> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/sonarqube-server/instance-administration/ai-features/llm-providers/azure-ai-foundry.md).

# Azure AI Foundry

Register models deployed in Azure AI Foundry as an LLM provider on SonarQube Server 2026.5.

Reach Azure AI Foundry directly through your Azure resource endpoint, or through Azure API Management (APIM). Both work with this dedicated **Azure AI Foundry** provider type in SonarQube Server, which authenticates with the `api-key` header. SonarQube Server also offers a **Custom** provider type for endpoints that expect a different header (see [#azure-apim](#azure-apim "mention")).

This page covers both connection paths: see [#fields](#fields "mention") for the fields to enter and [#azure-apim](#azure-apim "mention") for what APIM needs. For the steps that apply to every provider type, see [LLM providers](/sonarqube-server/instance-administration/ai-features/llm-providers.md).

## Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* A model deployed in your Azure AI Foundry resource. SonarQube Server can only use a model that exists as a deployment. See [Deploy Foundry Models](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/how-to/deploy-foundry-models) in the Microsoft documentation.
* Your Azure resource endpoint and an API key for it.

## Fields for the Azure AI Foundry type <a href="#fields" id="fields"></a>

Enter these fields whether you connect directly or through APIM. If you're using the **Custom** type through APIM instead, see [#azure-apim-fields](#azure-apim-fields "mention").

| Field        | Required | What to enter                                                                                      |
| ------------ | -------- | -------------------------------------------------------------------------------------------------- |
| **Endpoint** | Yes      | The base URL. For a direct connection, your Azure resource endpoint. For APIM, your APIM base URL. |
| **API key**  | Yes      | Your Azure API key for a direct connection, or your APIM subscription key for APIM.                |

## Reaching through API Management <a href="#azure-apim" id="azure-apim"></a>

Reaching Azure AI Foundry through Azure API Management (APIM) adds requirements of its own, whichever provider type you register:

* APIM has to route both operations through to your Azure resource.
* APIM authenticates to Azure AI Foundry separately from how SonarQube Server authenticates to APIM.
* Both SonarQube Server and each agent host that uses this provider need outbound network access to your APIM hostname. If APIM or another gateway in the path presents a certificate signed by a private CA, install that CA in the trust store used by SonarQube Server and in the one used by your agent hosts.

Pick a type based on the header your APIM policy expects:

* **`api-key`** (the header this dedicated **Azure AI Foundry** type sends): use this type, with your APIM base URL as the **Endpoint** and your APIM subscription key as the **API key**. See [#fields](#fields "mention").
* Any other header: use the **Custom** provider type in SonarQube Server, with the subscription key as a custom header. See [#azure-apim-fields](#azure-apim-fields "mention") for the fields to enter here, and [Custom](/sonarqube-server/instance-administration/ai-features/llm-providers/custom.md) for how the **Custom** type and its API contract work.

### Fields for the Custom type <a href="#azure-apim-fields" id="azure-apim-fields"></a>

| Field              | What to enter                                                                                                            |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------ |
| **Endpoint**       | Your APIM base URL                                                                                                       |
| **API key**        | Leave empty                                                                                                              |
| **Custom headers** | Your APIM subscription-key header name and value, marked as secret. Check your own APIM policy for the exact header name |

### Routing the requests in APIM <a href="#azure-apim-routing" id="azure-apim-routing"></a>

Your APIM API has to expose and forward both operations, the same two operations every OpenAI-compatible endpoint must expose. See [Custom](/sonarqube-server/instance-administration/ai-features/llm-providers/custom.md#protocol).

* `GET /models`
* `POST /chat/completions`

Define them individually or with a wildcard operation. Keep the paths intact through the inbound rewrite and the backend rewrite. APIM has to accept `GET` and `POST` requests at your endpoint's base path, with `/models` and `/chat/completions` appended, matching those two operations.

### Authenticating APIM to Azure AI Foundry <a href="#azure-apim-authentication" id="azure-apim-authentication"></a>

APIM also needs its own way to authenticate to Azure AI Foundry, configured entirely in Azure and APIM, not in SonarQube Server.

If your APIM instance isn't already set up for this, use one of two methods:

* Enable a managed identity for APIM, and grant it the Cognitive Services OpenAI User role on the Azure AI Foundry resource.
* Store the Azure AI Foundry API key as a secret named value in APIM, and add it to backend requests in the `api-key` header.

Either way, the Azure AI Foundry API key never reaches SonarQube Server.

## Entering the model identifier <a href="#model-identifier" id="model-identifier"></a>

1. Find the model in your Azure AI Foundry resource.
2. Copy the identifier exactly as Azure shows it.
3. Go to the agent's page under **Administration** > **Configuration** > **AI capabilities**, paste the identifier into the model field, and select **Save**.

On Azure, the identifier is the name of your deployment rather than the vendor's name for the model. A model that is not deployed has no identifier to enter.

SonarQube Server verifies the model against your endpoint when you save. An identifier Azure does not recognize fails then rather than during a run.

If adding the provider fails, see [LLM providers](/sonarqube-server/instance-administration/ai-features/llm-providers.md#troubleshooting).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.sonarsource.com/sonarqube-server/instance-administration/ai-features/llm-providers/azure-ai-foundry.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.