Question
You have a Microsoft Foundry project that contains a customer support agent built by using the Foundry Agent Service.
The agent uploads user-provided screenshots to Azure Storage through a ticketing tool and receives a blob URL for additional reasoning.
You need to use image moderation during agent runs and prevent harmful content from being returned during runs. Azure AI Content Safety must access the images by using the blob URL. The solution must follow the principle of least privilege.
What should you configure for Content Safety? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Guardrails: Selecting User input, Output, Tool response, and Tool call with Action set to Block scans every point where content enters or leaves the agent run and actually stops harmful content. Annotate only flags content without preventing it, and it is not available as an action for agents. Selecting only Tool call misses the screenshot content returned from tools and the final output.
Storage access: For a blob URL, Content Safety reads the image by using its system-assigned managed identity, and the documentation states that only Storage Blob Data Contributor or Storage Blob Data Owner are valid roles. Storage Blob Data Contributor is therefore the least privilege that works, even though Storage Blob Data Reader looks more restrictive. Access keys grant full account access, and a queue role does not grant access to blobs.
