Connect Azure AI Foundry with Microsoft Entra ID

When you connect your Azure AI Foundry resource to BI Pixie with Microsoft Entra ID, BI Pixie signs in to the resource as an app that you register in your own tenant. No key to the resource is shared with BI Pixie. The app can call the resource and nothing else, its calls appear in your own logs under the app's name, and you can revoke its access from your own tenant at any time.

Microsoft recommends this approach for Azure AI Foundry: "We recommend keyless authentication using Microsoft Entra ID. If that's not possible, use an API key and store it in Azure Key Vault." In BI Pixie, Microsoft Entra ID is the default choice for Azure AI Foundry, and the API key is the alternative.

This guide follows the order the work is done in. The first three tasks happen in the Azure portal, usually by an Azure administrator. The last task happens in the BI Pixie Portal, by a BI Pixie account admin. When those are two different people, the Azure administrator passes five values to the account admin, listed under The five values BI Pixie needs.

Prerequisites

• An Azure AI Foundry resource, or an Azure OpenAI resource, in your Azure subscription, with an AI model deployed on it, such as gpt-5-mini.
• Permission to register an app in your Microsoft Entra tenant.
• Permission to assign roles on the Azure AI Foundry resource.
• In BI Pixie, the account admin role. AI setup is an account setting, so only account admins can see and change it.

The five values BI Pixie needs

The BI Pixie form asks for five values. Each one comes from the Azure portal, in the task named beside it.

Check the resource's endpoint

Microsoft Entra ID sign-in works only against a resource that has a custom subdomain. A resource with a custom subdomain has an endpoint that begins with its own name, in the form https://your-resource.cognitiveservices.azure.com/.

1. In the Azure portal, open your Azure AI Foundry resource, and find its endpoint.
2. Check that the endpoint begins with the resource's own name. If it begins with the name of an Azure region instead, the resource has no custom subdomain, and Microsoft Entra ID sign-in doesn't work against it. See Microsoft's guide to Microsoft Entra ID authentication for the requirement.
3. Note the endpoint, and the name of the deployment you want BI Pixie to use.

Register an app for BI Pixie

1. In the Azure portal, in Microsoft Entra ID, register a new app. A name such as "BI Pixie" makes its calls easy to recognize in your logs. The app is used only within your own tenant, and it needs no redirect URI.
2. On the app's overview, note its Application (client) ID and its Directory (tenant) ID. The BI Pixie form uses the same two names.
3. Create a client secret for the app, with an expiry that fits your organization's policy. Copy the secret's value as soon as it's shown, because Microsoft Entra ID shows the value only once.

Grant the app access to the resource

1. In the Azure portal, open your Azure AI Foundry resource, and add a role assignment.
2. Choose the Cognitive Services OpenAI User role.
3. Assign the role to the app you registered, and save the assignment.

The role is granted on the resource, so it covers every deployment on that resource. It lets the app call the resource's deployments. It doesn't let the app read the resource's keys or change the resource.

Enter the values in BI Pixie

1. Open the BI Pixie Portal, select Account, and then select the AI tab. You can also open AI setup from the AI Readiness page, as described in Open AI setup.
2. Start adding an AI. It can become your AI, or one of your generic AI agents to test. See Set Up Your AI for AI Readiness for the difference.
3. Under Service, select Azure AI Foundry.
4. In Foundry endpoint, enter the endpoint. In Deployment name, enter the name of the deployment.
5. Under Authentication, leave Microsoft Entra ID (recommended) selected. It's the default for Azure AI Foundry.
6. Enter the Directory (tenant) ID, the Application (client) ID, and the Client secret.
7. Optionally, enter a Name. If you leave it empty, the AI is listed under the name of its service.
8. Select Save.

In AI setup, the AI is described as "Azure AI Foundry, deployment gpt-5-mini, through Microsoft Entra ID", with the name of your own deployment in place of gpt-5-mini.

Add another deployment on the same resource

When BI Pixie already has a credential for your resource, a second deployment on it needs no endpoint and no secret. When you add the AI, under Credential, choose the saved credential, which reads as your endpoint followed by "through Microsoft Entra ID". Then enter only the Deployment name. A different resource, or a different app registration, is added with Add a new credential.

Replace the client secret

A client secret stops working when it expires or when you delete it. To replace it before then:

1. In the Azure portal, create a new client secret for the app, and copy its value.
2. In AI setup, on the row of the AI, select Replace credential.
3. Enter the Directory (tenant) ID, the Application (client) ID, and the new Client secret, and then select Replace credential.
4. After BI Pixie is using the new secret, delete the old secret in the Azure portal.

When several AIs share one credential, the form names each of them before you replace it, and the replacement applies to all of them.

Turn off key access on the resource

Once BI Pixie works with Microsoft Entra ID, you can turn off key access on the resource, so that no key can call it at all. Microsoft documents this as the resource's disableLocalAuth property, set with -DisableLocalAuth $true in Azure PowerShell.

Before you turn it off, check that nothing else calls the resource with a key. That includes any AI you saved in BI Pixie for the same resource with API key authentication, which stops working when key access is off.

Considerations and limitations

• Microsoft Entra ID is available only for Azure AI Foundry. OpenAI and Anthropic connect with an API key.
• BI Pixie doesn't check the values when you save them. A wrong ID, an expired secret, or a missing role assignment shows up the first time BI Pixie calls the AI.
• BI Pixie exchanges the client secret for short-lived tokens and keeps each token only until it expires. When you remove the role assignment, delete the secret, or delete the app, BI Pixie's access ends once the token it already holds expires.
• BI Pixie stores the client secret encrypted and never writes it to a log.
• You can't change the deployment of a saved AI. To use a different deployment, add it as a new AI.
• Calls to your resource are billed to your Azure subscription.

Related content

• Set Up Your AI for AI Readiness
• Choose the AI to Test
• Configure Microsoft Entra ID authentication for Azure AI Foundry (Microsoft)
• Configure Azure OpenAI with Microsoft Entra ID authentication (Microsoft)