity authentication to securely access models deployed in a different Azure OpenAI account.