Unable to successfully create and use current Azure AI Foundry resources for current Azure.AI.Projects SDK (1.0.0-beta.9) using bicep

[v-croft]

Problem

I am trying to update my code to use the current SDK based on Azure.AI.Projects (Version=1.0.0-beta.9) and Azure.AI.Agents.Persistent library (Version=1.1.0-beta.3) but am not able to dynamically provision the resources to connect to using bicep. Manually provisioning the resources works.

Failing API code to create an agent dynamically

// Retrieve from environment variables added by Aspire AppHost
var endpoint = Environment.GetEnvironmentVariable("OpenAiEndpoint");
var modelDeploymentName = System.Environment.GetEnvironmentVariable("ModelDeployment");

AIProjectClient projectClient = new AIProjectClient(new Uri(endpoint), new DefaultAzureCredential());
PersistentAgentsClient agentsClient = projectClient.GetPersistentAgentsClient();

// Create the agent - fails with a 404 (not found) error
PersistentAgent agent = await agentsClient.Administration.CreateAgentAsync(
    model: modelDeploymentName,
    name: $"agent-{Guid.NewGuid()}",
    instructions: SearchService.Instructions
);

Note that changes to the Azure.AI.Project SDK no longer accept a project connection string and expect an Azure AI Foundry resource rather than an AI hub resource (which I was previously using). See Azure.AI.Projects Change Log.

When I try to create an Azure Foundry AI resource and project with bicep (via Aspire), the resources are provisioned but the above code fails to create an agent returning a 404. The endpoint and modelDeploymentName are correct and correspond to the provisioned resources.

If I access the provisioned resources via the Azure Portal and navigate to the Agents I get the following error, implying the resource is not correctly provisioned.

If I create an Azure AI Foundry resource manually through the Foundry portal then everything works (I can create an agent manually or via the above code). When I compare the generated bicep of the manually created resources with the bicep below, they look exactly the same (naming aside).

The issues seems to be with the AI Foundry resource rather than the project as recreating a project manually in the AI Foundry resource also fails.

Am I missing something or is there a bug here? (I cannot find any examples using the Azure AI Foundry approach, rather than the older AI Hub which does not work with the current SDK). Either way it does not seem possible to marry bicep IaC with the current SDK.

Bicep to provision infrastructure - succeeds but does not allow agents to be created

@description('The location for the resource(s) to be deployed.')
param location string = resourceGroup().location

@description('The principal ID for role assignments')
param principalId string

@description('The principal type for role assignments')
param principalType string

@description('The AI project name')
param aiProjectName string = take('aiProject-${uniqueString(resourceGroup().id)}', 64)

@description('The model deployment name')
param model string = 'gpt-4o'

// Create Azure AI Foundry resource (using CognitiveServices accounts for AI Foundry)
#disable-next-line BCP037
resource aiFoundryResource 'Microsoft.CognitiveServices/accounts@2025-06-01' = {
  name: take('ai-foundry-${uniqueString(resourceGroup().id)}', 64)
  location: location
  sku: {
    name: 'S0'
  }
  kind: 'AIServices'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    #disable-next-line BCP037
    apiProperties: {}
    customSubDomainName: toLower(take(concat('aifoundry', uniqueString(resourceGroup().id)), 24))
    publicNetworkAccess: 'Enabled'
    disableLocalAuth: false
    networkAcls: {
      defaultAction: 'Allow'
      virtualNetworkRules: []
      ipRules: []
    }
    allowProjectManagement: true
  }
}

// Create GPT-4o model deployment using Standard tier
#disable-next-line BCP037
resource modelDeployment 'Microsoft.CognitiveServices/accounts/deployments@2025-06-01' = {
  parent: aiFoundryResource
  name: model
  sku: {
    name: 'Standard'
    capacity: 30
  }
  properties: {
    model: {
      format: 'OpenAI'
      name: model
      version: '2024-11-20'
    }
    versionUpgradeOption: 'OnceNewDefaultVersionAvailable'
    raiPolicyName: 'Microsoft.DefaultV2'
  }
}

// Create AI Project
#disable-next-line BCP037
resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-06-01' = {
  parent: aiFoundryResource
  name: aiProjectName
  location: location
  kind: 'AIServices'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {}
  dependsOn: [
    modelDeployment
  ]
}

// Outputs as required
output modelDeployment string = modelDeployment.name
output openAiEndpoint string = aiProject.properties.endpoints['AI Foundry API']

[v-croft]

I managed to resolve this.

[ejones18]

@v-croft - what was the fix?

[v-croft]

Hi @ejones18.
This is an extract of the bicep I am using. It additionally creates a specific role to manage give the aspire generated Principal the correct access to the resources (in this case to create, delete and run agents).

Hope this helps.

@description('Location for all resources.')
param location string = resourceGroup().location

@description('The principal ID for role assignments')
param principalId string

@description('The principal type for role assignments')
param principalType string

@description('The model to deploy in the AI Foundry.')
param model string = 'gpt-4o'

@description('The model sku to deploy in the AI Foundry (GlobalStandard or standard).')
param modelSku string = 'Standard'

@description('The model version to deploy in the AI Foundry.')
param modelVersion string = '2024-11-20'

@description('The model version to deploy in the AI Foundry.')
param modelCapacity string = '100'

@description('SKU for the Azure Foundry service.')
param foundryAISku string = 'S0'

@description('The AI foundry name')
param aiFoundryName string = take('${resourceGroup().name}-foundry', 64)

@description('The AI project name')
param aiProjectName string = take('${resourceGroup().name}-project', 64)


// AI Foundry resource
resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-06-01' = {
  name: aiFoundryName
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  sku: {
    name: foundryAISku
  }
  kind: 'AIServices'
  properties: {
    // required to work in AI Foundry
    allowProjectManagement: true 

    publicNetworkAccess: 'Enabled'

    // Defines developer API endpoint subdomain
    customSubDomainName: toLower(aiFoundryName)

    disableLocalAuth: true
  }
}

// Create the Azure AI Foundry Project
resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-06-01' = {
  name: aiProjectName
  parent: aiFoundry
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    description: 'Azure AI Foundry Project for ReportWriter'
    friendlyName: 'ReportWriter AI Foundry Project'
    storageAccount: storageAccount.id
    keyVault: keyVault.id
    applicationInsights: applicationInsights.id
  }
}

resource modelDeployment 'Microsoft.CognitiveServices/accounts/deployments@2024-10-01'= {
  parent: aiFoundry
  name: model
  sku : {
    capacity: modelCapacity
    name: modelSku
  }
  properties: {
    model:{
      name: model
      format: 'OpenAI'
      version: modelVersion
    }
  }
}

// Create a custom role with the necessary permissions to create agents and run them
resource agentUserRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
  name: guid(resourceGroup().id, deployment().name, aiProject.id)
  scope: aiProject
  properties: {
    roleName: 'AI Management User'
    description: 'Allows creating, deleting and running agents and threads.'
    type: 'CustomRole'
    permissions: [
      {
        actions: [
          'Microsoft.CognitiveServices/accounts/projects/read'
          'Microsoft.CognitiveServices/accounts/projects/connections/read'
        ]
        dataActions: [
          'Microsoft.CognitiveServices/accounts/AIServices/agents/write'
          'Microsoft.CognitiveServices/accounts/AIServices/agents/read'
          'Microsoft.CognitiveServices/accounts/AIServices/agents/delete'
        ]
        notActions: []
      }
    ]
    assignableScopes: [
      aiProject.id
    ]
  }
}

// Role assignments for AI Agent User permissions
resource aiProject_AIAgentUser 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(
    aiProject.id,
    principalId,
    agentUserRole.id
  )
  properties: {
    principalId: principalId
    roleDefinitionId: agentUserRole.id
    principalType: principalType
  }
  scope: aiProject
}

// Outputs
output aiProjectEndpoint string = aiProject.properties.endpoints['AI Foundry API']
output modelDeployment string = modelDeployment.name

[ejones18]

Thanks @v-croft, I'll give this a test - appreciate it