Foundry Iq

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Data and AI
MIT
Medium risk
Has scripts

From the author

Foundry IQ knowledge bases. WHEN: make local or Blob documents searchable; create/diagnose KBs; triage unsupported connectors or multi-source KB creation/reconfiguration (even with classic-search terms); connect existing KB to agents (including multi-source KBs); create/reuse a Search service; retrieve from an existing knowledge base with citations; no brand words needed. Read its procedure before query/target questions. NOT: other KB providers, repository-file search, classic Azure AI Search index/query/app work with no Foundry IQ KB or connector request, generic agent creation.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Foundry IQ provides a structured framework for creating, diagnosing, and connecting knowledge bases to AI agents. It supports making local or Blob-based documents searchable, managing multi-source knowledge configurations, and retrieving information with citations. The skill emphasizes strict adherence to defined procedures for service discovery, resource creation, and troubleshooting to ensure reliable agent-knowledge integration.

What it does

Creates searchable knowledge bases from local or Azure Blob storage documents.
Connects existing knowledge bases to AI agents.
Diagnoses issues with knowledge base configurations or unsupported connectors.
Retrieves information from knowledge bases with source citations.
Manages the lifecycle of search services and knowledge sources.
Routes requests based on specific operational needs rather than source counts.

When to use it

When you need to make local or cloud-stored documents searchable by an AI agent.
When connecting an existing knowledge base to a new or current agent.
When troubleshooting or diagnosing a knowledge base configuration.
When you need to create a new search service or knowledge source.
When performing retrieval tasks that require citations from a knowledge base.

Advantages

Provides a clear, procedural approach to knowledge base management.
Ensures consistent handling of multi-source knowledge configurations.
Includes built-in diagnostic paths for troubleshooting.
Supports secure, citation-backed retrieval for agent responses.
Prevents unauthorized or unsupported configuration changes.

Usage examples

“Create a new knowledge base from my Azure Blob container.”: The agent will initiate the knowledge base creation procedure, validating the source and setting up the necessary search indexing.
“Connect my existing knowledge base to the current agent.”: The agent will follow the connection workflow to link the specified knowledge base to the agent's retrieval pipeline.
“Why is my multi-source knowledge base failing to index?”: The agent will trigger the diagnostic procedure to identify configuration drifts or unsupported connector issues.
“Retrieve information about project timelines from the knowledge base.”: The agent will query the knowledge base and provide an answer with citations from the source documents.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/foundry-iq/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip foundry-iq.zip -d .agents/skills

Documentation by Microsoft

Foundry IQ

Read one procedure before questions/actions; invocation is not a read. Read the owning procedure before blocked/unsupported responses too. Before mutation plans/approval, successfully read its required pre-action references, selected branches only. Do not reload successful reads. On failure, try only permitted bounded exact-path reads with any supported reader; never bypass restrictions or search broadly. If still unavailable: blocked: reference-unavailable, name missing references and inability to plan. Never invent requirements/plans. Failures first.

Cleanup and receipt-backed execution go directly to their lifecycle/producer owner; do not reopen Search intake, provisioning or hardening.

Before expensive service discovery, reuse supplied resource/intent; otherwise ask one early USE EXISTING / FIND CANDIDATES / CREATE NEW choice. Only FIND enumerates; supplied identity uses exact/minimum scoped resolution. CREATE checks its proposed name, not existing-service inventories. Preserve these answers across source/KB/CU/model handoffs; selection is not write approval.

Searchable docs: KB + validated retrieval. Confirm intent once; KS-only must be explicit. Child success is not KB completion. Unclear/compound/mode/completion: read.

Route by requested operation, not existing KB source count. Connecting an existing KB with two or more sources, without changing the KB, uses Connect. Read-only operations use their owning procedure and actual helper constraints; this does not add retrieval modes or supported source kinds. Explicit unsupported provisioning or multi-source KB creation/reconfiguration uses Diagnose and stops before discovery, even when connecting an agent is also requested. This routing takes precedence over classic-search terms (e.g. hybrid search) in compound requests. Never end in a plain refusal: Diagnose gives the boundary, docs pointer and agent handoff; writes still need an approved concrete plan. Do not silently execute only the supported part of a compound request. If existing-KB connection versus KB creation/reconfiguration is unclear, read intent-routing and clarify that scope before Azure discovery. Never infer KB mutation.

Outcome	Read
Cleanup	Plan cleanup
Failure/drift	Diagnose
Unsupported connector provisioning / multi-source KB creation or reconfiguration	Diagnose
Connect	Connect
Read KB	Query
Search only	Search
File KS only	File
Blob/ADLS KS only	Blob
Searchable/KB	KB

Generic agents: microsoft-foundry. Reads: no approval; approve unchanged plans before writes. Hide hashes. No Search/Storage keys, scope widening, guessed identity/boundaries, drift repair or joint cleanup/creation approval. Acceptance != success.

Files

ATTRIBUTION.mdAdded by AutoGineer977 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.7 KiB
agents/connect-hosted-toolbox.md7.8 KiB
agents/connect-hosted.md7.8 KiB
agents/connect-prompt-sdk-fallback.md7.8 KiB
agents/connect.md7.8 KiB
agents/create-missing-agent.md7.8 KiB
helpers/_blob_observation.pyScript4.4 KiB
helpers/_blob_source_read.pyScript39.5 KiB
helpers/_bootstrap_io.pyScript30.1 KiB
helpers/_cleanup_dependencies.pyScript27.5 KiB
helpers/_cleanup_receipts.pyScript13.5 KiB
helpers/_common.pyScript36.2 KiB
helpers/_document_adapters.pyScript15.0 KiB
helpers/_document_limits.pyScript3.9 KiB
helpers/_embedding.pyScript7.0 KiB
helpers/_file_inventory.pyScript24.4 KiB
helpers/_file_source_config.pyScript15.6 KiB
helpers/_indexer_observation.pyScript7.1 KiB
helpers/_initial_prompt.pyScript12.5 KiB
helpers/_private_json.pyScript2.4 KiB
helpers/_progress.pyScript12.1 KiB
helpers/_prompt_read.pyScript17.7 KiB
helpers/_search_read.pyScript6.0 KiB
helpers/_source_readback.pyScript1.6 KiB
helpers/blob-contracts.md7.8 KiB
helpers/blob-cu-contracts.md7.8 KiB
helpers/blob_inventory.pyScript17.1 KiB
helpers/blob_recheck.pyScript64.6 KiB
helpers/blob_source.pyScript35.8 KiB
helpers/bootstrap-contracts.md7.8 KiB
helpers/bootstrap_azure.pyScript41.5 KiB
helpers/cleanup_plan.pyScript41.4 KiB
helpers/contracts.md7.8 KiB
helpers/cu_ingestion_auth.pyScript12.5 KiB
helpers/document-assessment.md7.8 KiB
helpers/document_assess.pyScript14.0 KiB
helpers/file-upload-recovery.md7.8 KiB
helpers/file_cu_canary.pyScript32.7 KiB
helpers/file_cu_mi.pyScript9.6 KiB
helpers/file_ingest.pyScript15.4 KiB
helpers/file_source.pyScript31.7 KiB
helpers/file_upload.pyScript53.7 KiB
helpers/hosted_connect.pyScript30.8 KiB
helpers/kb-contracts.md7.8 KiB
helpers/knowledge_base_retrieve.pyScript7.7 KiB
helpers/model-discovery-contracts.md7.8 KiB
helpers/model-discovery-scopes.md7.8 KiB
helpers/model_discovery.pyScript23.7 KiB
helpers/private-artifacts.md7.2 KiB
helpers/private_artifacts.pyScript4.8 KiB
helpers/prompt_cleanup.pyScript22.0 KiB
helpers/prompt_connect.pyScript62.3 KiB
helpers/requirements-assessment.txt103 B
helpers/retrieval-verification-contracts.md7.8 KiB
helpers/retrieval_verify.pyScript19.6 KiB
helpers/search-intake-contracts.md7.6 KiB
helpers/search_intake.pyScript18.4 KiB
helpers/search_reconcile.pyScript59.7 KiB
helpers/source_vector.pyScript33.2 KiB
helpers/throttle-recovery.md5.0 KiB
helpers/vector-contracts.md7.8 KiB
knowledge-bases/create.md8.1 KiB
knowledge-bases/retrieve.md7.8 KiB
knowledge-sources/create-azure-blob.md7.8 KiB
knowledge-sources/create-file.md7.8 KiB
lifecycle/cleanup.md7.8 KiB
references/abstention.md1.0 KiB
references/blob-binding-evidence.md7.8 KiB
references/blob-indexer-observation.md7.7 KiB
references/blob-ingestion-progress.md6.5 KiB
references/blob-readiness-recheck.md7.8 KiB
references/blob-vector-readiness.md2.6 KiB
references/bootstrap-azure.md7.8 KiB
references/content-fit.md7.8 KiB
references/cu-ingestion.md7.8 KiB
references/file-cu-canary.md7.8 KiB
references/intent-routing.md7.7 KiB
references/owner.md2.1 KiB
references/platform-contracts.md7.7 KiB
references/platform-interfaces.md7.8 KiB
references/resource-intake.md7.8 KiB
references/search-substrate.md7.8 KiB
references/standard-cu.md7.8 KiB
search-services/create.md7.8 KiB
troubleshooting/diagnose.md8.7 KiB

knowledge-bases/create.md

Create a knowledge base

When to use

Create exactly one KB over one verified File, Blob or ADLS Gen2 source. Single-source helper; Azure supports multiple sources.

Do not use

Not multiple sources, unsupported connectors, classic Search or agents. For unsupported sources/connectors or multi-source KB creation/reconfiguration, route to Diagnose to hand off to the calling agent with Azure AI Search public documentation pointers so the agent can take action to get it done. Never mutate conflicts, select duplicates or call GA extraction synthesis.

Inputs and discovery order

Reuse prompt/session/workspace/exact Azure readback; then one focused question. Label sources; silence is not approval. Reads need no approval.

Input	Why needed	Required?	Discovery order	Safe default	If missing or unanswered	Reconfirmation trigger
Tenant/subscription/group/region	Scope	Yes	Azure/selection	Propose absent group	Ask	Scope
Search ID/endpoint	Target	Pre-source	Discovery/bootstrap	Honor reuse/new	Bootstrap absent	Target
Source ID/type/boundary/definition	Grounding	Pre-approval	Source GET	None	Create absent; block unverified	Source
Base name/owner/purpose	Identity	Yes	Prompt/caller/GET	Azure user	Override	Identity/owner
Outcome/API/mode	Response	Yes	Prompt/GET	GA Blob: minimal/extractive	Block unsupported	Outcome/API
Effort/model/version/capacity	Preview	Conditional	Choice/bootstrap	Minimal/extractive	Resolve	Model/capacity/region
Caller/roles	Retrieval	Pre-query	Discovery/bootstrap	Service reader	Plan missing roles	Identity/scope
Network/permissions	Security	Required	Source/Search GET	Preserve	Block	Posture
Source identity	Source binding	Required	Source inventory	None	Block	Identity change
Acceptance/unrelated questions	Retrieval audit	Opt-in	Authorized evidence	Not requested	Defer audit	Question change
Cleanup owner	Recovery	Yes	Prompt, session	Cleanup not approved	Block	Owner change

Decisions

Offline audit is opt-in; no Q&A required for creation. Propose title/content questions from authorized content, not filenames/structural facts. No samples/questions: defer audit; separate query consent. Audit/filename.

Default explicitly to minimal/extractive. Minimal extractive KB adds no model; preview minimal permits synthesis. Low/medium or synthesis needs a KB model, separate from source CU/embeddings. Omitted KB/request effort defaults to low, not the portal's Minimal selection. Retrieval/answer instructions: optional, preview-only. API auto: explicit handoff.

Select/recheck Search operation first: owner. For low/medium or synthesis, select/reuse chat or bootstrap approved model/version/region/capacity/cost/access. Verify readiness, resume KB creation; never downgrade. Other infrastructure stays shared; no routine policy reads.

Retain source IDs/API/boundary/definition, ownership/health/permissions/reuse, content assessment/uncertainty, answer needs and ingestion mode through prerequisites; resume KB plus validated retrieval, not source-only. Readback drift blocks. Only then present the KB plan; never preapprove a future verified_source or reuse bootstrap consent for KB mutation.

GET exact name; only FIND paginates. Normalized match: zero-write. Multiple compatible KBs require exact-ID selection. Same-name conflict/inaccessible blocks. Choose:

minimal: direct extractive grounding. Blob-only, non-agentic, non-permission-preview work defaults to GA 2026-04-01, with no preview-only fields or synthesized I don't know.
Preview minimal: explicit minimal effort; extractive or synthesis with one chat model. Synthesis adds model cost, not query planning; retrieval still uses intents.
Low/medium: one preflighted chat model; extractiveData or answerSynthesis. Low is one-pass; medium may follow up. Preserve a low miss and ask one tradeoff question; never auto-escalate.

File/synthesis/permissions/low/medium require approved preview. Prompt uses preview; GA MCP is minimal/extractive.

Agent-compatible minimal transition

Optional, not a required step for every agent connection; preserve valid KB reasoning/synthesis. Read the existing GA minimal KB through 2026-08-01-preview; verify its source. With separate approval, use action: update and the current ETag to set only outputMode: extractiveData and retrievalReasoningEffort: {kind: minimal}. Leave models, source contents, RBAC and networking unchanged; preserve unrelated fields; conflicts block. Verify agent MCP retrieval; GA isn't MCP proof.

Proposed plan

Read helper contracts before planning. Use KB intent/wire: python helpers/search_reconcile.py --plan <intent.json>. Show IDs/source/owner/API/mode/model, data/access/cost, optional acceptance, actions/verification/cleanup/retained resources. No write.

Confirmation

Keep immutable proposed mutation plan/plan_fingerprint, cleanup_approved: false. Approve concrete changes once. Changed source/mode/model/boundary/access, acceptance or freshness requires review; never ask users to calculate or repeat hashes.

Mutation

After approval, invoke:

python helpers/search_reconcile.py --input <approved-envelope.json>

reconcile/knowledge-base binds endpoint/name/API/definition/owner, cleanup_approved: false, verified source name/normalized same-API digest. Before create/update/reuse, a fresh source GET must match. Block absent/unreadable/drift, mode/API mixing and extra sources. Conditional create/ETag-update reads back. Exit 2: blocked/no-write; 3: partial.

Preserve API settings and reuse roles/dependencies. Never overwrite conflicts, add sources, resize models, broaden access or modify source/generated children. Resolve ambiguity on the same identity.

Verification

Verify owner/source/API/mode/model/keyless access/roles/network. Use REST Retrieve with consent; check grounding/native references/activity, no MCP. Errors remain incomplete. Without query consent: retrieval_status: not-tested; KB creation is separate. Requested retrieval stays incomplete until verified. Default audit_status: not-requested; no paired bundle required. Opted-in audits: original File path plus file ID or Blob/ADLS URL/path plus ETag/version; a bare path/URL is insufficient. Missing proof stays unverified. For authorized unrelated questions, answerSynthesis requires semantic abstention per the abstention criteria and any explicit exact-output contract. GA/preview extractiveData requires no supporting extracts. Recheck stable IDs/zero writes. Optional: Connect.

Failure and partial completion

Preserve first status/message/request ID. Low failure never authorizes medium. Citation/access/model/region/definition/source mismatch blocks. blocked: evidence, no writes, next decision. partial: writes, unverified state, ownership and separately approved cleanup.

Cleanup

Receipts: retain pre-create. Separate cleanup plan/approval: run-owned KB before exclusive owned dependencies. Keep reused resources, source content, retained sources' children/shared roles. operation: delete: owned digest/fresh ETag; unclear ownership blocks.

Return contract

Return status/IDs/API/mode/model, access/data movement, verification, first failure/warnings/ownership/cleanup; hide digests.

References

Authorities: failure/conflict/uncertainty only.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

The author says: Azure

Security

What our scanner noticed· Medium risk

References to credential files
Instructions that use the network
Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/foundry-iq-skills/skills/foundry-iq · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/foundry-iq-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download foundry-iq.zip