Microsoft Foundry (Azure AI Foundry)

A Microsoft Foundry connection sends the models you choose through your own Foundry resource, so Azure bills your subscription instead of Amp. It serves Claude deployments through Foundry’s Anthropic-compatible Messages endpoint and other deployments through Foundry’s OpenAI-compatible endpoint.

Amp authenticates with Microsoft Entra workload identity federation. You create an Entra application, add a federated identity credential that trusts Amp, and grant the application the Foundry User role on your Foundry resource. Amp signs in as that application with short-lived signed tokens and stores no key or secret.

Set Up a Connection

First, deploy the models you want to use in your Foundry resource from the Foundry portal. Amp sends each model as its deployment name, so keep the default names (the model name, such as claude-opus-5 or gpt-5.5) or map models to your deployment names in Amp, for example anthropic/claude-opus-5 -> my-claude-deployment.

Azure needs model quota before it lets you create a deployment. A new subscription starts with no quota for most current models, and the deployment fails with InsufficientQuota until a request at aka.ms/oai/stuquotarequest is approved. Check what you can deploy in the Foundry portal under Manage > Quota with “Show all” on. Claude models also need you to accept Anthropic’s marketplace terms once per subscription in the Foundry portal before the first Claude deployment.

Then, in Amp, open personal model routing or workspace model routing and add a Microsoft Foundry connection. The form walks you through creating the Entra application by showing you this script:

Sign in to see your own AMP_ISSUER and AMP_SUBJECT values in the script. 
# The Amp user or workspace that will use this connection.
export AMP_ISSUER=AMP_ISSUER
export AMP_SUBJECT=AMP_SUBJECT

# Your Foundry resource: the NAME in https://NAME.services.ai.azure.com and its resource group.
export FOUNDRY_RESOURCE_NAME=my-foundry
export FOUNDRY_RESOURCE_GROUP=my-resource-group
export APP_NAME=AmpFoundry

# Create an Entra application for Amp and its service principal (once per tenant).
export CLIENT_ID=$(az ad app create --display-name "$APP_NAME" --query appId --output tsv)
az ad sp create --id "$CLIENT_ID" --output none

# Trust only tokens Amp issues for your Amp account. Keep issuer, subject, and audience exact.
az ad app federated-credential create --id "$CLIENT_ID" --parameters "$(cat <<EOF
{
  "name": "amp-${AMP_SUBJECT//[^[:alnum:]]/-}",
  "issuer": "$AMP_ISSUER",
  "subject": "$AMP_SUBJECT",
  "audiences": ["api://AzureADTokenExchange"]
}
EOF
)" --output none

# Allow the application to run inference on the Foundry resource (Foundry User role).
export FOUNDRY_RESOURCE_ID=$(az cognitiveservices account show \
  --name "$FOUNDRY_RESOURCE_NAME" --resource-group "$FOUNDRY_RESOURCE_GROUP" \
  --query id --output tsv)
az role assignment create \
  --assignee-object-id "$(az ad sp show --id "$CLIENT_ID" --query id --output tsv)" \
  --assignee-principal-type ServicePrincipal \
  --role 53ca6127-db72-4b80-b1b0-d745d6d5456d \
  --scope "$FOUNDRY_RESOURCE_ID" --output none

echo "$(az account show --query tenantId --output tsv)/$CLIENT_ID"

The last command prints TENANT_ID/CLIENT_ID. Paste it into the Entra Application field, enter your Foundry resource name (the NAME in https://NAME.services.ai.azure.com), select which models should use the connection, and save.

Use the Check Access button to confirm that Entra ID accepts Amp’s identity and that the resource serves a deployment. A 404 DeploymentNotFound error means the model is not deployed under that name in the resource; a 401 or 403 means the application lacks the Foundry User role on the resource, or the role assignment has not propagated yet (this can take a few minutes).

You can also add the connection from the CLI:

amp config model-providers setup-guide azure-ai-foundry --workspace

amp config model-providers add-router azure-ai-foundry --workspace \
  --entra-application 72f988bf-86f1-41af-91ab-2d7cd011db47/11111111-2222-3333-4444-555555555555 \
  --foundry-resource my-foundry \
  --model-mapping anthropic/claude-opus-5

Credentials Amp Does Not Accept

Entra workload identity federation is the only supported authentication method. Amp does not accept these credentials, and does not plan to:

  • Foundry or Azure OpenAI API keys. Resource keys are long-lived secrets that grant every deployment on the resource and cannot be scoped to Amp.
  • Entra application client secrets or certificates. Federation lets the application trust Amp directly, so nothing needs to be created, stored, or rotated.
  • Legacy *.openai.azure.com endpoints. Amp uses the Foundry resource endpoint (NAME.services.ai.azure.com), which serves both the Anthropic-compatible and OpenAI-compatible routes with Entra tokens.

For more, see Microsoft’s documentation on workload identity federation and keyless authentication for Foundry.