Foundry Iq

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Data and AI
MIT
Medium risk
Has scripts

From the author

Foundry IQ knowledge bases. WHEN: make local or Blob documents searchable; create/diagnose KBs; triage unsupported connectors or multi-source KB creation/reconfiguration (even with classic-search terms); connect existing KB to agents (including multi-source KBs); create/reuse a Search service; retrieve from an existing knowledge base with citations; no brand words needed. Read its procedure before query/target questions. NOT: other KB providers, repository-file search, classic Azure AI Search index/query/app work with no Foundry IQ KB or connector request, generic agent creation.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Foundry IQ provides a structured framework for creating, diagnosing, and connecting knowledge bases to AI agents. It supports making local or Blob-based documents searchable, managing multi-source knowledge configurations, and retrieving information with citations. The skill emphasizes strict adherence to defined procedures for service discovery, resource creation, and troubleshooting to ensure reliable agent-knowledge integration.

What it does

Creates searchable knowledge bases from local or Azure Blob storage documents.
Connects existing knowledge bases to AI agents.
Diagnoses issues with knowledge base configurations or unsupported connectors.
Retrieves information from knowledge bases with source citations.
Manages the lifecycle of search services and knowledge sources.
Routes requests based on specific operational needs rather than source counts.

When to use it

When you need to make local or cloud-stored documents searchable by an AI agent.
When connecting an existing knowledge base to a new or current agent.
When troubleshooting or diagnosing a knowledge base configuration.
When you need to create a new search service or knowledge source.
When performing retrieval tasks that require citations from a knowledge base.

Advantages

Provides a clear, procedural approach to knowledge base management.
Ensures consistent handling of multi-source knowledge configurations.
Includes built-in diagnostic paths for troubleshooting.
Supports secure, citation-backed retrieval for agent responses.
Prevents unauthorized or unsupported configuration changes.

Usage examples

“Create a new knowledge base from my Azure Blob container.”: The agent will initiate the knowledge base creation procedure, validating the source and setting up the necessary search indexing.
“Connect my existing knowledge base to the current agent.”: The agent will follow the connection workflow to link the specified knowledge base to the agent's retrieval pipeline.
“Why is my multi-source knowledge base failing to index?”: The agent will trigger the diagnostic procedure to identify configuration drifts or unsupported connector issues.
“Retrieve information about project timelines from the knowledge base.”: The agent will query the knowledge base and provide an answer with citations from the source documents.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/foundry-iq/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip foundry-iq.zip -d .agents/skills

Documentation by Microsoft

Foundry IQ

Read one procedure before questions/actions; invocation is not a read. Read the owning procedure before blocked/unsupported responses too. Before mutation plans/approval, successfully read its required pre-action references, selected branches only. Do not reload successful reads. On failure, try only permitted bounded exact-path reads with any supported reader; never bypass restrictions or search broadly. If still unavailable: blocked: reference-unavailable, name missing references and inability to plan. Never invent requirements/plans. Failures first.

Cleanup and receipt-backed execution go directly to their lifecycle/producer owner; do not reopen Search intake, provisioning or hardening.

Before expensive service discovery, reuse supplied resource/intent; otherwise ask one early USE EXISTING / FIND CANDIDATES / CREATE NEW choice. Only FIND enumerates; supplied identity uses exact/minimum scoped resolution. CREATE checks its proposed name, not existing-service inventories. Preserve these answers across source/KB/CU/model handoffs; selection is not write approval.

Searchable docs: KB + validated retrieval. Confirm intent once; KS-only must be explicit. Child success is not KB completion. Unclear/compound/mode/completion: read.

Route by requested operation, not existing KB source count. Connecting an existing KB with two or more sources, without changing the KB, uses Connect. Read-only operations use their owning procedure and actual helper constraints; this does not add retrieval modes or supported source kinds. Explicit unsupported provisioning or multi-source KB creation/reconfiguration uses Diagnose and stops before discovery, even when connecting an agent is also requested. This routing takes precedence over classic-search terms (e.g. hybrid search) in compound requests. Never end in a plain refusal: Diagnose gives the boundary, docs pointer and agent handoff; writes still need an approved concrete plan. Do not silently execute only the supported part of a compound request. If existing-KB connection versus KB creation/reconfiguration is unclear, read intent-routing and clarify that scope before Azure discovery. Never infer KB mutation.

Outcome	Read
Cleanup	Plan cleanup
Failure/drift	Diagnose
Unsupported connector provisioning / multi-source KB creation or reconfiguration	Diagnose
Connect	Connect
Read KB	Query
Search only	Search
File KS only	File
Blob/ADLS KS only	Blob
Searchable/KB	KB

Generic agents: microsoft-foundry. Reads: no approval; approve unchanged plans before writes. Hide hashes. No Search/Storage keys, scope widening, guessed identity/boundaries, drift repair or joint cleanup/creation approval. Acceptance != success.

Files

ATTRIBUTION.mdAdded by AutoGineer977 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.7 KiB
agents/connect-hosted-toolbox.md7.8 KiB
agents/connect-hosted.md7.8 KiB
agents/connect-prompt-sdk-fallback.md7.8 KiB
agents/connect.md7.8 KiB
agents/create-missing-agent.md7.8 KiB
helpers/_blob_observation.pyScript4.4 KiB
helpers/_blob_source_read.pyScript39.5 KiB
helpers/_bootstrap_io.pyScript30.1 KiB
helpers/_cleanup_dependencies.pyScript27.5 KiB
helpers/_cleanup_receipts.pyScript13.5 KiB
helpers/_common.pyScript36.2 KiB
helpers/_document_adapters.pyScript15.0 KiB
helpers/_document_limits.pyScript3.9 KiB
helpers/_embedding.pyScript7.0 KiB
helpers/_file_inventory.pyScript24.4 KiB
helpers/_file_source_config.pyScript15.6 KiB
helpers/_indexer_observation.pyScript7.1 KiB
helpers/_initial_prompt.pyScript12.5 KiB
helpers/_private_json.pyScript2.4 KiB
helpers/_progress.pyScript12.1 KiB
helpers/_prompt_read.pyScript17.7 KiB
helpers/_search_read.pyScript6.0 KiB
helpers/_source_readback.pyScript1.6 KiB
helpers/blob-contracts.md7.8 KiB
helpers/blob-cu-contracts.md7.8 KiB
helpers/blob_inventory.pyScript17.1 KiB
helpers/blob_recheck.pyScript64.6 KiB
helpers/blob_source.pyScript35.8 KiB
helpers/bootstrap-contracts.md7.8 KiB
helpers/bootstrap_azure.pyScript41.5 KiB
helpers/cleanup_plan.pyScript41.4 KiB
helpers/contracts.md7.8 KiB
helpers/cu_ingestion_auth.pyScript12.5 KiB
helpers/document-assessment.md7.8 KiB
helpers/document_assess.pyScript14.0 KiB
helpers/file-upload-recovery.md7.8 KiB
helpers/file_cu_canary.pyScript32.7 KiB
helpers/file_cu_mi.pyScript9.6 KiB
helpers/file_ingest.pyScript15.4 KiB
helpers/file_source.pyScript31.7 KiB
helpers/file_upload.pyScript53.7 KiB
helpers/hosted_connect.pyScript30.8 KiB
helpers/kb-contracts.md7.8 KiB
helpers/knowledge_base_retrieve.pyScript7.7 KiB
helpers/model-discovery-contracts.md7.8 KiB
helpers/model-discovery-scopes.md7.8 KiB
helpers/model_discovery.pyScript23.7 KiB
helpers/private-artifacts.md7.2 KiB
helpers/private_artifacts.pyScript4.8 KiB
helpers/prompt_cleanup.pyScript22.0 KiB
helpers/prompt_connect.pyScript62.3 KiB
helpers/requirements-assessment.txt103 B
helpers/retrieval-verification-contracts.md7.8 KiB
helpers/retrieval_verify.pyScript19.6 KiB
helpers/search-intake-contracts.md7.6 KiB
helpers/search_intake.pyScript18.4 KiB
helpers/search_reconcile.pyScript59.7 KiB
helpers/source_vector.pyScript33.2 KiB
helpers/throttle-recovery.md5.0 KiB
helpers/vector-contracts.md7.8 KiB
knowledge-bases/create.md8.1 KiB
knowledge-bases/retrieve.md7.8 KiB
knowledge-sources/create-azure-blob.md7.8 KiB
knowledge-sources/create-file.md7.8 KiB
lifecycle/cleanup.md7.8 KiB
references/abstention.md1.0 KiB
references/blob-binding-evidence.md7.8 KiB
references/blob-indexer-observation.md7.7 KiB
references/blob-ingestion-progress.md6.5 KiB
references/blob-readiness-recheck.md7.8 KiB
references/blob-vector-readiness.md2.6 KiB
references/bootstrap-azure.md7.8 KiB
references/content-fit.md7.8 KiB
references/cu-ingestion.md7.8 KiB
references/file-cu-canary.md7.8 KiB
references/intent-routing.md7.7 KiB
references/owner.md2.1 KiB
references/platform-contracts.md7.7 KiB
references/platform-interfaces.md7.8 KiB
references/resource-intake.md7.8 KiB
references/search-substrate.md7.8 KiB
references/standard-cu.md7.8 KiB
search-services/create.md7.8 KiB
troubleshooting/diagnose.md8.7 KiB

knowledge-sources/create-azure-blob.md

Create a Blob or ADLS Gen2 knowledge source

When to use

One Blob/ADLS; types/API.

Do not use

No uploads/unselected boundaries/other connectors. Never modify objects.

Inputs and discovery order

Resolve prompt/session/workspace, then az account show for caller/tenant/default subscription. Explicit scope wins; never silently switch context. Missing CLI/sign-in blocks discovery, not proof of absence. Reads need no approval except content inspection: exact sample authorization. Silence is not approval. Recommend; after discovery batch compatible choices only for unresolved decisions. Reuse informed choices; separate sample-content consent from resource/permission/CU/source/KB approvals.

Input	Why needed	Required?	Discovery order	Safe default	If missing or unanswered	Reconfirmation trigger
Scope/Search/access	Target	Pre-write	Exact Azure GET	Reuse/new	Choices	Scope/access
Storage/container/prefix	Data	Pre-list	URL/name	No implicit root	Choose boundary	Scope
Objects/ETags/versions/ACLs	Drift	Yes	Inventory	None	Read/block	Any
Processing/API/models	Mode	Yes	Content	No extraction default	Assess/choose	Content/mode
Owner/name/cost/network/cleanup	Owner	Pre-plan	Caller	Azure user	Override	Any

Decisions

Opt-in title/content; no Q&A required. No auto-sample/query or filename defaults.

Search operation; bootstrap. No routine policy reads. Reuse Storage; never create data or a KB.

Names/URLs/unresolved accounts: read resource intake; reuse derived fields. After account selection, enumerate only unresolved containers: az storage container list --account-name <account> --auth-mode login --subscription <sub> --num-results '*'. Known containers skip enumeration; validate the selected boundary directly. Denied listing: ask for an exact container, never broaden access or infer absence. Resolve scope; root "" requires explicit choice. No object inventory/download before boundary selection. No keys/SAS; missing Storage/content: separate provisioning/upload workflow.

Missing roles: RBAC. Propose least privilege; obtain consent/readback; resume planning.

Honor explicit processing choices only when informed and compatible. Unknown content or mode/goal conflicts: read content-fit. MUST assess/clarify before planning: bounded authorized samples or questions about text-only versus multimodal content and answer dependence. Reuse answers; honor informed reduced outcomes. Unavailable/declined/unreadable inspection means ask, not assume text-only. No filename/MIME inference, silent default/downgrade or model calls. Explain tradeoffs; obtain concrete-plan/CU/data approvals. Vectors are independent. New unresolved search: recommend Hybrid; confirm tradeoffs/opt-out. Keyword-only: no embedding discovery. Lexical skips vector references. Do not download blobs to decide. If CU/models: discovery.

HNS selects ADLS; preserve case. Blob non-root prefixes end in /; ADLS directories do not. Arbitrary partial-name prefixes: never append / or widen. GA 2026-04-01 minimal is Blob-only extractive; synthesis/agents/permissions need approved preview. Permission retrieval forwards the caller's Entra token per-request through x-ms-query-source-authorization, scoped to https://search.azure.com/.default; never persist it.

Read Blob contract; run read-only python helpers/blob_source.py --discover <selected-boundary.json>.

Proposed plan

python helpers/blob_source.py --plan intent.json

Intent. Bind dependencies/boundary/API/processing/access/read/poll limits; public/system-assigned; no image verbalization, permissions or schedule settings. Vectors use processing: minimal-vector and embedding choices.

Opt-in Content Understanding

processing: standard-cu: read CU branch. No provisioning/default-model/local-auth changes or probes. cu-prerequisite-missing: return missing evidence to owner; never downgrade. Combine CU/auth/data consent; no manual auth questions.

CU-only omits embedding. Verify CU-capable services.ai.azure.com region/required models/effective access, not existence. Search's system identity needs Cognitive Services User on CU. Verify embedding access separately; Storage stays keyless. No File keys/chat/asset store; CU isn't KB reasoning.

Return planned, execution_input (approval.confirmed: false), approval_summary: changes/counts/bytes/processing/access/cost/ownership/cleanup. Keep evidence private.

Exact reuse: no mutation approval/executor. Read source, observe selected Storage twice; reread source/ETag/generated IDs. Redacted bindings need approved input/successful creation result matching fresh ETag. Unproven provenance blocks; never infer accounts from containers. Identity/inventory/ACLs aren't ingestion readiness/retrieval.

Confirmation

Keep immutable plan_fingerprint/cleanup_approved: false; approve changes, not hashes; save only execution_input. Refresh access/cost/data consent pre-write. Scope/object/access/definition/ model/ETag/known-requirement drift: rerun --plan, replace artifact and discard old consent. Never edit nested plans or recompute hashes manually; receipts are not future consent.

Mutation

New minimal or Standard/CU, with/without vectors: read checkpoint/recheck; Select an existing operator-private directory; retain approved input there before writes. Reuse: read-only capture, never replay.

python helpers/blob_source.py --input <approved-envelope.json> --receipt-dir <absolute-private-directory> --compact

reconcile-and-monitor revalidates then creates/reuses. Never update drift, suffix-create, change schedules, or patch children. Source helpers never assign roles; bootstrap owns access gaps. Private ADLS needs both blob and dfs links/DNS.

Verification

Verify core configuration/children and relevant completed cycle: zero failed items. Require actual Storage binding. Unscheduled reuse/old success/active are not proof. Inventories detect drift, not atomic snapshots; schedules evolve. Vectors: query verification; deployment isn't readiness/retrieval.

Failure and partial completion

Preserve first failure/request ID and creation. Watch expiry pauses; resume GET-only by receipt. 403 is inaccessible, not absent. Exit 2: blocked/no-write; 3: partial/ownership/separate cleanup. No alternate name or unapproved recreate. Use recovery; no replay.

Cleanup

Separately approved search_reconcile.py: delete only run-owned source with current ETag/owned digest; Search deletes children. Never delete Storage, objects or reused resources. Bootstrap owns separately approved role cleanup; unclear ownership blocks.

Return contract

Return compact status/readiness/failure/warnings/private evidence; updates aren't files. Pass assessment/uncertainty/answer needs/mode through prerequisites to the KB owner; resume KB plus validated retrieval.

References

Authorities: failure/conflict/uncertainty only.

Official Blob procedure. ADLS HEAD.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

The author says: Azure

Security

What our scanner noticed· Medium risk

References to credential files
Instructions that use the network
Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/foundry-iq-skills/skills/foundry-iq · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/foundry-iq-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download foundry-iq.zip