Question
You have a Microsoft Foundry project that contains an agent.
The agent uses tools to retrieve internal content and call external APIs. The agent is configured to let the model decide when to call the tools.
You need to publish the agent for a compliance workflow. The solution must meet the following requirements:
- Each workflow run must include a retrieval step before generating a response.
- Tool calls must authenticate by using the published agent's own identity.
- Tool access must use an identity isolated from other project resources.
- Tool access must use support audit tracing.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Set tool_choice to: required makes the model call a tool, which guarantees the retrieval step in every run. The current setting, auto, lets the model decide and so can skip retrieval, and none prevents tool calls altogether.
Configure the tool to authenticate by: a distinct agent identity gives the published agent its own identity in Microsoft Entra ID, so its permissions and activity can be scoped and audited separately from other project resources. The shared project agent identity is used by every legacy agent in the project and has no identity-level separation, and storing API keys in prompts exposes secrets and provides no agent identity at all.
