Azure AI Foundry

Register models deployed in Azure AI Foundry as an LLM provider on SonarQube Server 2026.5.

Reach Azure AI Foundry directly through your Azure resource endpoint, or through Azure API Management (APIM). Both work with this dedicated Azure AI Foundry provider type in SonarQube Server, which authenticates with the api-key header. SonarQube Server also offers a Custom provider type for endpoints that expect a different header (see Reaching through API Management).

This page covers both connection paths: see Fields for the Azure AI Foundry type for the fields to enter and Reaching through API Management for what APIM needs. For the steps that apply to every provider type, see LLM providers.

Prerequisites

• A model deployed in your Azure AI Foundry resource. SonarQube Server can only use a model that exists as a deployment. See Deploy Foundry Models in the Microsoft documentation.
• Your Azure resource endpoint and an API key for it.

Fields for the Azure AI Foundry type

Enter these fields whether you connect directly or through APIM. If you're using the Custom type through APIM instead, see Fields for the Custom type.

Field	Required	What to enter
Endpoint	Yes	The base URL. For a direct connection, your Azure resource endpoint. For APIM, your APIM base URL.
API key	Yes	Your Azure API key for a direct connection, or your APIM subscription key for APIM.

Reaching through API Management

Reaching Azure AI Foundry through Azure API Management (APIM) adds requirements of its own, whichever provider type you register:

• APIM has to route both operations through to your Azure resource.
• APIM authenticates to Azure AI Foundry separately from how SonarQube Server authenticates to APIM.
• Both SonarQube Server and each agent host that uses this provider need outbound network access to your APIM hostname. If APIM or another gateway in the path presents a certificate signed by a private CA, install that CA in the trust store used by SonarQube Server and in the one used by your agent hosts.

Pick a type based on the header your APIM policy expects:

• api-key (the header this dedicated Azure AI Foundry type sends): use this type, with your APIM base URL as the Endpoint and your APIM subscription key as the API key. See Fields for the Azure AI Foundry type.
• Any other header: use the Custom provider type in SonarQube Server, with the subscription key as a custom header. See Fields for the Custom type for the fields to enter here, and Custom for how the Custom type and its API contract work.

Fields for the Custom type

Field	What to enter
Endpoint	Your APIM base URL
API key	Leave empty
Custom headers	Your APIM subscription-key header name and value, marked as secret. Check your own APIM policy for the exact header name

Routing the requests in APIM

Your APIM API has to expose and forward both operations, the same two operations every OpenAI-compatible endpoint must expose. See Supported API.

• GET /models
• POST /chat/completions

Define them individually or with a wildcard operation. Keep the paths intact through the inbound rewrite and the backend rewrite. APIM has to accept GET and POST requests at your endpoint's base path, with /models and /chat/completions appended, matching those two operations.

Authenticating APIM to Azure AI Foundry

APIM also needs its own way to authenticate to Azure AI Foundry, configured entirely in Azure and APIM, not in SonarQube Server.

If your APIM instance isn't already set up for this, use one of two methods:

• Enable a managed identity for APIM, and grant it the Cognitive Services OpenAI User role on the Azure AI Foundry resource.
• Store the Azure AI Foundry API key as a secret named value in APIM, and add it to backend requests in the api-key header.

Either way, the Azure AI Foundry API key never reaches SonarQube Server.

Entering the model identifier

1. Find the model in your Azure AI Foundry resource.
2. Copy the identifier exactly as Azure shows it.
3. Go to the agent's page under Administration > Configuration > AI capabilities, paste the identifier into the model field, and select Save.

On Azure, the identifier is the name of your deployment rather than the vendor's name for the model. A model that is not deployed has no identifier to enter.

SonarQube Server verifies the model against your endpoint when you save. An identifier Azure does not recognize fails then rather than during a run.

If adding the provider fails, see Troubleshooting.