Connecting Azure AI Foundry Tool to Project Connection

AI-103 By islever Editorial Last updated

Build agents by using Foundry

Short answer

D Connect the tool to Connection1 to allow Foundry to automatically inject the stored API key into requests.

Question

You have a Microsoft Foundry project named Project1 that contains the following:
An OpenAPI tool that calls an external API
A project connection named Connection1 that stores the API key of the external API
When an agent calls the OpenAPI tool, the API returns a 401 unauthorized error, and traces show that the API key header is NOT being sent.
You need to ensure that the OpenAPI tool automatically includes the API key from Connection1 on all requests.
What should you do?
  1. Enable identity passthrough so that the tool uses the Microsoft Entra token of the caller.
  2. Add the API key header manually to the OpenAPI specification.
  3. Configure the tool to use the default connection of Project1.
  4. Connect the tool to Connection1. Correct Answer

Key Takeaways

Tools must be explicitly bound to connections to securely pass authentication credentials; manual injection or default settings are insufficient.

Learn how to resolve 401 errors in Azure AI Foundry by connecting an OpenAPI tool to a project connection to automatically inject API keys.

Common mistake: Manually adding the API key header to the OpenAPI spec (Option B) is wrong because it hardcodes secrets, exposing them and preventing secure management.

Expert Analysis

The scenario describes a Microsoft Foundry agent attempting to call an external API via an OpenAPI tool but receiving a 401 error because the API key header is missing. The core issue is that the tool is not authenticated with the credentials stored in Connection1. In Azure AI Foundry, tools must be explicitly bound to a project connection to securely inject authentication headers.

Option D is correct because connecting the tool to Connection1 allows Foundry to automatically retrieve the API key and inject it into the request headers defined in the OpenAPI specification. This follows the principle of least privilege and secure credential management, avoiding hardcoding secrets.

Option A is incorrect because identity passthrough uses Microsoft Entra tokens for authentication, which is irrelevant when the external API requires a specific API key stored in Connection1. Option B is incorrect because manually adding the header to the OpenAPI spec hardcodes the secret, violating security best practices and preventing dynamic secret rotation. Option C is incorrect because using the default connection does not guarantee that Connection1 is used; explicit binding is required to ensure the correct credentials are applied. Community comments confirm that binding the tool to the specific connection resolves the 401 error by ensuring the key is sent.

Exam Strategy

When troubleshooting agent tool failures, check if the tool is bound to the correct connection. If authentication fails, verify that the tool's configuration points to the specific connection holding the necessary credentials rather than assuming defaults or manual overrides.

Frequently Asked Questions

Why does identity passthrough not work for API key authentication?

Identity passthrough uses Microsoft Entra tokens, which are suitable for Azure services. It cannot provide a custom API key required by external APIs.

Can I hardcode the API key in the OpenAPI spec?

No. Hardcoding secrets violates security best practices. Use project connections to manage and inject credentials securely.

More AI-103 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. RICHARDALEX007 👍 4 Answered D
    The 401 with a missing key header means the tool is not bound to the connection holding the key. Connecting the tool to Connection1 makes Foundry inject the stored key automatically. Identity passthrough (A) sends the caller's Entra token, not the API key; manually adding the header (B) hardcodes secrets; the default project connection (C) is not necessarily Connection1.
  2. 8ac3742 👍 2 Answered D
    ​Bind to the Connection: ​In the tool configuration blade, scroll to the Authentication section. ​Switch the authentication method/source to Project Connection (or Saved Connection). ​From the dropdown list of available connections, select Connection1. ​Verify that the security scheme defined in the OpenAPI specification (e.g., apiKey in header) matches the key/secret stored in Connection1.
  3. cloudera 👍 2 Answered D
    D. Connect the tool to Connection1. B is incomplete answer and can expose secrets if done wrong.
  4. afolabisbox 👍 1 Answered D
    Tool must be bounded to connection holding the key

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which Request Parameters Maximize Foundry Output Stability and Reasoning?

S-grade

Azure Custom Vision: ordered steps to detect factory component faults

S-grade

Improving Agent Response Completeness in Microsoft Foundry

S-grade

Restricting Access to Microsoft Foundry Service via VNet

S-grade

Practice All AI-103 Questions

Access 88 questions with complete answers and detailed explanations.

View Full AI-103 Practice Test →

← Back to AI-103 Study Guide