When configuring the connection between Copilot Studio and an Azure AI Foundry agent, which authentication mechanism is used to authorize Copilot Studio to invoke the Foundry agent?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Managed identities are like a royal seal — the Copilot Studio environment is issued an identity by Azure AD, and you grant that identity permission on the Foundry resource. No passwords, no API keys to rotate, no human credentials in the loop.
Full explanation below image
Full Explanation
Azure services communicate with each other securely using managed identities (formerly Managed Service Identity / MSI). A managed identity is an Azure AD identity automatically managed by Azure — it has no credentials that need to be stored or rotated by administrators.
For Copilot Studio to invoke an Azure AI Foundry agent, you assign a system-assigned or user-assigned managed identity to the Copilot Studio Power Platform environment (or use the environment's service principal), then grant that identity the appropriate RBAC role (such as Azure AI User or Cognitive Services User) on the Foundry resource.
Option A (shared API key) would work for some HTTP integrations but is not the native, recommended authentication mechanism for Copilot Studio ↔ Foundry integration. It introduces credential management overhead.
Option C (username/password of agent author) would tie authorization to a human account — if that person leaves the organization, the integration breaks. This is an anti-pattern for service-to-service auth.
Option D (anonymous public endpoint) is a security violation. Foundry agents with fine-tuned models and sensitive data should never be exposed publicly without authentication.
Exam principle: service-to-service authentication in Azure = managed identity + RBAC. This pattern applies broadly across Azure AI services.