Foundry Iq

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Data and AI
MIT
Medium risk
Has scripts

From the author

Foundry IQ knowledge bases. WHEN: make local or Blob documents searchable; create/diagnose KBs; triage unsupported connectors or multi-source KB creation/reconfiguration (even with classic-search terms); connect existing KB to agents (including multi-source KBs); create/reuse a Search service; retrieve from an existing knowledge base with citations; no brand words needed. Read its procedure before query/target questions. NOT: other KB providers, repository-file search, classic Azure AI Search index/query/app work with no Foundry IQ KB or connector request, generic agent creation.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Foundry IQ provides a structured framework for creating, diagnosing, and connecting knowledge bases to AI agents. It supports making local or Blob-based documents searchable, managing multi-source knowledge configurations, and retrieving information with citations. The skill emphasizes strict adherence to defined procedures for service discovery, resource creation, and troubleshooting to ensure reliable agent-knowledge integration.

What it does

Creates searchable knowledge bases from local or Azure Blob storage documents.
Connects existing knowledge bases to AI agents.
Diagnoses issues with knowledge base configurations or unsupported connectors.
Retrieves information from knowledge bases with source citations.
Manages the lifecycle of search services and knowledge sources.
Routes requests based on specific operational needs rather than source counts.

When to use it

When you need to make local or cloud-stored documents searchable by an AI agent.
When connecting an existing knowledge base to a new or current agent.
When troubleshooting or diagnosing a knowledge base configuration.
When you need to create a new search service or knowledge source.
When performing retrieval tasks that require citations from a knowledge base.

Advantages

Provides a clear, procedural approach to knowledge base management.
Ensures consistent handling of multi-source knowledge configurations.
Includes built-in diagnostic paths for troubleshooting.
Supports secure, citation-backed retrieval for agent responses.
Prevents unauthorized or unsupported configuration changes.

Usage examples

“Create a new knowledge base from my Azure Blob container.”: The agent will initiate the knowledge base creation procedure, validating the source and setting up the necessary search indexing.
“Connect my existing knowledge base to the current agent.”: The agent will follow the connection workflow to link the specified knowledge base to the agent's retrieval pipeline.
“Why is my multi-source knowledge base failing to index?”: The agent will trigger the diagnostic procedure to identify configuration drifts or unsupported connector issues.
“Retrieve information about project timelines from the knowledge base.”: The agent will query the knowledge base and provide an answer with citations from the source documents.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/foundry-iq/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip foundry-iq.zip -d .agents/skills

Documentation by Microsoft

Foundry IQ

Read one procedure before questions/actions; invocation is not a read. Read the owning procedure before blocked/unsupported responses too. Before mutation plans/approval, successfully read its required pre-action references, selected branches only. Do not reload successful reads. On failure, try only permitted bounded exact-path reads with any supported reader; never bypass restrictions or search broadly. If still unavailable: blocked: reference-unavailable, name missing references and inability to plan. Never invent requirements/plans. Failures first.

Cleanup and receipt-backed execution go directly to their lifecycle/producer owner; do not reopen Search intake, provisioning or hardening.

Before expensive service discovery, reuse supplied resource/intent; otherwise ask one early USE EXISTING / FIND CANDIDATES / CREATE NEW choice. Only FIND enumerates; supplied identity uses exact/minimum scoped resolution. CREATE checks its proposed name, not existing-service inventories. Preserve these answers across source/KB/CU/model handoffs; selection is not write approval.

Searchable docs: KB + validated retrieval. Confirm intent once; KS-only must be explicit. Child success is not KB completion. Unclear/compound/mode/completion: read.

Route by requested operation, not existing KB source count. Connecting an existing KB with two or more sources, without changing the KB, uses Connect. Read-only operations use their owning procedure and actual helper constraints; this does not add retrieval modes or supported source kinds. Explicit unsupported provisioning or multi-source KB creation/reconfiguration uses Diagnose and stops before discovery, even when connecting an agent is also requested. This routing takes precedence over classic-search terms (e.g. hybrid search) in compound requests. Never end in a plain refusal: Diagnose gives the boundary, docs pointer and agent handoff; writes still need an approved concrete plan. Do not silently execute only the supported part of a compound request. If existing-KB connection versus KB creation/reconfiguration is unclear, read intent-routing and clarify that scope before Azure discovery. Never infer KB mutation.

Outcome	Read
Cleanup	Plan cleanup
Failure/drift	Diagnose
Unsupported connector provisioning / multi-source KB creation or reconfiguration	Diagnose
Connect	Connect
Read KB	Query
Search only	Search
File KS only	File
Blob/ADLS KS only	Blob
Searchable/KB	KB

Generic agents: microsoft-foundry. Reads: no approval; approve unchanged plans before writes. Hide hashes. No Search/Storage keys, scope widening, guessed identity/boundaries, drift repair or joint cleanup/creation approval. Acceptance != success.

Files

ATTRIBUTION.mdAdded by AutoGineer977 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.7 KiB
agents/connect-hosted-toolbox.md7.8 KiB
agents/connect-hosted.md7.8 KiB
agents/connect-prompt-sdk-fallback.md7.8 KiB
agents/connect.md7.8 KiB
agents/create-missing-agent.md7.8 KiB
helpers/_blob_observation.pyScript4.4 KiB
helpers/_blob_source_read.pyScript39.5 KiB
helpers/_bootstrap_io.pyScript30.1 KiB
helpers/_cleanup_dependencies.pyScript27.5 KiB
helpers/_cleanup_receipts.pyScript13.5 KiB
helpers/_common.pyScript36.2 KiB
helpers/_document_adapters.pyScript15.0 KiB
helpers/_document_limits.pyScript3.9 KiB
helpers/_embedding.pyScript7.0 KiB
helpers/_file_inventory.pyScript24.4 KiB
helpers/_file_source_config.pyScript15.6 KiB
helpers/_indexer_observation.pyScript7.1 KiB
helpers/_initial_prompt.pyScript12.5 KiB
helpers/_private_json.pyScript2.4 KiB
helpers/_progress.pyScript12.1 KiB
helpers/_prompt_read.pyScript17.7 KiB
helpers/_search_read.pyScript6.0 KiB
helpers/_source_readback.pyScript1.6 KiB
helpers/blob-contracts.md7.8 KiB
helpers/blob-cu-contracts.md7.8 KiB
helpers/blob_inventory.pyScript17.1 KiB
helpers/blob_recheck.pyScript64.6 KiB
helpers/blob_source.pyScript35.8 KiB
helpers/bootstrap-contracts.md7.8 KiB
helpers/bootstrap_azure.pyScript41.5 KiB
helpers/cleanup_plan.pyScript41.4 KiB
helpers/contracts.md7.8 KiB
helpers/cu_ingestion_auth.pyScript12.5 KiB
helpers/document-assessment.md7.8 KiB
helpers/document_assess.pyScript14.0 KiB
helpers/file-upload-recovery.md7.8 KiB
helpers/file_cu_canary.pyScript32.7 KiB
helpers/file_cu_mi.pyScript9.6 KiB
helpers/file_ingest.pyScript15.4 KiB
helpers/file_source.pyScript31.7 KiB
helpers/file_upload.pyScript53.7 KiB
helpers/hosted_connect.pyScript30.8 KiB
helpers/kb-contracts.md7.8 KiB
helpers/knowledge_base_retrieve.pyScript7.7 KiB
helpers/model-discovery-contracts.md7.8 KiB
helpers/model-discovery-scopes.md7.8 KiB
helpers/model_discovery.pyScript23.7 KiB
helpers/private-artifacts.md7.2 KiB
helpers/private_artifacts.pyScript4.8 KiB
helpers/prompt_cleanup.pyScript22.0 KiB
helpers/prompt_connect.pyScript62.3 KiB
helpers/requirements-assessment.txt103 B
helpers/retrieval-verification-contracts.md7.8 KiB
helpers/retrieval_verify.pyScript19.6 KiB
helpers/search-intake-contracts.md7.6 KiB
helpers/search_intake.pyScript18.4 KiB
helpers/search_reconcile.pyScript59.7 KiB
helpers/source_vector.pyScript33.2 KiB
helpers/throttle-recovery.md5.0 KiB
helpers/vector-contracts.md7.8 KiB
knowledge-bases/create.md8.1 KiB
knowledge-bases/retrieve.md7.8 KiB
knowledge-sources/create-azure-blob.md7.8 KiB
knowledge-sources/create-file.md7.8 KiB
lifecycle/cleanup.md7.8 KiB
references/abstention.md1.0 KiB
references/blob-binding-evidence.md7.8 KiB
references/blob-indexer-observation.md7.7 KiB
references/blob-ingestion-progress.md6.5 KiB
references/blob-readiness-recheck.md7.8 KiB
references/blob-vector-readiness.md2.6 KiB
references/bootstrap-azure.md7.8 KiB
references/content-fit.md7.8 KiB
references/cu-ingestion.md7.8 KiB
references/file-cu-canary.md7.8 KiB
references/intent-routing.md7.7 KiB
references/owner.md2.1 KiB
references/platform-contracts.md7.7 KiB
references/platform-interfaces.md7.8 KiB
references/resource-intake.md7.8 KiB
references/search-substrate.md7.8 KiB
references/standard-cu.md7.8 KiB
search-services/create.md7.8 KiB
troubleshooting/diagnose.md8.7 KiB

references/resource-intake.md

Select resources from names, URLs or observed choices

For unresolved names/URLs/choices, helpers still receive their documented, resolved JSON inputs. Execute only the applicable branch, not every discovery command on this page.

Search validation is not AI-host readiness. CU (AIServices) and model (OpenAI/AIServices) selections use their purpose-specific owners below.

Before expensive enumeration, reuse supplied resource/intent; otherwise ask one USE EXISTING / FIND CANDIDATES / CREATE NEW choice. USE asks only for a missing locator. Only FIND enumerates. CREATE checks its proposed name and necessary region/quota/cost, not existing-service inventory; approval remains separate. Carry intent and resolved IDs/modes through source/KB/CU/model handoffs.

Reuse prompt/session choices. Otherwise use az account show and assume its default subscription, stating that assumption; an explicit subscription wins. Pass --subscription <sub> on reads; never silently change CLI context. Account context and candidate listings are not access/readiness proof.

Exact supplied IDs need exact readback, not enumeration. Only FIND browses relevant types in the known group, else selected subscription. Read all pages within that query, never fan out across subscriptions or enumerate unrelated resource types. Offer choices, not a questionnaire about IDs.

Search reuse

Read Search intake; execute its native search_intake.py --select surface, not improvised filtering/glue. Exact ID/name+group skips enumeration. Name/endpoint without group gets only exact name/type resolution in the selected subscription; do not fetch arbitrary URLs. FIND uses known RG before selected-subscription fallback; bounded metadata/pages, five-row presentation and unassessed counts, no megabyte inventory dump. Explicit choice wins; retain cross-region candidates. Observed source-region proximity is latency/data movement preference, not Search/CU compatibility. Never infer location from names, absence/uniqueness from top five, or broaden denial. Use returned selection_input; users need not copy IDs.

Recheck selected operation, not new-resource hardening defaults. Keys-enabled Search may support Entra; never disable keys/change identity/firewall/ tags to satisfy a template. Actual File CU-MI/Blob/vector/KB-chat MI remains required. Private/UAMI-selected unsupported paths return capability/access blockers, not global compliance failures. Caller-to-Search and Search-to-dependency access are separate; metadata/read proof is not write permission or outbound readiness. No Search/Storage keys or billable readiness probes. The Search owner preserves exact approval boundaries.

Blob or ADLS container/folder URL

Accept https://example.blob.core.windows.net/documents as intake: account example, container documents. A URL does not identify its Azure subscription or resource group; the CLI default is only the initial lookup scope. Also accept separately supplied names/IDs; do not ask again for URL-derived fields.

Also accept https://example.dfs.core.windows.net/documents/onboarding: account example, filesystem/container documents, directory onboarding. Keep the observed endpoint type (Blob or DFS); do not infer HNS from the hostname.

Parse locally: HTTPS, exact <account>.blob.core.windows.net or <account>.dfs.core.windows.net host and an explicit container/filesystem path. Reject user-info, query/SAS, fragments, custom hosts/ports and malformed encoding without echoing the input; request a clean locator. Decode path segments once, preserve case, and reject ambiguous encoded separators, dot segments and control characters. Never use credentials from a pasted URL or fetch its content during intake. Do not guess a folder from an individual blob URL.

Resolve the account by exact name/type in the selected subscription:

az resource list --name <account> --resource-type Microsoft.Storage/storageAccounts --subscription <sub>.

Add --resource-group <group> when known. Read the returned exact ARM resource and verify its account name, corresponding Blob/DFS endpoint and HNS setting. DFS/ADLS intent requires verified HNS; resolve mismatches rather than silently converting to Blob. A Blob hostname on an HNS account still uses ADLS rules. Obtain the Storage ID/group from that readback; do not invent them from the URL. If inaccessible or absent from the selected scope, ask for the correct scope/ID; do not scan every subscription, provision Storage or request broader access automatically.

Keep the supplied container; no container enumeration is needed. If it is unknown, the Blob owner offers observed containers in the selected account using Entra login. Only FIND with an unknown account offers Storage-account choices with az storage account list --subscription <sub>, adding the known group filter. Choose a returned account before enumerating its containers.

A container locator does not silently select every object. Preserve an explicit folder choice, or resolve whole-container versus folder scope before inventory. Ambiguous folder/blob paths need clarification, never automatic slash-appending or parent-container expansion. Carry endpoint type and verified HNS to the owner: Blob non-root prefixes end in /; ADLS directories do not. Never append / merely to turn a file or arbitrary partial prefix into a folder. No object inventory/download occurs before the data boundary is selected.

Existing model choices

Keyword-only skips embedding discovery; other dependencies remain conditional. Carry the early service choice: supplied account/deployment uses exact reads; only FIND lists accounts/deployments. CREATE uses required catalog/quota checks, not an existing-account inventory. Never reopen resolved CU/model selections. Use typed discovery, not ad hoc CLI filtering/glue. Exact model IDs first; otherwise selected RG/subscription only. Choose account before its deployments. Reuse returned selection_input; show deployment versus model/version and account/region. CU uses purpose: cu; shared CU ingestion owns necessary checks and pending drafts, not generic configuration attestations. Retrieval effort alone never makes a route model-free. Minimal+extractive can skip chat; minimal+answerSynthesis requires chat-model discovery (purpose: chat). Keep extraction mode, source embeddings and CU independent. The KB/retrieve owner verifies API support; this intake does not establish availability or change validators.

For new deployments the native owner uses az cognitiveservices model list and az cognitiveservices usage list with --location <region> --subscription <sub> for model/version/SKU/quota before approval. Existing deployments need readback, not catalogs. Retain capacity/price/residency checks; execute only approved changes.

Return selections without restarting intake. Selection is not mutation approval. Preserve boundaries, complete inventories, fresh pre-write and ownership/access checks. After discovery, batch compatible unresolved Search, processing/search and model/CU choices with recommendations; reuse informed answers. Account selection precedes deployment listing, so do not batch a deployment guess. Keep exact sample-content consent and actual resource/permission/CU/source/KB approvals distinct; no approval of unknown future bodies. Source planners already own exact-name collision checks.

References

Authorities: failure/conflict/uncertainty only.

Filtered ARM resources. Blob resource URIs. ADLS filesystem/path.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

The author says: Azure

Security

What our scanner noticed· Medium risk

References to credential files
Instructions that use the network
Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/foundry-iq-skills/skills/foundry-iq · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/foundry-iq-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download foundry-iq.zip