Foundry Iq

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Data and AI
MIT
Medium risk
Has scripts

From the author

Foundry IQ knowledge bases. WHEN: make local or Blob documents searchable; create/diagnose KBs; triage unsupported connectors or multi-source KB creation/reconfiguration (even with classic-search terms); connect existing KB to agents (including multi-source KBs); create/reuse a Search service; retrieve from an existing knowledge base with citations; no brand words needed. Read its procedure before query/target questions. NOT: other KB providers, repository-file search, classic Azure AI Search index/query/app work with no Foundry IQ KB or connector request, generic agent creation.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Foundry IQ provides a structured framework for creating, diagnosing, and connecting knowledge bases to AI agents. It supports making local or Blob-based documents searchable, managing multi-source knowledge configurations, and retrieving information with citations. The skill emphasizes strict adherence to defined procedures for service discovery, resource creation, and troubleshooting to ensure reliable agent-knowledge integration.

What it does

Creates searchable knowledge bases from local or Azure Blob storage documents.
Connects existing knowledge bases to AI agents.
Diagnoses issues with knowledge base configurations or unsupported connectors.
Retrieves information from knowledge bases with source citations.
Manages the lifecycle of search services and knowledge sources.
Routes requests based on specific operational needs rather than source counts.

When to use it

When you need to make local or cloud-stored documents searchable by an AI agent.
When connecting an existing knowledge base to a new or current agent.
When troubleshooting or diagnosing a knowledge base configuration.
When you need to create a new search service or knowledge source.
When performing retrieval tasks that require citations from a knowledge base.

Advantages

Provides a clear, procedural approach to knowledge base management.
Ensures consistent handling of multi-source knowledge configurations.
Includes built-in diagnostic paths for troubleshooting.
Supports secure, citation-backed retrieval for agent responses.
Prevents unauthorized or unsupported configuration changes.

Usage examples

“Create a new knowledge base from my Azure Blob container.”: The agent will initiate the knowledge base creation procedure, validating the source and setting up the necessary search indexing.
“Connect my existing knowledge base to the current agent.”: The agent will follow the connection workflow to link the specified knowledge base to the agent's retrieval pipeline.
“Why is my multi-source knowledge base failing to index?”: The agent will trigger the diagnostic procedure to identify configuration drifts or unsupported connector issues.
“Retrieve information about project timelines from the knowledge base.”: The agent will query the knowledge base and provide an answer with citations from the source documents.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/foundry-iq/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip foundry-iq.zip -d .agents/skills

Documentation by Microsoft

Foundry IQ

Read one procedure before questions/actions; invocation is not a read. Read the owning procedure before blocked/unsupported responses too. Before mutation plans/approval, successfully read its required pre-action references, selected branches only. Do not reload successful reads. On failure, try only permitted bounded exact-path reads with any supported reader; never bypass restrictions or search broadly. If still unavailable: blocked: reference-unavailable, name missing references and inability to plan. Never invent requirements/plans. Failures first.

Cleanup and receipt-backed execution go directly to their lifecycle/producer owner; do not reopen Search intake, provisioning or hardening.

Before expensive service discovery, reuse supplied resource/intent; otherwise ask one early USE EXISTING / FIND CANDIDATES / CREATE NEW choice. Only FIND enumerates; supplied identity uses exact/minimum scoped resolution. CREATE checks its proposed name, not existing-service inventories. Preserve these answers across source/KB/CU/model handoffs; selection is not write approval.

Searchable docs: KB + validated retrieval. Confirm intent once; KS-only must be explicit. Child success is not KB completion. Unclear/compound/mode/completion: read.

Route by requested operation, not existing KB source count. Connecting an existing KB with two or more sources, without changing the KB, uses Connect. Read-only operations use their owning procedure and actual helper constraints; this does not add retrieval modes or supported source kinds. Explicit unsupported provisioning or multi-source KB creation/reconfiguration uses Diagnose and stops before discovery, even when connecting an agent is also requested. This routing takes precedence over classic-search terms (e.g. hybrid search) in compound requests. Never end in a plain refusal: Diagnose gives the boundary, docs pointer and agent handoff; writes still need an approved concrete plan. Do not silently execute only the supported part of a compound request. If existing-KB connection versus KB creation/reconfiguration is unclear, read intent-routing and clarify that scope before Azure discovery. Never infer KB mutation.

Outcome	Read
Cleanup	Plan cleanup
Failure/drift	Diagnose
Unsupported connector provisioning / multi-source KB creation or reconfiguration	Diagnose
Connect	Connect
Read KB	Query
Search only	Search
File KS only	File
Blob/ADLS KS only	Blob
Searchable/KB	KB

Generic agents: microsoft-foundry. Reads: no approval; approve unchanged plans before writes. Hide hashes. No Search/Storage keys, scope widening, guessed identity/boundaries, drift repair or joint cleanup/creation approval. Acceptance != success.

Files

ATTRIBUTION.mdAdded by AutoGineer977 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.7 KiB
agents/connect-hosted-toolbox.md7.8 KiB
agents/connect-hosted.md7.8 KiB
agents/connect-prompt-sdk-fallback.md7.8 KiB
agents/connect.md7.8 KiB
agents/create-missing-agent.md7.8 KiB
helpers/_blob_observation.pyScript4.4 KiB
helpers/_blob_source_read.pyScript39.5 KiB
helpers/_bootstrap_io.pyScript30.1 KiB
helpers/_cleanup_dependencies.pyScript27.5 KiB
helpers/_cleanup_receipts.pyScript13.5 KiB
helpers/_common.pyScript36.2 KiB
helpers/_document_adapters.pyScript15.0 KiB
helpers/_document_limits.pyScript3.9 KiB
helpers/_embedding.pyScript7.0 KiB
helpers/_file_inventory.pyScript24.4 KiB
helpers/_file_source_config.pyScript15.6 KiB
helpers/_indexer_observation.pyScript7.1 KiB
helpers/_initial_prompt.pyScript12.5 KiB
helpers/_private_json.pyScript2.4 KiB
helpers/_progress.pyScript12.1 KiB
helpers/_prompt_read.pyScript17.7 KiB
helpers/_search_read.pyScript6.0 KiB
helpers/_source_readback.pyScript1.6 KiB
helpers/blob-contracts.md7.8 KiB
helpers/blob-cu-contracts.md7.8 KiB
helpers/blob_inventory.pyScript17.1 KiB
helpers/blob_recheck.pyScript64.6 KiB
helpers/blob_source.pyScript35.8 KiB
helpers/bootstrap-contracts.md7.8 KiB
helpers/bootstrap_azure.pyScript41.5 KiB
helpers/cleanup_plan.pyScript41.4 KiB
helpers/contracts.md7.8 KiB
helpers/cu_ingestion_auth.pyScript12.5 KiB
helpers/document-assessment.md7.8 KiB
helpers/document_assess.pyScript14.0 KiB
helpers/file-upload-recovery.md7.8 KiB
helpers/file_cu_canary.pyScript32.7 KiB
helpers/file_cu_mi.pyScript9.6 KiB
helpers/file_ingest.pyScript15.4 KiB
helpers/file_source.pyScript31.7 KiB
helpers/file_upload.pyScript53.7 KiB
helpers/hosted_connect.pyScript30.8 KiB
helpers/kb-contracts.md7.8 KiB
helpers/knowledge_base_retrieve.pyScript7.7 KiB
helpers/model-discovery-contracts.md7.8 KiB
helpers/model-discovery-scopes.md7.8 KiB
helpers/model_discovery.pyScript23.7 KiB
helpers/private-artifacts.md7.2 KiB
helpers/private_artifacts.pyScript4.8 KiB
helpers/prompt_cleanup.pyScript22.0 KiB
helpers/prompt_connect.pyScript62.3 KiB
helpers/requirements-assessment.txt103 B
helpers/retrieval-verification-contracts.md7.8 KiB
helpers/retrieval_verify.pyScript19.6 KiB
helpers/search-intake-contracts.md7.6 KiB
helpers/search_intake.pyScript18.4 KiB
helpers/search_reconcile.pyScript59.7 KiB
helpers/source_vector.pyScript33.2 KiB
helpers/throttle-recovery.md5.0 KiB
helpers/vector-contracts.md7.8 KiB
knowledge-bases/create.md8.1 KiB
knowledge-bases/retrieve.md7.8 KiB
knowledge-sources/create-azure-blob.md7.8 KiB
knowledge-sources/create-file.md7.8 KiB
lifecycle/cleanup.md7.8 KiB
references/abstention.md1.0 KiB
references/blob-binding-evidence.md7.8 KiB
references/blob-indexer-observation.md7.7 KiB
references/blob-ingestion-progress.md6.5 KiB
references/blob-readiness-recheck.md7.8 KiB
references/blob-vector-readiness.md2.6 KiB
references/bootstrap-azure.md7.8 KiB
references/content-fit.md7.8 KiB
references/cu-ingestion.md7.8 KiB
references/file-cu-canary.md7.8 KiB
references/intent-routing.md7.7 KiB
references/owner.md2.1 KiB
references/platform-contracts.md7.7 KiB
references/platform-interfaces.md7.8 KiB
references/resource-intake.md7.8 KiB
references/search-substrate.md7.8 KiB
references/standard-cu.md7.8 KiB
search-services/create.md7.8 KiB
troubleshooting/diagnose.md8.7 KiB

agents/connect-hosted.md

Existing Hosted Agent connection

Branch of Connect, not a creation workflow. Inspect remotely first; no source path for inspection or exact reuse. Missing azure.yaml in cwd is not a discovery blocker. Do not reinstall, reinitialize or inspect policy upfront. Retain resources; Hosted cleanup is unsupported.

Inspect

Use known project endpoint, exact agent name/version, KB MCP identity, runtime principal and actual connection/toolbox/binding readbacks through authenticated, observed read operations. Missing read tooling is a tooling blocker, not a source request. Run these azd reads only with already available project/environment:

azd ai agent show <service-name> --output json --no-prompt
azd ai connection show <connection-name> --output json --no-prompt
azd ai toolbox show <toolbox-name> --output json --no-prompt

Never use azd ai project set as a read; context changes require approval. Inspect compatible connections/toolboxes before choosing a new name. Never overwrite a Prompt connection using ProjectManagedIdentity to make it Hosted.

Compare agent identity/version, model, telemetry, ACR, network, environment, connection target/auth/audience and toolbox/default tools. For omitted audience or UnknownConnectionPropertiesV2, use the exact nonsecret connection readback. Projection gaps are warnings only after authoritative equality is proven; denial, conflicting properties or still-missing required evidence blocks.

Resolve the actual published agent principal, not its blueprint or project MI. Check effective runtime access and plan only missing grants:

Permission	Grant scope
Search Index Data Reader	`<search-service-resource-id>`
Foundry User or documented equivalent for toolbox access	`<project-resource-id>`

Reuse compatible effective grants. Disclose that Search service scope covers its indexes, while Foundry User grants broader project data operations, not just toolbox reads. No automatic grant, scope widening or caller-role change. A newly observed principal or access requirement needs a separate approved access plan.

Select binding before approval

Unchanged consumer: toolbox-only branch; no deploy.

Source-free changes require observed runtime support and an authoritative surface. Otherwise explain the exact code/config/deploy delta and handoff/request source only then. Hosted code orchestrates tools: existing agents may need source too; no arbitrary Hosted tool changes through Prompt APIs.

For the source-backed recipe, inspect its supported mode and emitted environment, not just local variables. For FoundryToolbox, an explicitly empty TOOLBOX_ENDPOINT raises instead of falling back to TOOLBOX_NAME.

Mode	`TOOLBOX_ENDPOINT`	`TOOLBOX_NAME`
Endpoint	`<consumer-endpoint>`	`""` or absent
Name	absent	`<toolbox-name>`

The consumer endpoint is <project-endpoint>/toolboxes/<toolbox-name>/mcp?api-version=v1. Do not substitute the version-specific developer endpoint returned by some toolbox readers. Preserve an already compatible exact binding without standardizing its mode. For new/repair bindings, select one supported mode: if the manifest injects an empty endpoint, prefer endpoint mode when supported. Unsetting a local variable does not remove a manifest's runtime environment key. If no valid binding is possible without source edits, stop for separate review.

If installed, validate resolution offline with the SDK; do not install it for this check. No token/model call or standalone agentic toolbox tools/list: runtime identity requires published-agent context.

Approved changes only

This source-backed recipe requires the approved existing azd ai agent source project; unsupported/image-only source blocks this recipe, not remote inspection. Retain source/config hashes for source/config changes or source-backed redeployment. Plan grants/resource/binding deltas, source digest, costs and verification. Exact state skips every mutation below. After approved access changes, create only absent exact resources:

azd ai connection create <connection-name> --kind remote-tool --target <exact-kb-mcp-endpoint> --auth-type agentic-identity --audience https://search.azure.com/ --output json --no-prompt
azd ai toolbox create <toolbox-name> --from-file <approved-toolbox-yaml> --output json --no-prompt

Verify stored AgenticIdentityToken, audience, target and project before toolbox creation. YAML contains only description and the exact connection name; no credentials or extra tools. Creation auto-publishes the first toolbox version and writes TOOLBOX_<NORMALIZED_NAME>_MCP_ENDPOINT locally; disclose that write.

Apply only the selected approved binding delta. Endpoint mode:

azd env set TOOLBOX_ENDPOINT <consumer-endpoint> --no-prompt

If the source exposes an unused name variable, clear it only as an approved delta:

azd env set TOOLBOX_NAME "" --no-prompt

Name mode, only with the endpoint absent from the emitted runtime environment:

azd env set TOOLBOX_NAME <toolbox-name> --no-prompt

Deploy only when remote configuration differs, under the same agent name:

azd deploy <service-name> --no-prompt

Independently read back the returned version, actual principal, binding and protected state. active metadata is not runtime-health proof. Unknown/changed identity, source drift or failure stops; no blind retry, --force, handcrafted mutation API, replacement agent or automatic cleanup.

Verify and reconcile

Pin the observed version at session creation. A new session does not guarantee a new Responses conversation. Start both fresh:

azd ai agent invoke <service-name> "<supported-question>" --protocol responses --version <verified-version> --new-session --new-conversation --no-prompt

Capture the first response's session ID as <first-response-session-id> and its conversation ID. Verify both are distinct from prior trial IDs. Missing or reused first-response IDs block the second call. Do not rely on automatic session selection; explicitly pin the captured session while starting a fresh conversation:

azd ai agent invoke <service-name> "<unsupported-question>" --protocol responses --session-id <first-response-session-id> --new-conversation --no-prompt

Sessions bind their version at creation; --version and --session-id are mutually exclusive. If the installed CLI lacks --session-id, block verification rather than falling back to a saved session. Require the second response's session ID to equal the captured ID and its conversation ID to differ from the first and all prior trials. Missing or mismatched IDs make isolation unverified: stop before monitoring or further invocations. Do not silently add invocations to repair a bounded test.

Correlate actual knowledge_base_retrieve success with each request and response, using returned events or supported logs:

azd ai agent monitor <service-name> --session-id <first-response-session-id> --tail 300 --no-prompt

Require supported answers with original citations and unsupported answers exactly I don't know. without citations. Errors are not abstention. Tool success proves execution, not the contents of an unavailable payload: record missing arguments, results or usage and leave payload-level faithfulness unverified. Never infer empty retrieval or change source/telemetry to manufacture proof.

Compare identities, versions, tools, roles, protected source and binding. Repeat reconciliation through reads only: no setters, create, publish or deploy calls on exact state. Zero configuration writes excludes authorized invocation/conversation/session activity and local test metadata; report both. Retain resources. Cleanup remains separately approved and hosted-cleanup-unsupported in this skill.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

The author says: Azure

Security

What our scanner noticed· Medium risk

References to credential files
Instructions that use the network
Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/foundry-iq-skills/skills/foundry-iq · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/foundry-iq-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download foundry-iq.zip