Foundry Iq

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Data and AI
MIT
Medium risk
Has scripts

From the author

Foundry IQ knowledge bases. WHEN: make local or Blob documents searchable; create/diagnose KBs; triage unsupported connectors or multi-source KB creation/reconfiguration (even with classic-search terms); connect existing KB to agents (including multi-source KBs); create/reuse a Search service; retrieve from an existing knowledge base with citations; no brand words needed. Read its procedure before query/target questions. NOT: other KB providers, repository-file search, classic Azure AI Search index/query/app work with no Foundry IQ KB or connector request, generic agent creation.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Foundry IQ provides a structured framework for creating, diagnosing, and connecting knowledge bases to AI agents. It supports making local or Blob-based documents searchable, managing multi-source knowledge configurations, and retrieving information with citations. The skill emphasizes strict adherence to defined procedures for service discovery, resource creation, and troubleshooting to ensure reliable agent-knowledge integration.

What it does

Creates searchable knowledge bases from local or Azure Blob storage documents.
Connects existing knowledge bases to AI agents.
Diagnoses issues with knowledge base configurations or unsupported connectors.
Retrieves information from knowledge bases with source citations.
Manages the lifecycle of search services and knowledge sources.
Routes requests based on specific operational needs rather than source counts.

When to use it

When you need to make local or cloud-stored documents searchable by an AI agent.
When connecting an existing knowledge base to a new or current agent.
When troubleshooting or diagnosing a knowledge base configuration.
When you need to create a new search service or knowledge source.
When performing retrieval tasks that require citations from a knowledge base.

Advantages

Provides a clear, procedural approach to knowledge base management.
Ensures consistent handling of multi-source knowledge configurations.
Includes built-in diagnostic paths for troubleshooting.
Supports secure, citation-backed retrieval for agent responses.
Prevents unauthorized or unsupported configuration changes.

Usage examples

“Create a new knowledge base from my Azure Blob container.”: The agent will initiate the knowledge base creation procedure, validating the source and setting up the necessary search indexing.
“Connect my existing knowledge base to the current agent.”: The agent will follow the connection workflow to link the specified knowledge base to the agent's retrieval pipeline.
“Why is my multi-source knowledge base failing to index?”: The agent will trigger the diagnostic procedure to identify configuration drifts or unsupported connector issues.
“Retrieve information about project timelines from the knowledge base.”: The agent will query the knowledge base and provide an answer with citations from the source documents.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/foundry-iq/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip foundry-iq.zip -d .agents/skills

Documentation by Microsoft

Foundry IQ

Read one procedure before questions/actions; invocation is not a read. Read the owning procedure before blocked/unsupported responses too. Before mutation plans/approval, successfully read its required pre-action references, selected branches only. Do not reload successful reads. On failure, try only permitted bounded exact-path reads with any supported reader; never bypass restrictions or search broadly. If still unavailable: blocked: reference-unavailable, name missing references and inability to plan. Never invent requirements/plans. Failures first.

Cleanup and receipt-backed execution go directly to their lifecycle/producer owner; do not reopen Search intake, provisioning or hardening.

Before expensive service discovery, reuse supplied resource/intent; otherwise ask one early USE EXISTING / FIND CANDIDATES / CREATE NEW choice. Only FIND enumerates; supplied identity uses exact/minimum scoped resolution. CREATE checks its proposed name, not existing-service inventories. Preserve these answers across source/KB/CU/model handoffs; selection is not write approval.

Searchable docs: KB + validated retrieval. Confirm intent once; KS-only must be explicit. Child success is not KB completion. Unclear/compound/mode/completion: read.

Route by requested operation, not existing KB source count. Connecting an existing KB with two or more sources, without changing the KB, uses Connect. Read-only operations use their owning procedure and actual helper constraints; this does not add retrieval modes or supported source kinds. Explicit unsupported provisioning or multi-source KB creation/reconfiguration uses Diagnose and stops before discovery, even when connecting an agent is also requested. This routing takes precedence over classic-search terms (e.g. hybrid search) in compound requests. Never end in a plain refusal: Diagnose gives the boundary, docs pointer and agent handoff; writes still need an approved concrete plan. Do not silently execute only the supported part of a compound request. If existing-KB connection versus KB creation/reconfiguration is unclear, read intent-routing and clarify that scope before Azure discovery. Never infer KB mutation.

Outcome	Read
Cleanup	Plan cleanup
Failure/drift	Diagnose
Unsupported connector provisioning / multi-source KB creation or reconfiguration	Diagnose
Connect	Connect
Read KB	Query
Search only	Search
File KS only	File
Blob/ADLS KS only	Blob
Searchable/KB	KB

Generic agents: microsoft-foundry. Reads: no approval; approve unchanged plans before writes. Hide hashes. No Search/Storage keys, scope widening, guessed identity/boundaries, drift repair or joint cleanup/creation approval. Acceptance != success.

Files

ATTRIBUTION.mdAdded by AutoGineer977 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.7 KiB
agents/connect-hosted-toolbox.md7.8 KiB
agents/connect-hosted.md7.8 KiB
agents/connect-prompt-sdk-fallback.md7.8 KiB
agents/connect.md7.8 KiB
agents/create-missing-agent.md7.8 KiB
helpers/_blob_observation.pyScript4.4 KiB
helpers/_blob_source_read.pyScript39.5 KiB
helpers/_bootstrap_io.pyScript30.1 KiB
helpers/_cleanup_dependencies.pyScript27.5 KiB
helpers/_cleanup_receipts.pyScript13.5 KiB
helpers/_common.pyScript36.2 KiB
helpers/_document_adapters.pyScript15.0 KiB
helpers/_document_limits.pyScript3.9 KiB
helpers/_embedding.pyScript7.0 KiB
helpers/_file_inventory.pyScript24.4 KiB
helpers/_file_source_config.pyScript15.6 KiB
helpers/_indexer_observation.pyScript7.1 KiB
helpers/_initial_prompt.pyScript12.5 KiB
helpers/_private_json.pyScript2.4 KiB
helpers/_progress.pyScript12.1 KiB
helpers/_prompt_read.pyScript17.7 KiB
helpers/_search_read.pyScript6.0 KiB
helpers/_source_readback.pyScript1.6 KiB
helpers/blob-contracts.md7.8 KiB
helpers/blob-cu-contracts.md7.8 KiB
helpers/blob_inventory.pyScript17.1 KiB
helpers/blob_recheck.pyScript64.6 KiB
helpers/blob_source.pyScript35.8 KiB
helpers/bootstrap-contracts.md7.8 KiB
helpers/bootstrap_azure.pyScript41.5 KiB
helpers/cleanup_plan.pyScript41.4 KiB
helpers/contracts.md7.8 KiB
helpers/cu_ingestion_auth.pyScript12.5 KiB
helpers/document-assessment.md7.8 KiB
helpers/document_assess.pyScript14.0 KiB
helpers/file-upload-recovery.md7.8 KiB
helpers/file_cu_canary.pyScript32.7 KiB
helpers/file_cu_mi.pyScript9.6 KiB
helpers/file_ingest.pyScript15.4 KiB
helpers/file_source.pyScript31.7 KiB
helpers/file_upload.pyScript53.7 KiB
helpers/hosted_connect.pyScript30.8 KiB
helpers/kb-contracts.md7.8 KiB
helpers/knowledge_base_retrieve.pyScript7.7 KiB
helpers/model-discovery-contracts.md7.8 KiB
helpers/model-discovery-scopes.md7.8 KiB
helpers/model_discovery.pyScript23.7 KiB
helpers/private-artifacts.md7.2 KiB
helpers/private_artifacts.pyScript4.8 KiB
helpers/prompt_cleanup.pyScript22.0 KiB
helpers/prompt_connect.pyScript62.3 KiB
helpers/requirements-assessment.txt103 B
helpers/retrieval-verification-contracts.md7.8 KiB
helpers/retrieval_verify.pyScript19.6 KiB
helpers/search-intake-contracts.md7.6 KiB
helpers/search_intake.pyScript18.4 KiB
helpers/search_reconcile.pyScript59.7 KiB
helpers/source_vector.pyScript33.2 KiB
helpers/throttle-recovery.md5.0 KiB
helpers/vector-contracts.md7.8 KiB
knowledge-bases/create.md8.1 KiB
knowledge-bases/retrieve.md7.8 KiB
knowledge-sources/create-azure-blob.md7.8 KiB
knowledge-sources/create-file.md7.8 KiB
lifecycle/cleanup.md7.8 KiB
references/abstention.md1.0 KiB
references/blob-binding-evidence.md7.8 KiB
references/blob-indexer-observation.md7.7 KiB
references/blob-ingestion-progress.md6.5 KiB
references/blob-readiness-recheck.md7.8 KiB
references/blob-vector-readiness.md2.6 KiB
references/bootstrap-azure.md7.8 KiB
references/content-fit.md7.8 KiB
references/cu-ingestion.md7.8 KiB
references/file-cu-canary.md7.8 KiB
references/intent-routing.md7.7 KiB
references/owner.md2.1 KiB
references/platform-contracts.md7.7 KiB
references/platform-interfaces.md7.8 KiB
references/resource-intake.md7.8 KiB
references/search-substrate.md7.8 KiB
references/standard-cu.md7.8 KiB
search-services/create.md7.8 KiB
troubleshooting/diagnose.md8.7 KiB

references/cu-ingestion.md

Shared CU ingestion contract

For Standard File and indexed Blob/ADLS; adapters own source-specific wire/auth and ingestion lifecycle. Existing index/source/KB connection or query does not trigger CU setup or reingestion. Unsupported connectors remain unsupported; do not add SharePoint/OneLake adapters. Use native Azure AI Services; no project, agent, external setup skill or azd, not agent-tool discovery or general AI-app setup.

Independent dependencies

Input modality is text-only, multimodal or mixed/unknown, not a model choice. Ask only unknown answer dependence: layout/text versus visual semantics. Minimal extracts supported basic text; Standard CU already supports OCR/layout to structured Markdown/text chunks without optional image descriptions.

Plan each purpose, endpoint/deployment, access and cost. Shared accounts do not merge these choices:

Dependency	Selected when	Purpose and boundary
Content Understanding	Standard extraction	Billable extraction through `AIServices`; neither source vectors nor KB reasoning.
Ingestion chat model	Optional image/figure descriptions selected on a supported path	Descriptions also yield text. Separate ingestion-model purpose, not an Azure RBAC role or necessarily a new physical deployment; compatible deployment reuse still requires path-specific access/cost approval.
Source embedding model	Hybrid/vector search selected	Azure OpenAI models (e.g. `text-embedding-3-small`), in standalone or CU's `AIServices` account; no separate account required. Embedding/data movement/vector storage costs; not extraction/chat.
KB chat model	Reasoning or answer synthesis selected	KB reasoning/answers: independent model/access/cost, not source embeddings.

Current typed File/Blob planners set disableImageVerbalization: true and omit chatCompletionModel; their new-CU validators enforce this profile. Basic CU OCR/layout extraction remains supported. Broader service/API and generic/legacy complete-wire compatibility is unchanged, not universally disabled. There is no typed planner opt-in here: do not toggle flags or bypass validation. Require only models the selected CU operation uses; a CU deployment prerequisite does not enable Search embeddingModel. Never add CU because hybrid was chosen, add source vectors because CU was chosen, or require KB chat merely for ingestion. Preserve existing selections; changing any dependency needs concrete approval.

Output and API distinctions

The CU skill outputs text_sections.content as Markdown; normalized_images is a separate optional output. This describes processing, not new source request fields or a promise to persist generated .md files. No guarantee covers every table/chart. Since 2026-05-01-preview, the CU skill's description opt-in pairs modelName and modelDeployment for deployed Azure OpenAI chat in its attached account. Knowledge-source APIs instead expose chatCompletionModel and disableImageVerbalization; do not transplant skill fields into source requests. File's example supplies independent aiServices, embeddingModel and chatCompletionModel; it does not make every example option mandatory. Blob documents a multimodal chat deployment if image verbalization is enabled. Do not infer ingestion verbalization from any chat dependency or KB synthesis.

Necessary checks, not extra configuration

Use verified adapter auth, not nullable shared schema: Blob/ADLS prefer established Search system MI plus Cognitive Services User on CU; no keys or fallback after denial. File MI is implemented; live compatibility unverified. Never transplant Blob MI to File. Shared cu_ingestion_auth.py discloses auth; private ARM listKeys execution remains File-only.

No "can you configure credentials/MI?" or ENV-ready confirmation. Disclose exact auth scope/cost/data/access in one concrete approval. Reuse verified dependencies; no setup for exact reuse. Planning is GET-only, with no credential reads. Key acquisition is helper-internal only after unchanged fingerprinted approval; never return or persist secrets.

Reuse fresh readbacks; no account-configuration/defaults confirmation or direct CU analysis probe. Verify through approved ingestion, not by a new billable preflight. File auth GETs https://management.azure.com<cu-resource-id>?api-version=2024-10-01 and matches resource ID, kind: AIServices, properties.provisioningState: Succeeded, endpoint/location/network; key modes need local auth, MI does not. Use published operation-region support. Blob: identity/role readbacks. CU aiServices.uri and embedding embeddingModel.azureOpenAIParameters.resourceUri need independent readiness. Embedding URI/auth must match the connector/API, not generic embedding-skill aliases. prerequisites.configuration records selected processing/deployment facts, not extra settings or success proof. Metadata is not effective-access/ingestion proof. Explain actual key/deployment/network failures; never invent analyzers/defaults. Preserve first status/request ID and ownership.

Keep a useful draft when one dependency is pending

Return "Draft ready; one dependency check remains", not rejection or execution input:

{"planning_status":"blocked_pending_dependency","execution_input":null,"resolved_choices_ref":"<retained private intent/readbacks>","remaining_checks":[{"target":"<exact selected dependency>","action":"<necessary GET or owner action>","success_criteria":"<specific required fields/access>","reason":"<actual execution risk>"}],"next_step":"Complete only the remaining checks, then resume planning."}

Retain resolved names/boundaries/model choices/caller/owner/readbacks/approvals privately. Do not rediscover or re-question unchanged choices. List only unresolved checks; missing generic attestation does not prove a missing dependency. Retain actual failures and earlier completed writes/ownership; the draft performs none. Never pass this summary to --input, fabricate execution input or seek execution approval with unresolved dependencies. Never fill future verification fields or transfer infrastructure consent to source/KB writes. Resume --plan with retained choices and fresh readbacks; approve only new/material changes, preserving valid independent approvals. No silent extraction downgrade.

Only missing resources need setup

Use packaged native bootstrap for missing account/identity/role/local-auth plans and scoped execution/readback; never ask the user to configure them manually. Consolidate already-resolved changes when approving; retain fingerprints and explicit RBAC/local-auth consent. Source-only consent never grants permission changes. New principals/drift need new approval, not repeated consent for unchanged actions. No new RBAC engine or silent grants. Unsupported updates: bootstrap-cu-contract-unresolved; name the missing operation, never invent PATCH. For CU, use account A's body with kind: AIServices, API 2024-10-01. Only approved File key setup enables local auth; MI stays keyless. Retain approved region/tags/network/cost/ownership. Obtain separate approval for resource/access changes; verify IDs, endpoint, deployments and settings before resuming.

Authorities

Authorities: failure/conflict/uncertainty only.

CU account PUT, CU skill and supported regions, File standard, Blob prerequisites.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

The author says: Azure

Security

What our scanner noticed· Medium risk

References to credential files
Instructions that use the network
Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/foundry-iq-skills/skills/foundry-iq · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/foundry-iq-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download foundry-iq.zip