Skip to main content

​
Standard Agent Setup

Standard Agent Setup provides enterprise-grade security and data control by using customer-managed, single-tenant Azure resources to store all agent state and data.

​
Overview

In Standard Setup:
  • All agent data (conversations, files, vector stores) stays in your Azure resources
  • You own and control the storage, database, and search resources
  • Data never leaves your tenant without your explicit configuration
  • Enterprise security features are enabled by default

​
Bring Your Own (BYO) Resources

Standard Setup requires three customer-managed Azure resources:

​
Azure Storage Account

Purpose: Store all uploaded files and system data What’s stored:
  • Files uploaded by developers during agent configuration
  • Files uploaded by end-users during interactions
  • Intermediate processing data (chunks, embeddings)
Requirements:
  • Standard or Premium performance tier
  • Blob storage enabled
  • Minimum: General Purpose v2
Containers created automatically:
  • <workspace-id>-azureml-blobstore: User files
  • <workspace-id>-agents-blobstore: System data

​
Azure Cosmos DB for NoSQL

Purpose: Store conversation history and agent metadata What’s stored:
  • End-user conversations (messages and responses)
  • Internal system messages
  • Agent metadata (instructions, tools, configurations)
Requirements:
  • Minimum total throughput: 3,000 RU/s
  • Supported modes: Provisioned Throughput or Serverless
  • NoSQL API
Each project requires 3 containers × 1,000 RU/s = 3,000 RU/s minimum. If deploying multiple projects under the same Foundry account, multiply accordingly (e.g., 2 projects = 6,000 RU/s).
Containers created automatically:
  • thread-message-store: End-user conversations
  • system-thread-message-store: Internal system messages
  • agent-entity-store: Agent configurations
Purpose: Create and manage vector stores for file search What’s stored:
  • Vector embeddings from uploaded documents
  • Search indexes for file search tool
  • Chunk metadata and references
Requirements:
  • Basic tier or higher
  • Sufficient capacity for expected vector data

​
Project-Level Data Isolation

Standard Setup enforces strict data boundaries:
  • Each project gets isolated containers in Storage and Cosmos DB
  • Data cannot cross project boundaries
  • Projects cannot access each other’s resources
  • Simplifies compliance and access control
This default behavior reduces setup complexity while maintaining strict security.

​
Setup Process

Deploy a complete Standard Setup using Azure Bicep:
1

Clone the template repository

git clone https://github.com/azure-ai-foundry/foundry-samples.git
cd foundry-samples/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup
2

Customize parameters (optional)

Edit main.bicep to use existing resources:
// Use existing Azure OpenAI
param existingAoaiResourceId string = '/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.CognitiveServices/accounts/{name}'

// Use existing Storage
param aiStorageAccountResourceId string = '/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Storage/storageAccounts/{name}'

// Use existing Cosmos DB
param cosmosDBResourceId string = '/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.DocumentDB/databaseAccounts/{name}'

// Use existing AI Search
param aiSearchServiceResourceId string = '/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Search/searchServices/{name}'
3

Deploy

az deployment group create \
  --resource-group <your-resource-group> \
  --template-file main.bicep
This creates:
  • Foundry account and project
  • Azure Storage, Cosmos DB, and AI Search (if not provided)
  • GPT-4.1 model deployment
  • All required connections
  • Role assignments
  • Capability hosts

​
Option 2: Manual Setup

For granular control, set up resources manually:
1

Create Azure Resources

# Create Storage Account
az storage account create \
  --name <storage-name> \
  --resource-group <rg> \
  --sku Standard_LRS

# Create Cosmos DB
az cosmosdb create \
  --name <cosmos-name> \
  --resource-group <rg> \
  --default-consistency-level Session \
  --throughput 3000

# Create AI Search
az search service create \
  --name <search-name> \
  --resource-group <rg> \
  --sku basic
2

Create Foundry Resource and Project

# Create Foundry account
az cognitiveservices account create \
  --name <foundry-account> \
  --resource-group <rg> \
  --kind AIServices \
  --sku S0

# Create project
az ml workspace create \
  --name <project-name> \
  --resource-group <rg> \
  --type project
3

Create Project Connections

Create connections to your resources:
# Storage connection
az ml connection create \
  --file storage-connection.yml \
  --resource-group <rg> \
  --workspace-name <project-name>

# Cosmos DB connection
az ml connection create \
  --file cosmos-connection.yml \
  --resource-group <rg> \
  --workspace-name <project-name>

# AI Search connection
az ml connection create \
  --file search-connection.yml \
  --resource-group <rg> \
  --workspace-name <project-name>
4

Assign RBAC Roles

Grant the project’s managed identity access:
PROJECT_IDENTITY=$(az ml workspace show \
  --name <project-name> \
  --resource-group <rg> \
  --query identity.principalId -o tsv)

# Storage permissions
az role assignment create \
  --assignee $PROJECT_IDENTITY \
  --role "Storage Blob Data Contributor" \
  --scope /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Storage/storageAccounts/{storage}

# Cosmos DB permissions
az cosmosdb sql role assignment create \
  --account-name <cosmos-name> \
  --resource-group <rg> \
  --role-definition-name "Cosmos DB Built-in Data Contributor" \
  --principal-id $PROJECT_IDENTITY

# AI Search permissions
az role assignment create \
  --assignee $PROJECT_IDENTITY \
  --role "Search Index Data Contributor" \
  --scope /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Search/searchServices/{search}
5

Create Capability Hosts

# Account capability host
az cognitiveservices account capability-host create \
  --account-name <foundry-account> \
  --resource-group <rg> \
  --capability-host-kind Agents

# Project capability host
az ml capability-host create \
  --workspace-name <project-name> \
  --resource-group <rg> \
  --properties '{"cosmos_connection": "<cosmos-conn>", "storage_connection": "<storage-conn>", "search_connection": "<search-conn>"}'

​
Using Existing Resources

You can integrate existing Azure resources into Standard Setup:

​
Existing Azure Storage

1

Get Resource ID

az storage account show \
  --resource-group <rg> \
  --name <storage-name> \
  --query id --output tsv
2

Update Template

Set aiStorageAccountResourceId parameter in the Bicep template

​
Existing Cosmos DB

Verify your Cosmos DB has sufficient throughput: minimum 3,000 RU/s per project.
1

Get Resource ID

az cosmosdb show \
  --resource-group <rg> \
  --name <cosmos-name> \
  --query id --output tsv
2

Update Template

Set cosmosDBResourceId parameter in the Bicep template
1

Get Resource ID

az search service show \
  --resource-group <rg> \
  --name <search-name> \
  --query id --output tsv
2

Update Template

Set aiSearchServiceResourceId parameter in the Bicep template

​
Required Permissions

To deploy Standard Setup, you need:
ActionRequired Role
Create account and projectAzure AI Account Owner
Assign RBAC for resourcesRole Based Access Control Administrator
Create and edit agentsAzure AI User

​
Limitations

  • Capability host cannot be updated after creation. Changes require recreating the project.
  • Cosmos DB throughput must meet minimum requirements or provisioning will fail.
  • Azure Policy restrictions on CMK-encrypted indexes may prevent automatic index creation.

​
Next Steps

Environment Setup

Complete environment configuration guide

Virtual Networks

Add private network isolation

Create Agent

Build your first agent

Use Your Resources

Detailed resource configuration

Build docs developers (and LLMs) love

Get started for freeTalk to us