Skip to content

Add service principal Foundry onboarding and APIM routing - #80

Open
Zack Way (seiggy) wants to merge 3 commits into
mainfrom
feature/foundry-service-principal-onboarding
Open

Add service principal Foundry onboarding and APIM routing#80
Zack Way (seiggy) wants to merge 3 commits into
mainfrom
feature/foundry-service-principal-onboarding

Conversation

@seiggy

Copy link
Copy Markdown
Collaborator

Why

The policy engine currently discovers deployments from one configured Azure AI resource, which prevents centralized onboarding and routing across Foundry resources in a subscription or tenant.

What changed

  • Adds service-principal authentication and subscription or tenant-wide discovery of Foundry resources and model deployments.
  • Adds bulk onboarding that grants APIM's managed identity Cognitive Services access and queues existing APIM policies for reapplication.
  • Returns the resolved Foundry endpoint during precheck so all AI policy templates can route dynamically while continuing to use APIM managed identity credentials.
  • Adds dashboard onboarding controls, resource-qualified deployment targets, configuration guidance, and focused coverage for discovery and policy reapplication.

Notes

The discovery service principal is not used for inference and its secret is not copied into APIM. It requires Reader for discovery and Role Based Access Control Administrator where onboarding creates APIM role assignments.

Validation

  • Targeted .NET tests: 34 passed
  • React/TypeScript production build completed successfully

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 743498a2-db17-4d1f-a9e7-49cc555daf7c
@seiggy
Zack Way (seiggy) requested a review from a team August 19, 2026 16:39
Comment thread src/AIPolicyEngine.Api/Endpoints/DeploymentEndpoints.cs Fixed
Comment thread src/AIPolicyEngine.Tests/Integration/AccessProfilePrecheckTests.cs Fixed
Zack Way (seiggy) and others added 2 commits August 19, 2026 12:43
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 743498a2-db17-4d1f-a9e7-49cc555daf7c
Default CodeQL setup already scans this repository; the advanced workflow's duplicate SARIF upload is rejected by GitHub.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 743498a2-db17-4d1f-a9e7-49cc555daf7c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant