Build AI applications using the Azure AI Projects Python SDK (azure-ai-projects). Use when working with Foundry project clients, creating versioned agents with PromptAgentDefinition, running evaluatio... Download the free Azure AI Projects Py skill for Claude Code, Codex CLI, and
SaferSkills independently audited Azure AI Projects Py (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build AI applications on Microsoft Foundry using the azure-ai-projects SDK.
pip install azure-ai-projects azure-identityAZURE_AI_PROJECT_ENDPOINT="https://<resource>.services.ai.azure.com/api/projects/<project>" # Required for all auth methods
AZURE_AI_MODEL_DEPLOYMENT_NAME="gpt-4o-mini" # Required for all auth methods
AZURE_TOKEN_CREDENTIALS=prod # Required only if DefaultAzureCredential is used in production🔑 Two rules apply to every code sample below:
>
1. Prefer `DefaultAzureCredential`. It works locally (Azure CLI / VS Code / Developer CLI) and in Azure (managed identity, workload identity) with no code change. Avoid connection strings, account/API keys — they bypass Entra audit and rotation. - Local dev:DefaultAzureCredentialworks as-is. - Production: setAZURE_TOKEN_CREDENTIALS=prod(orAZURE_TOKEN_CREDENTIALS=<specific_credential>) to constrain the credential chain to production-safe credentials. 2. Wrap every client in a context manager so HTTP transports, sockets, and token caches are released deterministically: - Sync:with <Client>(...) as client:- Async:async with <Client>(...) as client:andasync with DefaultAzureCredential() as credential:(fromazure.identity.aio)
>
Snippets may abbreviate this setup, but production code should always follow both rules.
import os
from azure.identity import DefaultAzureCredential, ManagedIdentityCredential
from azure.ai.projects import AIProjectClient
# Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=<specific_credential>
credential = DefaultAzureCredential()
# Or use a specific credential directly in production:
# See https://learn.microsoft.com/python/api/overview/azure/identity-readme?view=azure-python#credential-classes
# credential = ManagedIdentityCredential()
with AIProjectClient(
endpoint=os.environ["AZURE_AI_PROJECT_ENDPOINT"],
credential=credential,
) as client:
deployments = list(client.deployments.list())| Operation | Access | Purpose |
|---|---|---|
client.agents | .agents.* | Agent CRUD, versions, threads, runs |
client.connections | .connections.* | List/get project connections |
client.deployments | .deployments.* | List model deployments |
client.datasets | .datasets.* | Dataset management |
client.indexes | .indexes.* | Index management |
client.evaluations | .evaluations.* | Run evaluations |
client.red_teams | .red_teams.* | Red team operations |
from azure.ai.projects import AIProjectClient
with AIProjectClient(
endpoint=os.environ["AZURE_AI_PROJECT_ENDPOINT"],
credential=DefaultAzureCredential(),
) as client:
# Use Foundry-native operations
agent = client.agents.create_agent(
model=os.environ["AZURE_AI_MODEL_DEPLOYMENT_NAME"],
name="my-agent",
instructions="You are helpful.",
)# Get OpenAI-compatible client from project
openai_client = client.get_openai_client()
# Use standard OpenAI API
response = openai_client.chat.completions.create(
model=os.environ["AZURE_AI_MODEL_DEPLOYMENT_NAME"],
messages=[{"role": "user", "content": "Hello!"}],
)agent = client.agents.create_agent(
model=os.environ["AZURE_AI_MODEL_DEPLOYMENT_NAME"],
name="my-agent",
instructions="You are a helpful assistant.",
)from azure.ai.agents.models import CodeInterpreterTool, FileSearchTool
agent = client.agents.create_agent(
model=os.environ["AZURE_AI_MODEL_DEPLOYMENT_NAME"],
name="tool-agent",
instructions="You can execute code and search files.",
tools=[CodeInterpreterTool(), FileSearchTool()],
)from azure.ai.projects.models import PromptAgentDefinition
# Create a versioned agent
agent_version = client.agents.create_version(
agent_name="customer-support-agent",
definition=PromptAgentDefinition(
model=os.environ["AZURE_AI_MODEL_DEPLOYMENT_NAME"],
instructions="You are a customer support specialist.",
tools=[], # Add tools as needed
),
version_label="v1.0",
)See references/agents.md for detailed agent patterns.
| Tool | Class | Use Case |
|---|---|---|
| Code Interpreter | CodeInterpreterTool | Execute Python, generate files |
| File Search | FileSearchTool | RAG over uploaded documents |
| Bing Grounding | BingGroundingTool | Web search (requires connection) |
| Azure AI Search | AzureAISearchTool | Search your indexes |
| Function Calling | FunctionTool | Call your Python functions |
| OpenAPI | OpenApiTool | Call REST APIs |
| MCP | McpTool | Model Context Protocol servers |
| Memory Search | MemorySearchTool | Search agent memory stores |
| SharePoint | SharepointGroundingTool | Search SharePoint content |
See references/tools.md for all tool patterns.
# 1. Create thread
thread = client.agents.threads.create()
# 2. Add message
client.agents.messages.create(
thread_id=thread.id,
role="user",
content="What's the weather like?",
)
# 3. Create and process run
run = client.agents.runs.create_and_process(
thread_id=thread.id,
agent_id=agent.id,
)
# 4. Get response
if run.status == "completed":
messages = client.agents.messages.list(thread_id=thread.id)
for msg in messages:
if msg.role == "assistant":
print(msg.content[0].text.value)# List all connections
connections = client.connections.list()
for conn in connections:
print(f"{conn.name}: {conn.connection_type}")
# Get specific connection
connection = client.connections.get(connection_name="my-search-connection")See references/connections.md for connection patterns.
# List available model deployments
deployments = client.deployments.list()
for deployment in deployments:
print(f"{deployment.name}: {deployment.model}")See references/deployments.md for deployment patterns.
# List datasets
datasets = client.datasets.list()
# List indexes
indexes = client.indexes.list()See references/datasets-indexes.md for data operations.
# Using OpenAI client for evals
openai_client = client.get_openai_client()
# Create evaluation with built-in evaluators
eval_run = openai_client.evals.runs.create(
eval_id="my-eval",
name="quality-check",
data_source={
"type": "custom",
"item_references": [{"item_id": "test-1"}],
},
testing_criteria=[
{"type": "fluency"},
{"type": "task_adherence"},
],
)See references/evaluation.md for evaluation patterns.
from azure.ai.projects.aio import AIProjectClient
async with AIProjectClient(
endpoint=os.environ["AZURE_AI_PROJECT_ENDPOINT"],
credential=DefaultAzureCredential(),
) as client:
agent = await client.agents.create_agent(...)
# ... async operationsSee references/async-patterns.md for async patterns.
# Create memory store for agent
memory_store = client.agents.create_memory_store(
name="conversation-memory",
)
# Attach to agent for persistent memory
agent = client.agents.create_agent(
model=os.environ["AZURE_AI_MODEL_DEPLOYMENT_NAME"],
name="memory-agent",
tools=[MemorySearchTool()],
tool_resources={"memory": {"store_ids": [memory_store.id]}},
)azure.ai.projects sync clients with azure.ai.projects.aio async clients in the same call path. Choose one mode per module.with AIProjectClient(...) as client: (sync) or async with AIProjectClient(...) as client: (async). For async DefaultAzureCredential from azure.identity.aio, also use async with credential: so tokens and transports are cleaned up.client.agents.delete_agent(agent.id)| Feature | azure-ai-projects | azure-ai-agents |
|---|---|---|
| Level | High-level (Foundry) | Low-level (Agents) |
| Client | AIProjectClient | AgentsClient |
| Versioning | create_version() | Not available |
| Connections | Yes | No |
| Deployments | Yes | No |
| Datasets/Indexes | Yes | No |
| Evaluation | Via OpenAI client | No |
| When to use | Full Foundry integration | Standalone agent apps |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.