Correct Answer: A,E  🗳️

Explanation: Only visible for iPassleader members. You can sign-up / login (it's free).

Correct Answer: C  🗳️

Explanation: Only visible for iPassleader members. You can sign-up / login (it's free).

Correct Answer:

Explanation:
Set tool_choice to: required
Configure the tool to authenticate by: Using a distinct agent identity bound to the client application Set tool_choice to required because the compliance workflow must deterministically include a tool-based retrieval step before the agent generates a response. Microsoft Foundry Agent Service guidance states that tool_choice provides the most deterministic control over tool use: auto lets the model decide, none prevents tool calls, and required forces the model to call one or more tools. This directly corrects the current nondeterministic behavior where the model decides whether to call tools.
For authentication, use a distinct agent identity bound to the client application . Microsoft Foundry creates a shared identity for unpublished or in-development agents, but publishing an agent automatically creates a dedicated agent identity blueprint and agent identity associated with the agent application resource. Published agents authenticate tool calls by using that unique agent identity, and RBAC permissions must be assigned to the new identity. This provides isolation from the broader shared project identity and supports independent audit trails for compliance workflows.
Storing API keys in prompts violates security guidance and prevents robust audit attribution. The shared project agent identity is easier for development, but it has a broader blast radius and does not meet the isolation requirement. Reference topics: Foundry Agent Service tool choice, tool authentication, published agent identities, RBAC, and auditability.

Correct Answer:

Explanation:
Authentication method: An Azure Login action that uses OpenID Connect (OIDC) If the evaluation results are NOT met, configure the workflow to: Fail The correct authentication method is Azure Login with OpenID Connect (OIDC) . Microsoft Foundry's GitHub Actions evaluation guidance recommends Microsoft Entra ID authentication and states that authentication can be automated by using the Azure Login GitHub action with OpenID Connect. The sample evaluation workflow also grants id-token: write, runs azure/login@v2, and then invokes the Microsoft AI Agent Evaluation action. This is the appropriate CI/CD authentication pattern because it avoids long-lived personal access tokens and supports secure federated authentication from GitHub Actions into Azure.
The workflow should be configured to fail when evaluation thresholds are not met. Foundry's evaluation GitHub Action is designed to automate pre-production assessment of Microsoft Foundry agents in CI/CD pipelines and produce evaluation results for the configured evaluators and test dataset. A failed GitHub Actions check can then be enforced through branch protection so the PR cannot merge until the quality gate passes. Locking the target branch or sending an alert does not directly implement a CI quality gate. Reference topics: Microsoft Foundry agent evaluation, GitHub Actions evaluation workflow, Microsoft Entra authentication, Azure Login with OIDC, pull-request quality gates, and CI/CD governance.