Foundry Iq

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Data and AI
MIT
Medium risk
Has scripts

From the author

Foundry IQ knowledge bases. WHEN: make local or Blob documents searchable; create/diagnose KBs; triage unsupported connectors or multi-source KB creation/reconfiguration (even with classic-search terms); connect existing KB to agents (including multi-source KBs); create/reuse a Search service; retrieve from an existing knowledge base with citations; no brand words needed. Read its procedure before query/target questions. NOT: other KB providers, repository-file search, classic Azure AI Search index/query/app work with no Foundry IQ KB or connector request, generic agent creation.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Foundry IQ provides a structured framework for creating, diagnosing, and connecting knowledge bases to AI agents. It supports making local or Blob-based documents searchable, managing multi-source knowledge configurations, and retrieving information with citations. The skill emphasizes strict adherence to defined procedures for service discovery, resource creation, and troubleshooting to ensure reliable agent-knowledge integration.

What it does

Creates searchable knowledge bases from local or Azure Blob storage documents.
Connects existing knowledge bases to AI agents.
Diagnoses issues with knowledge base configurations or unsupported connectors.
Retrieves information from knowledge bases with source citations.
Manages the lifecycle of search services and knowledge sources.
Routes requests based on specific operational needs rather than source counts.

When to use it

When you need to make local or cloud-stored documents searchable by an AI agent.
When connecting an existing knowledge base to a new or current agent.
When troubleshooting or diagnosing a knowledge base configuration.
When you need to create a new search service or knowledge source.
When performing retrieval tasks that require citations from a knowledge base.

Advantages

Provides a clear, procedural approach to knowledge base management.
Ensures consistent handling of multi-source knowledge configurations.
Includes built-in diagnostic paths for troubleshooting.
Supports secure, citation-backed retrieval for agent responses.
Prevents unauthorized or unsupported configuration changes.

Usage examples

“Create a new knowledge base from my Azure Blob container.”: The agent will initiate the knowledge base creation procedure, validating the source and setting up the necessary search indexing.
“Connect my existing knowledge base to the current agent.”: The agent will follow the connection workflow to link the specified knowledge base to the agent's retrieval pipeline.
“Why is my multi-source knowledge base failing to index?”: The agent will trigger the diagnostic procedure to identify configuration drifts or unsupported connector issues.
“Retrieve information about project timelines from the knowledge base.”: The agent will query the knowledge base and provide an answer with citations from the source documents.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/foundry-iq/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip foundry-iq.zip -d .agents/skills

Documentation by Microsoft

Foundry IQ

Read one procedure before questions/actions; invocation is not a read. Read the owning procedure before blocked/unsupported responses too. Before mutation plans/approval, successfully read its required pre-action references, selected branches only. Do not reload successful reads. On failure, try only permitted bounded exact-path reads with any supported reader; never bypass restrictions or search broadly. If still unavailable: blocked: reference-unavailable, name missing references and inability to plan. Never invent requirements/plans. Failures first.

Cleanup and receipt-backed execution go directly to their lifecycle/producer owner; do not reopen Search intake, provisioning or hardening.

Before expensive service discovery, reuse supplied resource/intent; otherwise ask one early USE EXISTING / FIND CANDIDATES / CREATE NEW choice. Only FIND enumerates; supplied identity uses exact/minimum scoped resolution. CREATE checks its proposed name, not existing-service inventories. Preserve these answers across source/KB/CU/model handoffs; selection is not write approval.

Searchable docs: KB + validated retrieval. Confirm intent once; KS-only must be explicit. Child success is not KB completion. Unclear/compound/mode/completion: read.

Route by requested operation, not existing KB source count. Connecting an existing KB with two or more sources, without changing the KB, uses Connect. Read-only operations use their owning procedure and actual helper constraints; this does not add retrieval modes or supported source kinds. Explicit unsupported provisioning or multi-source KB creation/reconfiguration uses Diagnose and stops before discovery, even when connecting an agent is also requested. This routing takes precedence over classic-search terms (e.g. hybrid search) in compound requests. Never end in a plain refusal: Diagnose gives the boundary, docs pointer and agent handoff; writes still need an approved concrete plan. Do not silently execute only the supported part of a compound request. If existing-KB connection versus KB creation/reconfiguration is unclear, read intent-routing and clarify that scope before Azure discovery. Never infer KB mutation.

Outcome	Read
Cleanup	Plan cleanup
Failure/drift	Diagnose
Unsupported connector provisioning / multi-source KB creation or reconfiguration	Diagnose
Connect	Connect
Read KB	Query
Search only	Search
File KS only	File
Blob/ADLS KS only	Blob
Searchable/KB	KB

Generic agents: microsoft-foundry. Reads: no approval; approve unchanged plans before writes. Hide hashes. No Search/Storage keys, scope widening, guessed identity/boundaries, drift repair or joint cleanup/creation approval. Acceptance != success.

Files

ATTRIBUTION.mdAdded by AutoGineer977 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.7 KiB
agents/connect-hosted-toolbox.md7.8 KiB
agents/connect-hosted.md7.8 KiB
agents/connect-prompt-sdk-fallback.md7.8 KiB
agents/connect.md7.8 KiB
agents/create-missing-agent.md7.8 KiB
helpers/_blob_observation.pyScript4.4 KiB
helpers/_blob_source_read.pyScript39.5 KiB
helpers/_bootstrap_io.pyScript30.1 KiB
helpers/_cleanup_dependencies.pyScript27.5 KiB
helpers/_cleanup_receipts.pyScript13.5 KiB
helpers/_common.pyScript36.2 KiB
helpers/_document_adapters.pyScript15.0 KiB
helpers/_document_limits.pyScript3.9 KiB
helpers/_embedding.pyScript7.0 KiB
helpers/_file_inventory.pyScript24.4 KiB
helpers/_file_source_config.pyScript15.6 KiB
helpers/_indexer_observation.pyScript7.1 KiB
helpers/_initial_prompt.pyScript12.5 KiB
helpers/_private_json.pyScript2.4 KiB
helpers/_progress.pyScript12.1 KiB
helpers/_prompt_read.pyScript17.7 KiB
helpers/_search_read.pyScript6.0 KiB
helpers/_source_readback.pyScript1.6 KiB
helpers/blob-contracts.md7.8 KiB
helpers/blob-cu-contracts.md7.8 KiB
helpers/blob_inventory.pyScript17.1 KiB
helpers/blob_recheck.pyScript64.6 KiB
helpers/blob_source.pyScript35.8 KiB
helpers/bootstrap-contracts.md7.8 KiB
helpers/bootstrap_azure.pyScript41.5 KiB
helpers/cleanup_plan.pyScript41.4 KiB
helpers/contracts.md7.8 KiB
helpers/cu_ingestion_auth.pyScript12.5 KiB
helpers/document-assessment.md7.8 KiB
helpers/document_assess.pyScript14.0 KiB
helpers/file-upload-recovery.md7.8 KiB
helpers/file_cu_canary.pyScript32.7 KiB
helpers/file_cu_mi.pyScript9.6 KiB
helpers/file_ingest.pyScript15.4 KiB
helpers/file_source.pyScript31.7 KiB
helpers/file_upload.pyScript53.7 KiB
helpers/hosted_connect.pyScript30.8 KiB
helpers/kb-contracts.md7.8 KiB
helpers/knowledge_base_retrieve.pyScript7.7 KiB
helpers/model-discovery-contracts.md7.8 KiB
helpers/model-discovery-scopes.md7.8 KiB
helpers/model_discovery.pyScript23.7 KiB
helpers/private-artifacts.md7.2 KiB
helpers/private_artifacts.pyScript4.8 KiB
helpers/prompt_cleanup.pyScript22.0 KiB
helpers/prompt_connect.pyScript62.3 KiB
helpers/requirements-assessment.txt103 B
helpers/retrieval-verification-contracts.md7.8 KiB
helpers/retrieval_verify.pyScript19.6 KiB
helpers/search-intake-contracts.md7.6 KiB
helpers/search_intake.pyScript18.4 KiB
helpers/search_reconcile.pyScript59.7 KiB
helpers/source_vector.pyScript33.2 KiB
helpers/throttle-recovery.md5.0 KiB
helpers/vector-contracts.md7.8 KiB
knowledge-bases/create.md8.1 KiB
knowledge-bases/retrieve.md7.8 KiB
knowledge-sources/create-azure-blob.md7.8 KiB
knowledge-sources/create-file.md7.8 KiB
lifecycle/cleanup.md7.8 KiB
references/abstention.md1.0 KiB
references/blob-binding-evidence.md7.8 KiB
references/blob-indexer-observation.md7.7 KiB
references/blob-ingestion-progress.md6.5 KiB
references/blob-readiness-recheck.md7.8 KiB
references/blob-vector-readiness.md2.6 KiB
references/bootstrap-azure.md7.8 KiB
references/content-fit.md7.8 KiB
references/cu-ingestion.md7.8 KiB
references/file-cu-canary.md7.8 KiB
references/intent-routing.md7.7 KiB
references/owner.md2.1 KiB
references/platform-contracts.md7.7 KiB
references/platform-interfaces.md7.8 KiB
references/resource-intake.md7.8 KiB
references/search-substrate.md7.8 KiB
references/standard-cu.md7.8 KiB
search-services/create.md7.8 KiB
troubleshooting/diagnose.md8.7 KiB

helpers/blob-cu-contracts.md

Optional Blob Content Understanding branch

Read only for processing: standard-cu in the Blob procedure. Selected Search/Storage/AI Services only; no provisioning, uploads, asset store, permission changes or KB creation. Resolve processing before planning; never downgrade CU or add it to minimal-vector.

Availability and dependencies

Read shared CU ingestion for independent model purposes, necessary checks and non-executable pending-dependency drafts. For portal/required-field questions, use the API/service/helper settings matrix.

Blob requires CU-capable AIServices in a supported region with an embedding deployment, not Search embeddingModel or source vectors. Image verbalization/source chat are disabled. Ingestion does not choose KB reasoning, reranking, query mode or synthesis.

Use the existing Search system-assigned identity with Cognitive Services User on that account; Storage stays ResourceId/keyless with Storage Blob Data Reader. Do not copy File CU credential channels or enable local auth. The Blob documentation's aiServices keyless configuration omits apiKey. Keys, user-assigned identities, private networking, schedules, asset stores and permission ingestion are outside this standard branch.

Verify CU capability/region/deployments, effective Search identity/RBAC and reachability through exact readbacks. configuration references selected processing/required deployment evidence. Existing dependencies permit planning; no setup-owner or azd prerequisite. Do not ask for a separate account-configuration confirmation. Default mappings need contract/observed-error evidence; never change them. cu-prerequisite-missing: name missing evidence, not a generic setup gate. No provisioning/model tests or default extraction downgrade.

Closed intent

Use the ordinary Blob intent, set processing: standard-cu and add this required object:

{"content_understanding":{"endpoint":"https://models.services.ai.azure.com","auth":"system-assigned","prerequisites":{"resource":"<CU capability/region readback>","configuration":"<selected processing/required deployment evidence>","identity":"<Search identity and AI Services role readback>","network":"<AI Services reachability evidence>"}}}

Fields required; references: 1–4096 characters. Omit embedding (or use null in the intent) to leave source vectors off. Only when selected, add the closed embedding choice. CU and source-vector endpoints are independently validated; they need not match. Combine CU/auth/source/vector costs and data consent; no manual credential/MI confirmation. Missing setup uses approved native bootstrap. A single trailing slash is immaterial. Custom CU endpoints, URL paths/queries/ports and credentials block. Minimal modes omit content_understanding. Private artifacts retain choices; summaries omit references, which are attestations, not CU calls.

New CU plans emit fingerprint-bound cu_plan_version: "1.0". This CU-specific marker requires the CU choice and exact presence/value binding of optional embeddings. Legacy approved wire-only standard artifacts, including expected_source_absent and expected_generated, retain their original admission, guards and fingerprints. Those generic guards predate CU planning; they do not select the new contract. Never rewrite historical approved artifacts/receipts. Removing choices from a marked CU artifact blocks if CU is missing or the wire still requests removed embeddings; changing/removing its marker invalidates existing approval. No new field is sent in the Search request.

Wire and approval

Both GA 2026-04-01 and preview 2026-08-01-preview expose azureBlobParameters.ingestionParameters with contentExtractionMode: standard, aiServices: {"uri": "<selected-endpoint>"}, disableImageVerbalization: true, null identity/schedule. Set embeddingModel only for selected source vectorization; otherwise omit it. Preview also sets public networking and empty permission options. ADLS remains preview-only in this helper with unchanged path/ACL controls.

Use the same blob_source.py --plan → private unapproved execution_input → one explicit unchanged-plan approval → --input flow. Execution uses conditional PUT /knowledgesources('<name>')?api-version=<selected-version> with If-None-Match: *, exact definition GET and status GET; no direct CU API call. Never overwrite or suffix around a collision.

CU creation also retains approved input and uses --receipt-dir. Timeout/interruption: read-only recheck, not another PUT or direct CU call. Fresh reuse capture carries no creation ownership.

Show combined source/CU/embedding cost, access and processing changes before approval. CU is billable with no free document allowance; selected documents move to CU and, only if selected, source embeddings, possibly across regions. Search retains outputs. The CU skill uses underlying CU 2025-11-01; Search manages that call, not a user-selectable version. Both GA and preview Swagger declare embeddingModel optional/nullable, with no required or conditional standard-extraction vectorizer constraint. CU deployment prerequisites must not be substituted for Search wire-field requirements. Search and CU limits apply, including five-minute analysis timeout with possible charges. No universal quality claim. Acceptance does not prove CU support; see format limits.

Verification and failure

Require exact CU mode/endpoint/auth readback. Allow only absent/null/empty-string aiServices.apiKey and null/absent ingestion identity. Masked/nonempty/malformed keys or another identity return cu-auth-conflict, without echoing values. Known null metadata, a single endpoint trailing slash and the documented resultsProcessing: rerank default do not require manual plan edits. Different endpoints, models, extraction, auth, scope, ETags or generated identities block; rerun planning and discard old consent.

Acceptance proves configuration only. The owning executor requires a relevant completed zero-failure ingestion cycle, not active or old success. Vector verification, only when configured, additionally observes generated dimensions/profile/vectorizer and nonempty zero-skip readiness. Retrieval needs its separately approved query; neither proves extraction quality or corpus-wide relevance. CU-only vector probes return embedding-not-configured, not “CU unsupported.” Fresh exact reuse remains mutation-approval-free, not ingestion/retrieval proof. Tests/mocks are not live evidence.

Keep the first failure/request ID. A failed post-write check is partial with run-owned source/children retained; never automatically delete anything. Use existing separately approved source cleanup only, never Storage, dependencies, shared resources or role assignments.

Authorities

Authorities: failure/conflict/uncertainty only.

Blob prerequisites, GA create, preview create, CU skill, GA Swagger, preview Swagger.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

The author says: Azure

Security

What our scanner noticed· Medium risk

References to credential files
Instructions that use the network
Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/foundry-iq-skills/skills/foundry-iq · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/foundry-iq-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download foundry-iq.zip