A county Foundry project must read municipal knowledge from Blob storage without embedding secrets in configs. What should they configure?

Configuring managed identities so Foundry accesses civic Blob storage without embedded secrets is correct because county GenAI knowledge retrieval should use Azure AD–backed identity and RBAC scoped to Blob storage, while Entra authentication scoped to civic OpenAI endpoints targets model endpoints and grants no Blob container access. Managed identities let the Foundry project read municipal Blob containers under auditable role assignments, rotating credentials out of application settings and reducing secret sprawl. That pattern matches municipal security baselines for knowledge bases feeding permitting, benefits, or resident-facing agents.

Using Foundry connections with Microsoft Entra authentication scoped to civic OpenAI endpoints fails because that scope authorizes model inference, not Blob storage reads, so the project still has no access to municipal knowledge containers. Placing managed identities on civic Blob storage so storage authenticates back to Foundry project fails because the authorization direction is reversed — the identity must be assigned to the Foundry project to present to storage, storage does not authenticate to Foundry. Assigning the Foundry agent identity a Blob contributor role in Microsoft Purview governance fails because Purview handles data governance and classification, not Blob data-plane authorization which must be granted through Azure RBAC, and contributor grants excessive write access when only read is needed.

Exam caveat: Foundry-to-storage access stems almost always want managed identity + RBAC, not Entra authentication scoped to OpenAI endpoints, managed identities placed on storage to authenticate back, or Blob roles assigned in Purview governance.

Operational check: assign a managed identity to the Foundry project or hosting resource, grant it least-privilege Blob data reader on the municipal knowledge container via Azure RBAC, ensure Entra scope targets Blob storage not OpenAI endpoints, keep the identity on the Foundry project rather than on storage, avoid assigning Blob access in Purview and avoid excessive contributor rights, and verify the agent can read documents only via that identity.