Microsoft Azure AI Foundry

Connect Microsoft Azure AI Foundry and Azure Machine Learning to Safeguard. The Azure role the service principal needs, which credentials work, and step-by-step setup.

Availability

This integration is switched on per workspace. If you do not see the card under Integrations, ask your Safeguard contact.

What it does

Safeguard reads an inventory of the AI assets you run in Azure: Azure Machine Learning workspaces and Azure AI Foundry hubs and projects, online endpoints and their deployments, serverless API endpoints, registered models with every version, and Azure AI Foundry resources with their model deployments and projects. For each one it records the model and version served, where the model came from, public network access, outbound isolation, customer-managed keys and how broad the Azure roles of its managed identity are. The results appear as AI asset inventory entries and continuous tests (asset inventory, public access, network isolation, customer-managed keys, least-privilege identities, pinned model versions, licence risk and model provenance). Catalog model licences are not returned by Azure Resource Manager, so the licence test points you to the model card in the Foundry catalog. Find the Microsoft Azure AI Foundry card under Integrations on the Project/Product tab (the AI Model filter shows only AI model cards). Nothing it reads is sent to a model: no customer data goes to third-party LLMs.

Public vs private

	Public	Private
What you enter	Nothing: there is no public mode	The tenant ID, the service principal's client ID and its client secret or certificate
Credential needed	Not applicable	A service principal with the Reader role
What you can scan	Not applicable	Every subscription the service principal can read, or the subscriptions and management group you name

Supported auth methods

Method	Use it when	Notes
Service principal with a client secret	The recommended default	Set an expiry on the secret and rotate it before it expires
Service principal with a certificate	Your policy prefers certificates over secrets	Upload the certificate and its private key in the connection

Permissions required

Safeguard only reads. Every call is an Azure Resource Manager read that the built-in Reader role allows. No data-plane call is made, so no Azure Machine Learning data-plane role (such as AzureML Data Scientist) is needed.

Service principal with a client secret

Permission / scope	Required?	What Safeguard uses it for
`Reader` role on each subscription (or on each resource group that holds your AI resources)	Required	All of the reads below
`Microsoft.Resources/subscriptions/read`	Required (in Reader)	Lists the subscriptions in scope
`Microsoft.MachineLearningServices/workspaces/read`	Required (in Reader)	Lists workspaces, hubs and projects: public network access, managed network, encryption, identity
`Microsoft.MachineLearningServices/workspaces/onlineEndpoints/read`	Required (in Reader)	Lists online endpoints: auth mode, public network access, identity
`Microsoft.MachineLearningServices/workspaces/onlineEndpoints/deployments/read`	Required (in Reader)	Lists each endpoint's deployments: model and version, instance type, outbound access, scaling
`Microsoft.MachineLearningServices/workspaces/serverlessEndpoints/read`	Required (in Reader)	Lists serverless API endpoints and the catalog model each serves
`Microsoft.MachineLearningServices/workspaces/models/read`	Required (in Reader)	Lists registered models
`Microsoft.MachineLearningServices/workspaces/models/versions/read`	Required (in Reader)	Lists every version of each registered model
`Microsoft.CognitiveServices/accounts/read`	Required (in Reader)	Lists Azure AI Foundry resources (accounts of kind AIServices): network access, encryption, local auth
`Microsoft.CognitiveServices/accounts/deployments/read`	Required (in Reader)	Lists each Foundry resource's model deployments and their version upgrade option
`Microsoft.CognitiveServices/accounts/projects/read`	Required (in Reader)	Lists each Foundry resource's projects and their identities
`Microsoft.Authorization/roleAssignments/read`	Required (in Reader)	Reads the Azure roles of each endpoint's, workspace's and project's managed identity
`Microsoft.Management/managementGroups/descendants/read` (in the Management Group Reader role, on that management group)	Optional	Only when the connection names a management group: lists the subscriptions under it

Least privilege: the Reader role on the resource groups that hold your workspaces and Foundry resources. Reader on the subscription is simpler and also lets Safeguard see roles granted at the subscription.

Service principal with a certificate

The same table applies: the role is the service principal's, whichever credential it signs in with.

Token types

Token type	Works?	Notes
Service principal client secret	Yes (recommended)	Created with `az ad sp create-for-rbac` or under App registrations > Certificates & secrets
Service principal certificate	Yes	Upload the certificate and private key
Managed identity	No	This connection signs in only with a service principal's client secret or certificate
Personal sign-in (OAuth)	No	Use a service principal
Read-only vs admin	Read-only only	The built-in Reader role is enough; Safeguard never needs Owner, Contributor or User Access Administrator

Expiry: a client secret expires on the date you set; 90 to 180 days is a common policy. When it expires the connection test fails with a sign-in error; create a new secret and update the connection.

What we never need: Owner, Contributor, any write or delete permission, listing keys (listKeys), the AzureML Data Scientist role, or any Azure Machine Learning or Azure OpenAI data-plane access.

Step-by-step setup

Create the credential in Microsoft Azure

In the Azure portal, open Microsoft Entra ID > App registrations > New registration, name it safeguard-ai-foundry-reader and register it.
Open the app's Certificates & secrets > New client secret, set an expiry and copy the secret value. The portal shows it only once.
Open each subscription (or resource group) to read, then Access control (IAM) > Add role assignment > Reader, and assign it to the app.
Note the Directory (tenant) ID and Application (client) ID from the app's overview.

Or with the Azure CLI

az login
az account set --subscription "<SUBSCRIPTION_ID>"

# Service principal with Reader on the subscription. Keep the printed appId, password and tenant.
az ad sp create-for-rbac \
  --name "safeguard-ai-foundry-reader" \
  --role "Reader" \
  --scopes "/subscriptions/<SUBSCRIPTION_ID>"

# Narrower: Reader on one resource group instead.
az role assignment create --assignee "<APP_ID>" --role "Reader" \
  --scope "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>"

# More subscriptions at once: Reader on their management group.
az role assignment create --assignee "<APP_ID>" --role "Reader" \
  --scope "/providers/Microsoft.Management/managementGroups/<MANAGEMENT_GROUP_ID>"

# Optional: a certificate instead of a client secret.
az ad sp credential reset --id "<APP_ID>" --create-cert

# Check the grant.
az role assignment list --assignee "<APP_ID>" --scope "/subscriptions/<SUBSCRIPTION_ID>" -o table

Connect it in Safeguard

Open Integrations and choose the Project/Product tab (optionally the AI Model filter).
Click Connect on the Microsoft Azure AI Foundry card.
Enter the tenant ID, the client ID and the client secret (or the certificate). Optionally list the subscriptions to read, or a management group.
The Setup steps section shows the Azure CLI commands above with your subscription filled in, with a copy button.
Save, then click Check access. Safeguard signs in, lists the subscriptions, and lists the workspaces and Foundry resources of the first one. Success reads Signed in; <n> subscription(s) will be read. In the first: <n> Azure Machine Learning workspace(s) and <n> Azure AI services account(s) visible. A failure names the missing permission.

Webhooks and triggers

This integration has no webhooks. The inventory is read each time the connection's tests run, on their schedule or when you run them by hand.

What we read and store

Read: the configuration of workspaces, hubs, projects, online endpoints and deployments, serverless endpoints, registered model versions, Foundry resources and their deployments and projects, and the role assignments of their managed identities.
Stored: the inventory (names, resource IDs, regions, model names and versions, network, encryption and identity settings, the roles found) in the AI asset inventory, and the test results. An asset that disappears is marked inactive, not deleted. The client secret or certificate is encrypted at rest and never shown again after you save it.
Not stored or read: model files, training data, prompts, completions, scoring requests, endpoint keys and any data-plane content.
No customer data from this integration is sent to third-party LLMs.

Troubleshooting

Message you see	Cause	Fix
`... Check the client id and its secret or certificate (and that the secret has not expired).`	Microsoft Entra ID refused the sign-in	Check the client ID, create a new secret if it expired, and update the connection
`... Check the tenant id and that the tenant is in the <cloud> cloud (a US Government tenant signs in at login.microsoftonline.us).`	The tenant ID is wrong, or the tenant is in another Azure cloud	Correct the tenant ID or the connection's cloud
`Signed in, but no Azure subscription is visible to this service principal: assign it the Reader role on the subscription or resource group to read.`	The service principal has no role on any subscription	Assign Reader on the subscription or resource group
`Subscription <id> is named by the connection but not visible to the credential: assign it the Reader role.`	A subscription listed in the connection has no Reader assignment	Assign Reader on that subscription, or remove it from the connection
`... The credential needs Microsoft.MachineLearningServices/workspaces/read (in the Reader role).`	A custom role or a deny assignment blocks that read	Assign the built-in Reader role; the message names the exact action
`... The credential needs Microsoft.Authorization/roleAssignments/read (in the Reader role).`	Role assignments cannot be read, so identity breadth is unknown	Assign Reader at the subscription
`... Grant the Reader role (it includes <action>).`	One part of a subscription (a workspace's endpoints, a Foundry resource's deployments) refused a read	Assign the built-in Reader role; the other parts are still read
`Signed in to <n> subscription(s), but the service principal cannot read <action>: assign it the Reader role.`	The connection test found a refused read	Assign the built-in Reader role

Rotation and disconnect

Rotate: create a new client secret on the app registration, edit the connection in Safeguard, paste the new secret and save, then delete the old secret in Azure.
Disconnect: delete the connection in Safeguard, then delete the client secret or the whole app registration in Microsoft Entra ID and remove its Reader assignments.

Vendor references

Workspaces - List By Subscription (Azure Machine Learning REST API), checked 2026-10-16.
Online Endpoints - List, checked 2026-10-16.
Online Deployments - List, checked 2026-10-16.
Serverless Endpoints - List, checked 2026-10-16.
Model Containers - List, checked 2026-10-16.
Model Versions - List, checked 2026-10-16.
Accounts - List (Azure AI services account management), checked 2026-10-16.
Deployments - List (Azure AI services account management), checked 2026-10-16.
Microsoft.CognitiveServices/accounts/projects template reference, checked 2026-10-16.
Role Assignments - List For Subscription, checked 2026-10-16.
Azure built-in roles, checked 2026-10-16.

Microsoft Azure AI Foundry

On this page