Set up your environment

Creating your first agent with Azure AI Agent Service is a two-step process:

1. Set up your agent environment.
2. Create and configure your agent using either the SDK of your choice or the Azure Foundry Portal.

Use this article to learn more about setting up your agents.

Required permissions

Set up your agent environment

To get started, you need an account and a project.
Agents are scoped at the project level, which ensures data isolation—agents within the same project share access to the same resources.

Prerequisites

• An Azure subscription - Create one for free.
• Ensure that the individual creating the account and project has the Azure AI Account Owner role at the subscription scope
• If configuring Standard Setup, the same individual must also have permissions to assign roles to required resources (Cosmos DB, Search, Storage).
  • The built-in role needed is Role Based Access Administrator.
  • Alternatively, having the Owner role at the subscription level also satisfies this requirement.
  • The key permission needed is: Microsoft.Authorization/roleAssignments/write

Choose your setup

Azure AI Foundry Agent Service offers three environment configuration modes to suit different needs:

• Basic Setup:

  This setup is compatible with OpenAI Assistants and manages agent states using the platform's built-in storage. It includes the same tools and capabilities as the Assistants API, with added support for non-OpenAI models and tools such as Azure AI Search, and Bing.

• Standard Setup:

  Includes everything in the basic setup and fine-grained control over your data by allowing you to use your own Azure resources. All customer data—including files, threads, and vector stores—are stored in your own Azure resources, giving you full ownership and control.

• Standard Setup with Bring Your Own (BYO) Virtual Network:

  Includes everything in the Standard Setup, with the added ability to operate entirely within your own virtual network. This setup supports Bring Your Own Virtual Network (BYO virtual network), allowing for strict control over data movement and helping prevent data exfiltration by keeping traffic confined to your network environment.

Compare setup options

Deployment options

To customize these templates, see use your own resources.

If you want support for Private Network Isolation see network-secured setup for more information on how to bring your own virtual network.

Description and Autodeploy	Diagram (click to zoom in)
Deploy a basic agent setup that uses Managed Identity for authentication. An account and project are created. A GPT-4o model is deployed. A Microsoft-managed Key Vault is used by default.
Deploy a standard agent setup that uses Managed Identity for authentication. An account and project are created. A GPT-4o model is deployed. Azure resources for storing customer data - Azure Storage, Azure Cosmos DB, and Azure AI Search - are automatically created if existing resources are't provided. These resources are connected to your project to store files, threads, and vector data. A Microsoft-managed Key Vault is used by default.

[Optional] Model selection in autodeploy template

You can customize the model used by your agent by editing the model parameters in the autodeploy template. To deploy a different model, you need to update at least the modelName and modelVersion parameters.

By default, the deployment template is configured with the following values:

What's next?

• Create your first agent
• Explore more:
  • Use your existing resources
  • Network secured agent setup