Foundry Iq

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Data and AI
MIT
Medium risk
Has scripts

From the author

Foundry IQ knowledge bases. WHEN: make local or Blob documents searchable; create/diagnose KBs; triage unsupported connectors or multi-source KB creation/reconfiguration (even with classic-search terms); connect existing KB to agents (including multi-source KBs); create/reuse a Search service; retrieve from an existing knowledge base with citations; no brand words needed. Read its procedure before query/target questions. NOT: other KB providers, repository-file search, classic Azure AI Search index/query/app work with no Foundry IQ KB or connector request, generic agent creation.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Foundry IQ provides a structured framework for creating, diagnosing, and connecting knowledge bases to AI agents. It supports making local or Blob-based documents searchable, managing multi-source knowledge configurations, and retrieving information with citations. The skill emphasizes strict adherence to defined procedures for service discovery, resource creation, and troubleshooting to ensure reliable agent-knowledge integration.

What it does

Creates searchable knowledge bases from local or Azure Blob storage documents.
Connects existing knowledge bases to AI agents.
Diagnoses issues with knowledge base configurations or unsupported connectors.
Retrieves information from knowledge bases with source citations.
Manages the lifecycle of search services and knowledge sources.
Routes requests based on specific operational needs rather than source counts.

When to use it

When you need to make local or cloud-stored documents searchable by an AI agent.
When connecting an existing knowledge base to a new or current agent.
When troubleshooting or diagnosing a knowledge base configuration.
When you need to create a new search service or knowledge source.
When performing retrieval tasks that require citations from a knowledge base.

Advantages

Provides a clear, procedural approach to knowledge base management.
Ensures consistent handling of multi-source knowledge configurations.
Includes built-in diagnostic paths for troubleshooting.
Supports secure, citation-backed retrieval for agent responses.
Prevents unauthorized or unsupported configuration changes.

Usage examples

“Create a new knowledge base from my Azure Blob container.”: The agent will initiate the knowledge base creation procedure, validating the source and setting up the necessary search indexing.
“Connect my existing knowledge base to the current agent.”: The agent will follow the connection workflow to link the specified knowledge base to the agent's retrieval pipeline.
“Why is my multi-source knowledge base failing to index?”: The agent will trigger the diagnostic procedure to identify configuration drifts or unsupported connector issues.
“Retrieve information about project timelines from the knowledge base.”: The agent will query the knowledge base and provide an answer with citations from the source documents.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/foundry-iq/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip foundry-iq.zip -d .agents/skills

Documentation by Microsoft

Foundry IQ

Read one procedure before questions/actions; invocation is not a read. Read the owning procedure before blocked/unsupported responses too. Before mutation plans/approval, successfully read its required pre-action references, selected branches only. Do not reload successful reads. On failure, try only permitted bounded exact-path reads with any supported reader; never bypass restrictions or search broadly. If still unavailable: blocked: reference-unavailable, name missing references and inability to plan. Never invent requirements/plans. Failures first.

Cleanup and receipt-backed execution go directly to their lifecycle/producer owner; do not reopen Search intake, provisioning or hardening.

Before expensive service discovery, reuse supplied resource/intent; otherwise ask one early USE EXISTING / FIND CANDIDATES / CREATE NEW choice. Only FIND enumerates; supplied identity uses exact/minimum scoped resolution. CREATE checks its proposed name, not existing-service inventories. Preserve these answers across source/KB/CU/model handoffs; selection is not write approval.

Searchable docs: KB + validated retrieval. Confirm intent once; KS-only must be explicit. Child success is not KB completion. Unclear/compound/mode/completion: read.

Route by requested operation, not existing KB source count. Connecting an existing KB with two or more sources, without changing the KB, uses Connect. Read-only operations use their owning procedure and actual helper constraints; this does not add retrieval modes or supported source kinds. Explicit unsupported provisioning or multi-source KB creation/reconfiguration uses Diagnose and stops before discovery, even when connecting an agent is also requested. This routing takes precedence over classic-search terms (e.g. hybrid search) in compound requests. Never end in a plain refusal: Diagnose gives the boundary, docs pointer and agent handoff; writes still need an approved concrete plan. Do not silently execute only the supported part of a compound request. If existing-KB connection versus KB creation/reconfiguration is unclear, read intent-routing and clarify that scope before Azure discovery. Never infer KB mutation.

Outcome	Read
Cleanup	Plan cleanup
Failure/drift	Diagnose
Unsupported connector provisioning / multi-source KB creation or reconfiguration	Diagnose
Connect	Connect
Read KB	Query
Search only	Search
File KS only	File
Blob/ADLS KS only	Blob
Searchable/KB	KB

Generic agents: microsoft-foundry. Reads: no approval; approve unchanged plans before writes. Hide hashes. No Search/Storage keys, scope widening, guessed identity/boundaries, drift repair or joint cleanup/creation approval. Acceptance != success.

Files

ATTRIBUTION.mdAdded by AutoGineer977 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.7 KiB
agents/connect-hosted-toolbox.md7.8 KiB
agents/connect-hosted.md7.8 KiB
agents/connect-prompt-sdk-fallback.md7.8 KiB
agents/connect.md7.8 KiB
agents/create-missing-agent.md7.8 KiB
helpers/_blob_observation.pyScript4.4 KiB
helpers/_blob_source_read.pyScript39.5 KiB
helpers/_bootstrap_io.pyScript30.1 KiB
helpers/_cleanup_dependencies.pyScript27.5 KiB
helpers/_cleanup_receipts.pyScript13.5 KiB
helpers/_common.pyScript36.2 KiB
helpers/_document_adapters.pyScript15.0 KiB
helpers/_document_limits.pyScript3.9 KiB
helpers/_embedding.pyScript7.0 KiB
helpers/_file_inventory.pyScript24.4 KiB
helpers/_file_source_config.pyScript15.6 KiB
helpers/_indexer_observation.pyScript7.1 KiB
helpers/_initial_prompt.pyScript12.5 KiB
helpers/_private_json.pyScript2.4 KiB
helpers/_progress.pyScript12.1 KiB
helpers/_prompt_read.pyScript17.7 KiB
helpers/_search_read.pyScript6.0 KiB
helpers/_source_readback.pyScript1.6 KiB
helpers/blob-contracts.md7.8 KiB
helpers/blob-cu-contracts.md7.8 KiB
helpers/blob_inventory.pyScript17.1 KiB
helpers/blob_recheck.pyScript64.6 KiB
helpers/blob_source.pyScript35.8 KiB
helpers/bootstrap-contracts.md7.8 KiB
helpers/bootstrap_azure.pyScript41.5 KiB
helpers/cleanup_plan.pyScript41.4 KiB
helpers/contracts.md7.8 KiB
helpers/cu_ingestion_auth.pyScript12.5 KiB
helpers/document-assessment.md7.8 KiB
helpers/document_assess.pyScript14.0 KiB
helpers/file-upload-recovery.md7.8 KiB
helpers/file_cu_canary.pyScript32.7 KiB
helpers/file_cu_mi.pyScript9.6 KiB
helpers/file_ingest.pyScript15.4 KiB
helpers/file_source.pyScript31.7 KiB
helpers/file_upload.pyScript53.7 KiB
helpers/hosted_connect.pyScript30.8 KiB
helpers/kb-contracts.md7.8 KiB
helpers/knowledge_base_retrieve.pyScript7.7 KiB
helpers/model-discovery-contracts.md7.8 KiB
helpers/model-discovery-scopes.md7.8 KiB
helpers/model_discovery.pyScript23.7 KiB
helpers/private-artifacts.md7.2 KiB
helpers/private_artifacts.pyScript4.8 KiB
helpers/prompt_cleanup.pyScript22.0 KiB
helpers/prompt_connect.pyScript62.3 KiB
helpers/requirements-assessment.txt103 B
helpers/retrieval-verification-contracts.md7.8 KiB
helpers/retrieval_verify.pyScript19.6 KiB
helpers/search-intake-contracts.md7.6 KiB
helpers/search_intake.pyScript18.4 KiB
helpers/search_reconcile.pyScript59.7 KiB
helpers/source_vector.pyScript33.2 KiB
helpers/throttle-recovery.md5.0 KiB
helpers/vector-contracts.md7.8 KiB
knowledge-bases/create.md8.1 KiB
knowledge-bases/retrieve.md7.8 KiB
knowledge-sources/create-azure-blob.md7.8 KiB
knowledge-sources/create-file.md7.8 KiB
lifecycle/cleanup.md7.8 KiB
references/abstention.md1.0 KiB
references/blob-binding-evidence.md7.8 KiB
references/blob-indexer-observation.md7.7 KiB
references/blob-ingestion-progress.md6.5 KiB
references/blob-readiness-recheck.md7.8 KiB
references/blob-vector-readiness.md2.6 KiB
references/bootstrap-azure.md7.8 KiB
references/content-fit.md7.8 KiB
references/cu-ingestion.md7.8 KiB
references/file-cu-canary.md7.8 KiB
references/intent-routing.md7.7 KiB
references/owner.md2.1 KiB
references/platform-contracts.md7.7 KiB
references/platform-interfaces.md7.8 KiB
references/resource-intake.md7.8 KiB
references/search-substrate.md7.8 KiB
references/standard-cu.md7.8 KiB
search-services/create.md7.8 KiB
troubleshooting/diagnose.md8.7 KiB

agents/connect.md

Connect a knowledge base to an agent

When to use

Connect one Prompt/Hosted Agent; optionally create it if missing. KB: content; project connection: auth; agent MCP tool: versioned use.

Do not use

Do not replace agents, attach multiple base tools, or handle base-free lifecycle. Permission error is not absence; creation approval is separate.

Inputs and discovery order

Resolve prompt, session, workspace, exact Azure readback, default, then one focused question. Label sources; missing input blocks. Reads need no approval; silence approves nothing.

Input	Why needed	Required?	Discovery order	Safe default	If missing or unanswered	Reconfirmation trigger
Base return/MCP endpoint	Grounding	Required	Session, exact proof	None	Block	Base/API/evidence change
Project ID/endpoint	Target	Required	Prompt, workspace, readback	None	Block	ID/tenant change
Agent name/inventory/type	Identity	Required	Prompt, readback	Never latest/type	Block ambiguity	Inventory/type
Definition/model/baseline; Hosted telemetry	Preservation	By branch	Exact readback	Preserve unrelated fields	Block	Protected state
Connection/tool; Hosted toolbox/environment	Binding	By branch	Full readback	One retrieve binding	Block conflict	Binding/endpoint
Principal/reader role	Retrieval	Before assignment	Readback	Exact Search scope	Block	Assignment
Grounding delta	Evidence	Required	Instructions	Base/citations/`I don't know`	Block loss	Delta
Acceptance/unrelated questions	Verification	Before invocation	Authorized evidence	None	Propose candidate	Questions
Cleanup/retention owner	Ownership	Required	Prompt/session	None	Block	Owner
Provider/install or CLI choice	Missing agent	Conditional	Runtime, then choice	No automatic fallback	Block	Availability/choice

Decisions

Use policy diagnostics only after a creation failure implicates policy, never as a gate.

Read exact IDs/all scoped pages; inaccessible is not absent:

Prompt: refresh the selected version and all its scoped version pages after portal add/remove; never assume latest. Exact is zero-write. Collision is the connection NAME, not KB endpoint: an approved new name can share that endpoint, preserving legacy/key connections. Same-name mismatch blocks. An explicit selected-tool switch creates a version, preserving all unrelated fields/tools.
Hosted: inspect remote project, exact agent/version, KB MCP, runtime principal and connection/toolbox/binding first: no source path for inspection or exact reuse. Bind source/config digest for agent edits/redeployment. Conflicts block. Read Hosted connection before plans or verification.

Only for a missing agent, load missing-agent creation before questions/plans. Prefer microsoft-foundry: delegate approved identity/configuration and known requirements. Otherwise offer installation or Prompt CLI creation. Installation refusal is not creation approval. Require a typed return with project, agent, version/deployment, model/status/identity and definition/source/config/environment. Independently read back; use fresh discovery and a new fingerprinted connection plan; never carry creation approval. Incomplete returns block.

Read the authenticated knowledgebases API, never generated indexes or foundryextensions_knowledge_index_list. Existing multi-source KBs are valid. Preserve valid KB effort/output/models; preview MCP supports reasoning/synthesis. Use the exact preview API in SDK; native GA minimal/extractive MCP exists. KB model: low or medium with supported output; preview minimal/answerSynthesis is valid. Use the approved KB transition only when an explicit model-free normalization is needed. Never change the KB implicitly or add a model as a workaround. Only when authenticated Foundry MCP is unavailable or lacks a required operation, load typed Prompt SDK fallback. Denial/conflict blocks. Bind the surface; switching requires fresh review, never bypass.

Proposed plan

List delta, API, identity/scope, network/data, cost, verification, owner and retained IDs.

Confirmation

Approve concrete changes once; plan_fingerprint stays internal, with cleanup_approved: false. Delegated creation is separate. A Hosted principal known only after deploy requires a separate RBAC plan. Material/protected-state drift invalidates approval; disclose bounded Prompt warnings below.

Mutation

After confirmation, use exact identities; never retry another name.

Prompt: Use the planned MCP or SDK surface; never invent operations. Reconcile one 2025-10-01-preview RemoteTool connection with ProjectManagedIdentity, Search audience, and the 2026-08-01-preview KB MCP endpoint. Require the exact Search-service-scoped Search Index Data Reader assignment to observed PROJECT identity.principalId, not agent identity. Preserve all fields; add/switch at most one same-label MCPTool with exact endpoint/connection, allowed_tools: ["knowledge_base_retrieve"], and require_approval: "never". Under the same agent name, require retrieval for every question, including unrelated questions. Answer from retrieved evidence, not general knowledge; unsupported answers are exactly I don't know without citations; retrieval errors must remain errors. Approve exact appended instructions; preserve previous instructions/versions. Duplicate labels block. Search provisioning alone is not a connection-write blocker when the KB GET is healthy; warn, never claim retrieval readiness. Failed/auth/deletion states block.

After exact identity/binding checks, type metadata differences and boolean isSharedToAll: true-to-false restriction warn without rewriting. Missing/malformed sharing, broader access, wrong target/auth/audience/category/required metadata block. Apply the same rules to reuse; require actual agent tests below.

Hosted: Follow the selected Hosted connection procedure. Only approved missing resources, binding differences and required deployments are writes; exact existing state skips them all. Never replace agents; source edits need separate review/handoff.

Verification

Verify protected fields, a knowledge_base_retrieve call with original citations, and unrelated I don't know without citations. Preserve behavior; rerun with stable IDs and zero configuration writes. Account separately for requested invocations, conversations/sessions and their usage. Record actual tool execution and returned evidence separately from answer behavior; unavailable payloads leave payload-level faithfulness unverified, not an inferred empty result.

Failure and partial completion

Preserve first status/message/request ID. Denial, conflict, incomplete delegation, failed citations, unknown principal or drift blocks. Record writes, evidence, ownership, recovery and warnings; never widen state.

Cleanup

Separate fingerprinted cleanup deletes only run-owned artifacts in reverse. Prompt uses helpers/prompt_cleanup.py with exact digests. Hosted returns hosted-cleanup-unsupported, zero writes, retaining all resources. Unclear ownership blocks.

Return contract

Return planned/completed/blocked/partial: exact actions/resources, invocation/readback evidence, ownership, failure, warnings and cleanup status.

References

Authorities: failure/conflict/uncertainty only.

Connect Agents to Foundry IQ knowledge bases

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

The author says: Azure

Security

What our scanner noticed· Medium risk

References to credential files
Instructions that use the network
Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/foundry-iq-skills/skills/foundry-iq · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/foundry-iq-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download foundry-iq.zip