For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Connect Solo Enterprise for agentregistry to an Azure AI Foundry project so that you can discover deployed agents and monitor them in the registry UI.

This guide walks you through how to connect Solo Enterprise for agentregistry to Azure AI Foundry, so that you can discover deployed agents and add them as instances to the registry Instances view in the registry UI.

Before you begin

1. Set up an OIDC provider. This guide assumes that you installed Keycloak. Make sure to follow the General setup tab to install Keycloak with the required realm settings, clients, and secrets.

2. Install Solo Enterprise for agentregistry.

3. Make sure that you have access to an Azure account with sufficient permissions to create Microsoft Entra app registrations, Azure AI Foundry projects, and AI Foundry agents.

Step 1: Create an Entra app registration

The Entra app registration is the service identity that Solo Enterprise for agentregistry uses to authenticate with Azure. When the registry syncs agents that you deployed in your Foundry project, it uses the app registration’s client ID and secret to request a token from Microsoft Entra. The registry then calls the Foundry project API with that token to discover deployed agents.

In this step, you create the Entra app registration and generate the client secret.

1. Log in to the Azure portal and go to Microsoft Entra ID → +Add → App registrations.

2. Create your app registration.

   • Enter a name for the app, such as agentregistry-foundry.
   • Choose the account type that can access your app.
   • Leave the redirect URI blank. Then, click Register.

3. On the overview page for your Entra app, get the Application (client) ID and Directory (tenant) ID and save them as environment variables.

   export AZURE_TENANT_ID=<directory-tenant-ID>
   export AZURE_CLIENT_ID=<application-client-ID>

4. Go to Manage → Certificates & secrets → + New client secret. Set an expiration date for your certificate, and click Add.

5. Copy the secret Value immediately as it is only shown once and save it in an environment variable.

   export AZURE_CLIENT_SECRET=<client-secret-value>

6. Store the client secret value in a Solo Enterprise for agentregistry Secret. This way, the value is written to the server-side secret backend and never stored in plain text in your runtime.

   arctl apply -f - <<EOF
   apiVersion: ar.dev/v1alpha1
   kind: Secret
   metadata:
     name: microsoft-foundry-creds
   spec:
     type: Opaque
     stringData:
       clientSecret: "${AZURE_CLIENT_SECRET}"
   EOF

   Example output:

   ✓ Secret/microsoft-foundry-creds created
   

7. Verify that the Secret is created.

   arctl get secret microsoft-foundry-creds

   Example output:

   NAME                      TYPE     DATA
   microsoft-foundry-creds   Opaque   1
   

Step 2: Create a Foundry project

A Foundry project is the Azure AI Foundry resource that organizes your AI models, deployments, and agents. Solo Enterprise for agentregistry uses the project’s API endpoint to call the Foundry data plane and list agents during discovery.

In this step, you create a Foundry project so that you can later deploy agents to it. If you already have a Foundry project you want to use, skip this step and continue with Step 3: Grant project-scoped RBAC.

1. Open the Azure AI Foundry home page (ai.azure.com).
2. Click Start building if you never created a project before, or click Create project to create a new Foundry project.
3. Enter a name for your project.
4. Expand the Advanced options and set the Location to a supported Azure region, such as East US, West US 2, or North Central US.
5. Click Create and wait for the provisioning to complete. This can take several minutes.
6. After the project is ready, go to the project overview page. Find the Project endpoint and store it in an environment variable. The project endpoint follows the https://<foundry-account>.services.ai.azure.com/api/projects/<project-name> format.

   export AZURE_PROJECT_ENDPOINT=<project-endpoint>

Step 3: Grant project-scoped RBAC

The Entra app registration you created in Step 1 has no Azure permissions by default. You must explicitly grant it the Foundry User role on the Foundry project so that Solo Enterprise for agentregistry can call the Foundry data-plane API to list agents, models, and endpoints. Assigning the role at the resource group or subscription level is not sufficient as the Foundry data-plane API enforces access at the project level.

1. Go to portal.azure.com and search for your Foundry project by name, or navigate to it through your resource group. The resource type can appear as Azure AI project or Foundry project depending on your portal version.
2. On the project resource, open Access control (IAM).
3. Choose Add → Add role assignment.
4. Select Foundry User and click Next.
5. Under Assign access to, select User, group, or service principal.
6. Click Select members and search for the Entra app registration that you created earlier (agentregistry-foundry).
7. Click Review + assign.

Step 4: Register the MicrosoftFoundry runtime

Register the Azure AI Foundry project as a discovery runtime in Solo Enterprise for agentregistry. The runtime uses the Entra client-credentials flow to call the Foundry project API and sync agents as deployed instances into the registry UI.

1. Create the MicrosoftFoundry runtime.

   arctl apply -f - <<EOF
   apiVersion: ar.dev/v1alpha1
   kind: Runtime
   metadata:
     name: foundry
   spec:
     type: MicrosoftFoundry
     config:
       projectEndpoint: "${AZURE_PROJECT_ENDPOINT}"
       auth:
         oidc:
           issuer: "https://login.microsoftonline.com/${AZURE_TENANT_ID}/v2.0"
           clientId: "${AZURE_CLIENT_ID}"
           clientSecretRef:
             name: microsoft-foundry-creds
             key: clientSecret
   EOF

   Field	Description
   type	Set to MicrosoftFoundry to enable the Azure AI Foundry discovery provider.
   config.projectEndpoint	The Azure AI Foundry project endpoint.
   config.auth.oidc.issuer	The Microsoft Entra OIDC issuer URL for your tenant. Follows the format https://login.microsoftonline.com/<directory-tenant-id>/v2.0.
   config.auth.oidc.clientId	The Application (client) ID from your Entra app registration.
   config.auth.oidc.clientSecretRef	A reference to the Solo Enterprise for agentregistry Secret that holds the Entra client secret value.

   info

   You can optionally add subscriptionId and resourceGroup under the config section to enable richer links from the registry UI back to the Foundry project in the Azure portal.

   subscriptionId: "<azure-subscription-id>"
   resourceGroup: "<foundry-project-resource-group>"

   Example output:

   ✓ Runtime/foundry created
   

2. Get the details of your runtime and verify that the runtime shows a successful sync with your configured Azure Foundry project. If an issue occurs during the sync, the error is listed in the runtime status.

   arctl get runtime foundry -o yaml

   Example output:

   status:
    conditions:
     - lastTransitionTime: "2026-07-01T13:27:21.915068044Z"
       reason: SyncOK
       status: "True"
       type: Synced
    details:
       runtimeSync:
         lastSyncStatus: ok
         lastSyncedAt: "2026-07-01T13:40:43Z"
   

Congratulations! You successfully set up Solo Enterprise for agentregistry and connected it to a Microsoft Azure AI Foundry project. Your Foundry agents are now discoverable and visible in the registry UI.

Next steps