{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":22800,"path":"intelligent-experiences/ai-control-tower/create-an-ai-connection-for-azure-foundry.md","title":"Create an AI connection for Azure Foundry \\(v 3.1.7\\)","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create an AI connection for Azure Foundry \\(v 3.1.7\\)\n\nCreate an AI connection for Azure AI Foundry in AI Control Tower using the  AI Service Graph Connector for Microsoft \\(version 3.1.7\\).\n\n## Azure Foundry prerequisites\n\nComplete the following steps in your Azure environment before creating an Azure Foundry connection.\n\n-   Configure OAuth Credentials\n-   The connector uses OAuth to authenticate with Azure APIs. To obtain credentials, register an application in Microsoft Entra ID.\n\nFor full instructions, see the [Azure documentation](https://learn.microsoft.com/en-us/rest/api/azure/#register-your-client-application-with-azure-ad)\n\nThe Azure client application requires the following roles:\n\n-   Reader role at the subscription or resource group level to discover resources.\n-   Foundry user role on the Azure AI Foundry resources.\n\n**Note:** As of March 2026, ServiceNow supports the New Azure AI Foundry alongside the original Azure AI Foundry. The New Foundry treats each agent version as a distinct entity.\n\nDiscovery scope\n\nConfigure the scope of Azure Foundry discovery using the following options:\n\n-   Tenant-wide discovery \\(default\\): Leave the Resource Name and Region fields empty to discover all Al agents across your entire Azure tenant.\n-   Filter by resource \\(optional\\): To limit discovery to specific resources, enter resource names as comma-separated values \\(examples: resource1, resource2\\).\n-   Filter by region \\(optional\\): To limit discovery to specific Azure regions, enter region names as comma-separated values \\(for examples: eastus, westus2\\).\n\n## Before you begin\n\nRole required: sn\\_ai\\_disc.discovery\\_admin and sn\\_cmdb\\_int\\_util.sgc\\_admin\n\nAccount & Resource Hierarchy\n\nThe connector supports three Azure service variants, each with its own resource hierarchy:\n\n-   ML Services \\(AI Hub\\) Subscriptions → Resource Groups → ML Workspaces → Agents\n-   AI Services/Old Foundry \\(Cognitive Services\\) Subscriptions → Resource Groups → Cognitive Services Accounts → Projects → Agents\n-   New Foundry Subscriptions → Resource Groups → Accounts → Projects → Agents → Agent Versions\n\nThe key distinction with New Foundry is that each agent version is treated as a distinct entity, which the other two variants don't support.\n\nDiscovered per agent\n\nFor each agent discovered across all three variants, the connector collects:\n\n-   AI Agents \\(assistants\\)- The primary entity.\n-   AI Models- Deployed models \\(GPT-4o, Llama, Claude, etc.\\) via deployment enrichment.\n-   AI Prompts- System instructions attached to agents.\n-   AI Tools- With type coverage varying by variant: ML & AI Services: functions, connected\\_agent, and others.\n-   Sub-component Relationships- M2M links between agents and their sub agents/tools.\n-   Usage/Execution Metrics- Aggregated run counts by agent, date, and session.\n\n## Procedure\n\n1.  Navigate to **Al Control Tower workspace** > **Configurations** > **AI connections**.\n\n2.  Select **AI connector for Microsoft** from the available connectors and then select **Create connection**.\n\n3.  Review setup instructions page displays.\n\n    **Note:** Verify to review the setup instructions and automation script.\n\n4.  Select **I have read the setup instructions** check box.\n\n5.  Select **Continue**.\n\n    Select authentication type page appears.\n\n6.  Choose the authentication type from the drop-down and select **Submit**.\n\n7.  Select **Client credentials** and skip to step 10.\n\n8.  Select **Certificate-based authentication**.\n\n9.  Create X.509 certificate:\n\n    **Note:** You can create a new certificate or use an existing one.\n\n    1.  Select **New**.\n\n    2.  Enter the**Name**.\n\n    3.  Enter the **Key store password**.\n\n    4.  Select **+Add file** to add an attachment.\n\n    5.  Select **Save**.\n\n    6.  Select the newly created certificate and select **Continue**.\n\n10. Create and test connection:\n\n    1.  Under **Select source systems** select the **Azure Foundry** check box.\n\n    2.  Enter the **Connection Name**.\n\n    3.  Enter the **Tenant ID**.\n\n    4.  Enter the **OAuth Client ID**.\n\n    5.  Enter the **Keystore**.\n\n    6.  Enter the **Keystore password**.\n\n    7.  Enter the **Thumbprint**.\n\n        **Note:** The Region and Resource name fields are optional. You can enter multiple Environment URLs by separating them with a comma.\n\n11. Configure import schedule:\n\n    1.  Open the Azure Foundry scheduled job.\n\n    2.  Verify that both the parent-scheduled jobs, Discovery and Execution are active as they’re shipped out inactive.\n\n        **Note:** Ensure to execute the Discovery-scheduled job first.\n\n    3.  Select Run according to your preference.\n\n    4.  To run frequency by demand, select **Execute Now**.\n\n        **Note:** This is an optional step as the schedule imports run according to the schedule.\n\n    5.  Select **Continue**.\n\n12. Select **Confirm connection setup** activity to verify whether the connection was configured.\n\n\n## Result\n\nSelect **View all connections** to review the connection details. The created connection appears in the Installed connections list.\n\n"}}