[Brandon Miller (brandom-msft)]

Summary

• Add a layer-on-existing Bicep sample under infrastructure/infrastructure-setup-bicep/01-connections/foundry-model-connection.
• Create a project-scoped ApiManagement connection directly to a Foundry account using ProjectManagedIdentity, explicit audience, Responses surface, and existing UX discovery metadata. No APIM service, API keys, discovery endpoint changes, or model deployments.
• Optionally grant Foundry User on the target account to the source PROJECT managed identity, including cross-resource-group/subscription module scope and deterministic assignment naming.
• Include generated ARM, parameter placeholders, metadata, deployment/cleanup guidance, and agent invocation through the existing prompt-agent Responses script.
• Link the sample from the connections index and golden path.

Authorship and history

Replicates microsoft-foundry/foundry-samples-pr#1063, originally authored by Mukesh Agarwal (Mukesh Agarwal (@mukeshagmsft)), through source commit bf9f539c1743c3bd7292d4985e5e42ba73e6cd11. All 13 changed files are byte-for-byte identical to that source PR.

The four original commits were carried over individually, in order, without squashing. Their author names, author dates, original messages, and existing co-author/session trailers are preserved. Each new commit records its original full commit ID. Mukesh's author email uses his verified GitHub noreply address instead of exposing his internal email. Commit IDs and committer metadata necessarily differ on this public branch; the source links retain the original history, comments, and validation notes. The new PR is opened by Brandon Miller (@brandom-msft) on behalf of the original author.

Original commit	Public commit
0c4cbee50bc0d6a4f9851954c5e986ae6c6e08e3	6957f78fffd41c4adfcff2d0743c20a1c2666348
681cec6192ee05488bccd4e009fef4e65ea2ee73	478f5c4089a07a1dc24d856bc5d099dcb1a04820
7437b3c96bb46c81c939855d21d87c021a61883a	06cf8c16fd014ebf617b23b6aec34f1f1632da28
bf9f539c1743c3bd7292d4985e5e42ba73e6cd11	13bfbafbb60f8453be576d032b0cf7d6e2130f29

Validation

• Built and linted both templates with Bicep 0.47.16; both commands succeeded. The APIM secret-header template reports BCP036 because the published authType enum omits ProjectManagedIdentity. This port keeps the original payload unchanged. The source README describes BCP081 with its author's older Bicep version; that is not the diagnostic from this validation.
• Verified both rebuilt ARM templates match the committed templates apart from compiler metadata.
• Verified JSON parsing, parameter-name compatibility, local documentation links, exact source-file equivalence, and all four commit attribution/provenance mappings.
• git diff --check passed. No live deployment or runtime validation is claimed.

[Copilot]

🔵 Needs a closer look

Maintainer-led live Azure verification is needed for the flighted secret-header and ProjectManagedIdentity contracts because compilation cannot validate secret resolution, discovery, inference, or target-account authorization.

No open issues 🎉

What changed in this PR

Adds two Bicep samples to the existing Foundry connection catalog: direct model access using project managed identity and APIM access combining project identity with a secret subscription-key header.

Changes:

• Adds a direct Foundry model connection with optional target-account role assignment across resource groups or subscriptions.
• Adds an APIM model connection with a secure CustomKeys companion and Key Vault parameter example.
• Provides generated ARM templates, deployment and invocation guidance, cleanup instructions, and navigation links.

Validation reported in the PR covers compilation and static checks; live deployment and inference remain unverified.

Paths are relative to infrastructure/infrastructure-setup-bicep/.

File	Description
golden-path/​README.md	Adds the direct Foundry identity-based connection variant.
01-connections/​README.md	Links both new connection samples.
01-connections/​foundry-model-connection/​samples/​parameters.json	Provides target-account and model deployment placeholders.
01-connections/​foundry-model-connection/​README.md	Documents prerequisites, deployment, invocation, and cleanup.
01-connections/​foundry-model-connection/​modules/​project-model-role.bicep	Grants the project identity Foundry User on the target account.
01-connections/​foundry-model-connection/​metadata.json	Adds catalog metadata for the direct connection sample.
01-connections/​foundry-model-connection/​main.bicep	Defines the direct connection and optional role-assignment module.
01-connections/​foundry-model-connection/​azuredeploy.json	Provides the generated ARM template.
01-connections/​apim-secret-headers/​samples/​parameters.json	Demonstrates supplying the subscription key through Key Vault.
01-connections/​apim-secret-headers/​README.md	Explains secret references, runtime prerequisites, rotation, and cleanup.
01-connections/​apim-secret-headers/​metadata.json	Adds catalog metadata for the secret-header sample.
01-connections/​apim-secret-headers/​main.bicep	Defines the identity-authenticated connection and secret companion.
01-connections/​apim-secret-headers/​azuredeploy.json	Provides the generated ARM template for both connections.

_{Review effort: Balanced}

[Mukesh Agarwal (mukeshagmsft)]

🤖 Pushed 3097961 to fix the missing-input/prerequisite failure in the ephemeral ARM deployment gate. Both connection samples now select disposable account/project fixtures through main.bicepparam and invoke the actual sample modules; the direct Foundry fixture retains the project-identity role assignment. No CI exclusions or policy bypasses were added. Local validation: both fixtures and parameter entry points compile; all 7 pipeline regression tests pass. Coverage is ARM creation/RBAC, not model inference or gateway authentication. New CI results and required maintainer review are still pending.

[Copilot]

🔵 Needs a closer look

Service-side PMI discovery and flighted secret-header resolution lack live validation, requiring maintainer verification of authorization, secret resolution, and inference in an enabled Foundry environment.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Service-owner runtime validation is needed to confirm direct PMI discovery/inference and flighted secret-header resolution, since compilation and ARM-only fixtures do not establish these service contracts.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Service-owner validation in an enabled environment is needed because compilation checks and ARM fixtures do not establish runtime compatibility for direct PMI discovery/inference or flight-gated secret-header resolution.

No open issues 🎉

_{Review effort: Balanced}