Foundry Iq

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Data and AI
MIT
Medium risk
Has scripts

From the author

Foundry IQ knowledge bases. WHEN: make local or Blob documents searchable; create/diagnose KBs; triage unsupported connectors or multi-source KB creation/reconfiguration (even with classic-search terms); connect existing KB to agents (including multi-source KBs); create/reuse a Search service; retrieve from an existing knowledge base with citations; no brand words needed. Read its procedure before query/target questions. NOT: other KB providers, repository-file search, classic Azure AI Search index/query/app work with no Foundry IQ KB or connector request, generic agent creation.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Foundry IQ provides a structured framework for creating, diagnosing, and connecting knowledge bases to AI agents. It supports making local or Blob-based documents searchable, managing multi-source knowledge configurations, and retrieving information with citations. The skill emphasizes strict adherence to defined procedures for service discovery, resource creation, and troubleshooting to ensure reliable agent-knowledge integration.

What it does

Creates searchable knowledge bases from local or Azure Blob storage documents.
Connects existing knowledge bases to AI agents.
Diagnoses issues with knowledge base configurations or unsupported connectors.
Retrieves information from knowledge bases with source citations.
Manages the lifecycle of search services and knowledge sources.
Routes requests based on specific operational needs rather than source counts.

When to use it

When you need to make local or cloud-stored documents searchable by an AI agent.
When connecting an existing knowledge base to a new or current agent.
When troubleshooting or diagnosing a knowledge base configuration.
When you need to create a new search service or knowledge source.
When performing retrieval tasks that require citations from a knowledge base.

Advantages

Provides a clear, procedural approach to knowledge base management.
Ensures consistent handling of multi-source knowledge configurations.
Includes built-in diagnostic paths for troubleshooting.
Supports secure, citation-backed retrieval for agent responses.
Prevents unauthorized or unsupported configuration changes.

Usage examples

“Create a new knowledge base from my Azure Blob container.”: The agent will initiate the knowledge base creation procedure, validating the source and setting up the necessary search indexing.
“Connect my existing knowledge base to the current agent.”: The agent will follow the connection workflow to link the specified knowledge base to the agent's retrieval pipeline.
“Why is my multi-source knowledge base failing to index?”: The agent will trigger the diagnostic procedure to identify configuration drifts or unsupported connector issues.
“Retrieve information about project timelines from the knowledge base.”: The agent will query the knowledge base and provide an answer with citations from the source documents.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/foundry-iq/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip foundry-iq.zip -d .agents/skills

Documentation by Microsoft

Foundry IQ

Read one procedure before questions/actions; invocation is not a read. Read the owning procedure before blocked/unsupported responses too. Before mutation plans/approval, successfully read its required pre-action references, selected branches only. Do not reload successful reads. On failure, try only permitted bounded exact-path reads with any supported reader; never bypass restrictions or search broadly. If still unavailable: blocked: reference-unavailable, name missing references and inability to plan. Never invent requirements/plans. Failures first.

Cleanup and receipt-backed execution go directly to their lifecycle/producer owner; do not reopen Search intake, provisioning or hardening.

Before expensive service discovery, reuse supplied resource/intent; otherwise ask one early USE EXISTING / FIND CANDIDATES / CREATE NEW choice. Only FIND enumerates; supplied identity uses exact/minimum scoped resolution. CREATE checks its proposed name, not existing-service inventories. Preserve these answers across source/KB/CU/model handoffs; selection is not write approval.

Searchable docs: KB + validated retrieval. Confirm intent once; KS-only must be explicit. Child success is not KB completion. Unclear/compound/mode/completion: read.

Route by requested operation, not existing KB source count. Connecting an existing KB with two or more sources, without changing the KB, uses Connect. Read-only operations use their owning procedure and actual helper constraints; this does not add retrieval modes or supported source kinds. Explicit unsupported provisioning or multi-source KB creation/reconfiguration uses Diagnose and stops before discovery, even when connecting an agent is also requested. This routing takes precedence over classic-search terms (e.g. hybrid search) in compound requests. Never end in a plain refusal: Diagnose gives the boundary, docs pointer and agent handoff; writes still need an approved concrete plan. Do not silently execute only the supported part of a compound request. If existing-KB connection versus KB creation/reconfiguration is unclear, read intent-routing and clarify that scope before Azure discovery. Never infer KB mutation.

Outcome	Read
Cleanup	Plan cleanup
Failure/drift	Diagnose
Unsupported connector provisioning / multi-source KB creation or reconfiguration	Diagnose
Connect	Connect
Read KB	Query
Search only	Search
File KS only	File
Blob/ADLS KS only	Blob
Searchable/KB	KB

Generic agents: microsoft-foundry. Reads: no approval; approve unchanged plans before writes. Hide hashes. No Search/Storage keys, scope widening, guessed identity/boundaries, drift repair or joint cleanup/creation approval. Acceptance != success.

Files

ATTRIBUTION.mdAdded by AutoGineer977 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.7 KiB
agents/connect-hosted-toolbox.md7.8 KiB
agents/connect-hosted.md7.8 KiB
agents/connect-prompt-sdk-fallback.md7.8 KiB
agents/connect.md7.8 KiB
agents/create-missing-agent.md7.8 KiB
helpers/_blob_observation.pyScript4.4 KiB
helpers/_blob_source_read.pyScript39.5 KiB
helpers/_bootstrap_io.pyScript30.1 KiB
helpers/_cleanup_dependencies.pyScript27.5 KiB
helpers/_cleanup_receipts.pyScript13.5 KiB
helpers/_common.pyScript36.2 KiB
helpers/_document_adapters.pyScript15.0 KiB
helpers/_document_limits.pyScript3.9 KiB
helpers/_embedding.pyScript7.0 KiB
helpers/_file_inventory.pyScript24.4 KiB
helpers/_file_source_config.pyScript15.6 KiB
helpers/_indexer_observation.pyScript7.1 KiB
helpers/_initial_prompt.pyScript12.5 KiB
helpers/_private_json.pyScript2.4 KiB
helpers/_progress.pyScript12.1 KiB
helpers/_prompt_read.pyScript17.7 KiB
helpers/_search_read.pyScript6.0 KiB
helpers/_source_readback.pyScript1.6 KiB
helpers/blob-contracts.md7.8 KiB
helpers/blob-cu-contracts.md7.8 KiB
helpers/blob_inventory.pyScript17.1 KiB
helpers/blob_recheck.pyScript64.6 KiB
helpers/blob_source.pyScript35.8 KiB
helpers/bootstrap-contracts.md7.8 KiB
helpers/bootstrap_azure.pyScript41.5 KiB
helpers/cleanup_plan.pyScript41.4 KiB
helpers/contracts.md7.8 KiB
helpers/cu_ingestion_auth.pyScript12.5 KiB
helpers/document-assessment.md7.8 KiB
helpers/document_assess.pyScript14.0 KiB
helpers/file-upload-recovery.md7.8 KiB
helpers/file_cu_canary.pyScript32.7 KiB
helpers/file_cu_mi.pyScript9.6 KiB
helpers/file_ingest.pyScript15.4 KiB
helpers/file_source.pyScript31.7 KiB
helpers/file_upload.pyScript53.7 KiB
helpers/hosted_connect.pyScript30.8 KiB
helpers/kb-contracts.md7.8 KiB
helpers/knowledge_base_retrieve.pyScript7.7 KiB
helpers/model-discovery-contracts.md7.8 KiB
helpers/model-discovery-scopes.md7.8 KiB
helpers/model_discovery.pyScript23.7 KiB
helpers/private-artifacts.md7.2 KiB
helpers/private_artifacts.pyScript4.8 KiB
helpers/prompt_cleanup.pyScript22.0 KiB
helpers/prompt_connect.pyScript62.3 KiB
helpers/requirements-assessment.txt103 B
helpers/retrieval-verification-contracts.md7.8 KiB
helpers/retrieval_verify.pyScript19.6 KiB
helpers/search-intake-contracts.md7.6 KiB
helpers/search_intake.pyScript18.4 KiB
helpers/search_reconcile.pyScript59.7 KiB
helpers/source_vector.pyScript33.2 KiB
helpers/throttle-recovery.md5.0 KiB
helpers/vector-contracts.md7.8 KiB
knowledge-bases/create.md8.1 KiB
knowledge-bases/retrieve.md7.8 KiB
knowledge-sources/create-azure-blob.md7.8 KiB
knowledge-sources/create-file.md7.8 KiB
lifecycle/cleanup.md7.8 KiB
references/abstention.md1.0 KiB
references/blob-binding-evidence.md7.8 KiB
references/blob-indexer-observation.md7.7 KiB
references/blob-ingestion-progress.md6.5 KiB
references/blob-readiness-recheck.md7.8 KiB
references/blob-vector-readiness.md2.6 KiB
references/bootstrap-azure.md7.8 KiB
references/content-fit.md7.8 KiB
references/cu-ingestion.md7.8 KiB
references/file-cu-canary.md7.8 KiB
references/intent-routing.md7.7 KiB
references/owner.md2.1 KiB
references/platform-contracts.md7.7 KiB
references/platform-interfaces.md7.8 KiB
references/resource-intake.md7.8 KiB
references/search-substrate.md7.8 KiB
references/standard-cu.md7.8 KiB
search-services/create.md7.8 KiB
troubleshooting/diagnose.md8.7 KiB

references/bootstrap-azure.md

Native prerequisite bootstrap

Use signed-in az, never evaluation fixtures or credentials in chat. Missing CLI/access returns bootstrap-tool-unavailable/bootstrap-access-denied. Invoke az as subprocess argument lists, never shell strings; platform support varies. Keep sanitized evidence in private receipts; show status/IDs, never raw stdout/stderr.

Search: owner. Here: RG/models/roles/CU and separately approved cleanup.

Resource-group-only prerequisite

For an absent group, execute RG-only: resolve subscription/group/region/tags/owner, approve its concrete plan, use only the R row below with fresh absence/readback. Require provisioningState == Succeeded; return the ready group ID to the caller. Do not dispatch Search, models, roles, Storage or CU, or re-enter the Search procedure from this branch. Search planning resumes only after RG readiness; no unknown future Search body is approved here.

Discover and approve

Use az account show, then exact ARM GETs for supplied IDs/names. Reuse resolved selections; otherwise propose CLI default subscription, explicit scope taking precedence. Never silently switch context. Reuse supplied resource/intent; else ask USE EXISTING / FIND CANDIDATES / CREATE NEW. Ask only unresolved choices, not discovery outputs. Only FIND enumerates: az group list --subscription  if no group is selected. Only model-dependent paths with no selected account and FIND use az cognitiveservices account list --subscription . Add a known --resource-group <group>; otherwise browse the selected subscription. Read all pages in scope. Only target ResourceNotFound proves absence, not 403/timeouts/empty output.

Models: read choices. Existing: exact readback. CREATE: collision/quota/region/cost, no service inventory. Retain choices. Model-free lexical paths skip model calls. New embeddings: propose 100K TPM if quota allows; otherwise ask. Approve model/SKU integer units. Verify region/network/prices; quota is not capacity.

Internal plan fingerprint: SHA-256 of sorted-key, ASCII-escaped, compact UTF-8 JSON. Bind IDs/URLs, before-state, bodies/tags, owner/model/version/SKU/capacity/cost/network/known requirements, deadline/readbacks/cleanup. Propose nonce names within user constraints. Actual approval precedes writes; new MI readback needs separate role approval. No routine policy reads. Only creation failures implicating policy trigger targeted diagnostics in the shared prerequisite contract.

Native ARM actions

Let R=/subscriptions//resourceGroups/<group>, A=R/providers/Microsoft.CognitiveServices/accounts/<account>. https://management.azure.com<ID>?api-version=<version>. GET immediately before each absent-resource PUT; existing means reuse/replan, never overwrite. ARM does not document If-None-Match: GET/PUT is not atomic. Require exclusive authority over new names; disclose the race. Unavailable required atomic protection blocks with bootstrap-concurrency-unresolved.

az rest --method get --url <url> then az rest --method put --url <url> --headers Content-Type=application/json --body @<approved-body-file>. @ loads an Azure CLI body file, not shell expansion. Pass "@" + str(body_path) as one subprocess argument, including paths with spaces; a bare path sends text, not JSON.

Apply retained approved bodies in dependency order:

ID / API	JSON body (substitute approved values)
R / `2022-09-01`	`{"location":"<region>","tags":{}}`
A / `2025-06-01`	`{"location":"<region>","tags":{},"kind":"OpenAI","sku":{"name":"S0"},"properties":{"customSubDomainName":"<name>","publicNetworkAccess":"<approved>","disableLocalAuth":true}}`
A/deployments/name / `2025-06-01`	`{"sku":{"name":"<deployment-SKU>","capacity":<approved-capacity>},"properties":{"model":{"format":"OpenAI","name":"<model>","version":"<version>"}}}`

Use required tags/settings; read back TPM/RPM. Poll GET to provisioningState == Succeeded; compare ID/body/tags and read principalId/endpoint/model/version/SKU/capacity. Accepted is not ready. Retain first error/request ID; reconcile ambiguous writes read-only, never blind retry or suffix-create.

Roles, readiness and return

Offer approved missing-role setup. Freshly read Search's identity.principalId, never assume it. For Blob/ADLS, recommend Storage Blob Data Reader for that ServicePrincipal at <storage-id>/blobServices/default/containers/<container>. This grants container-wide access even when ingestion selects a folder. Disclose scope; block if unacceptable, never broaden. Account scope requires explicit selection/approval, never a fallback for denial. az role definition list --name <role> --subscription  resolves role IDs; az role assignment list --scope <id> --include-inherited --subscription --fill-principal-name false --fill-role-definition-name false inventories roles. Match principal/role/scope and inherited access; read all pages. Reuse sufficient grants; preserve unrelated roles. Unreadable inventories or uncertain conditions/deny assignments are not proof of missing access. Bind missing grants to principal/role/scope/GUID and RBAC approval; source approval alone is insufficient; caller needs Microsoft.Authorization/roleAssignments/write at that scope. No approval/authority: return owner action; never self-elevate or switch identity. Recheck identity and assignments before writing; drift needs a new plan, a newly sufficient grant needs no write.

az role assignment create --subscription --name <approved-guid> --assignee-object-id <principal> --assignee-principal-type <User-or-ServicePrincipal> --role <role-id> --scope <exact-id>.

Use the target scope's subscription; read back assignment ID and exact principal/role/scope; keep ownership private. Ambiguous create: reconcile read-only with the same GUID, never retry using a new GUID or broaden scope. Return observed assignments to the source planner; do not fabricate RBAC evidence.

Search scope: operator Search Service Contributor, ingestion Search Index Data Contributor, retrieval Search Index Data Reader. Search MI: Cognitive Services User on model account; Blob additionally Storage Blob Data Reader on approved Storage scope. No unnecessary roles. For Search, bounded propagation waits use fresh CLI Entra auth: az rest --method get --url "<search-endpoint>/knowledgesources?api-version=2026-08-01-preview" --resource https://search.azure.com/. Require disableLocalAuth == true; no authOptions with it. Never call listAdminKeys, listQueryKeys, regenerateAdminKey or createQueryKey. Prove denial with az rest --skip-authorization-header --method get --url <probe-url> --headers api-key=phase1-key-denial-probe. Never acquire a real key. Missing readiness is partial, never permission to weaken security. Search metadata GET or operator Blob listing does not prove Search MI Storage access. After RBAC readback, resume the approved source workflow; require its relevant successful ingestion cycle. Pending propagation is unverified within the agreed deadline, not permission to regrant, bypass access or reset generated indexers.

CU ingestion: shared auth/setup; connection-only/minimal skip CU.

Cleanup

After source/KB removal, separately approve az role assignment delete --ids <id> then az rest --method delete --url <approved-ARM-url>; verify absence. Require fresh exclusive ownership/configuration/children/scoped-role inventory; no invented ARM ETags or reused/foreign deletion. Return observed dependencies; failure retains partial writes.

Optional schemas.

Authorities: failure/conflict/uncertainty only. Search Storage identity; Blob RBAC.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

The author says: Azure

Security

What our scanner noticed· Medium risk

References to credential files
Instructions that use the network
Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/foundry-iq-skills/skills/foundry-iq · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/foundry-iq-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download foundry-iq.zip