How to use this page
Do not read it first. Work the five skill pages, then come back here in the last week and drill until you can finish each row of the lookup table before reading the answer column. If a row surprises you, that is your signal to re-read the section it links to.
Numbers worth memorising
700
Pass mark, scaled to 1000
30–35%
Skill 2 — the largest area
25–30%
Skill 1 — the second largest
1–30
Skills allowed in a skillset
| Number | What it is |
|---|---|
| 700 / 1000 | Score required to pass |
| 1 year | Certification validity; renewal is a free online assessment on Microsoft Learn |
| April 16, 2026 | The skills-measured revision these notes target |
| 25–30 / 30–35 / 10–15 / 10–15 / 10–15 | Weightings for Skills 1 to 5 |
| 1–10 | Images per image-generation request (n) |
| 1–30 | Skills allowed in an Azure AI Search skillset (3–5 typical) |
| 200 | Maximum Content Understanding classification categories |
| ~50% | Cost saving from Batch deployment types |
| 1–10 seconds | Window over which RPM is evaluated — which is why bursts throttle |
| 31 March 2027 | Retirement date for Agents (classic) |
| US / EU / APAC | The three Data Zones |
| 0 to 1 | Content Understanding confidence score range |
The rebrand traps
More marks are lost to naming than to concepts on this exam, because the platform renamed almost everything while most study material did not.
| If you read… | Think… | Trap |
|---|---|---|
| Azure AI Foundry / Azure AI Studio | Microsoft Foundry | Same thing; do not treat them as different products |
| Azure AI Services / Cognitive Services | Foundry Tools | Roles starting with Cognitive Services are still the wrong ones to assign for Foundry |
| Assistants API, threads, runs, assistants | Responses API, conversations, responses, agent versions | Classic agents retire 31 March 2027 — never the answer for a new build |
| Content filters / RAI policy | Guardrails and their controls | — |
| Azure AI User / Owner / Account Owner / Project Manager | Foundry User / Owner / Account Owner / Project Manager | Role IDs and permissions are unchanged; only the display names moved |
| Hub + Azure OpenAI + Azure AI Services | One Foundry resource with projects | A hub is still required for open-source models, managed compute and prompt flow |
azure-ai-inference, azure-ai-generative, azure-ai-ml | azure-ai-projects 2.x | 2.x and 1.x are incompatible |
| Azure AI Developer role | Not a Foundry role | Despite the name, it is scoped to AML workspaces and hubs |
Service pairs people confuse
| This… | …vs this | The deciding difference |
|---|---|---|
| Prompt agent | Hosted agent | Declarative config vs your own container. Hosted adds container compute cost and custom orchestration |
| Hosted agent | Ephemeral agent (Responses API direct) | Hosted is a Foundry resource with an endpoint; ephemeral has no agent resource — the definition lives in your code |
| File search | Azure AI Search tool | Foundry-managed vector store vs your index with filters, permissions, relevance tuning |
| Azure AI Search | Foundry IQ | The index vs the managed, multi-source, permission-aware knowledge layer on top of it |
| Handoff | Agent-as-tool | Ownership transfers permanently vs control returns to the caller |
| Function calling | MCP / OpenAPI tool | Executed client-side by your code vs invoked by the service. Only the latter can live in a toolbox |
| Content Understanding | Document Intelligence | Generative, schema-described, multimodal, markdown-out vs trained prebuilt/custom document models |
| Content Understanding | Multimodal model prompt | Confidence scores + source grounding + a fixed schema vs free-form reasoning |
| Standard mode | Pro mode | One file vs several documents reasoned about together, with an external knowledge base |
| Azure Language | Generative prompting | Deterministic, scored, cheap, containerisable vs flexible and bespoke |
| Sentiment analysis | Content Safety | How people feel vs whether content is harmful — never interchangeable |
| Custom speech | Custom neural voice | How it hears you vs how it sounds |
| Azure Translator | LLM translation | Volume, documents, glossaries, predictable cost vs context, tone and combined tasks |
| Voice Live | STT → model → TTS | Low latency and built-in barge-in vs component-level control |
| Embedding skill | Vectorizer | Indexing time (skillset) vs query time (index). Same model for both |
| Global Standard | Data Zone Standard | Processed anywhere vs only within US, EU or APAC |
| Standard | Provisioned | Pay per token, variable latency vs reserved PTUs, predictable latency |
| Sora | Content Understanding video | Creates video vs analyses it |
| Groundedness | Relevance | Supported by the sources vs actually answers the question |
Master decision trees
Where should the agent get its knowledge?
flowchart TD
A["The agent needs information<br/>it does not have"] --> B{"Where does it live?"}
B -- "A handful of files<br/>you upload" --> C["File search tool<br/>+ vector store"]
B -- "An enterprise index<br/>with filters and permissions" --> D["Azure AI Search tool"]
B -- "Several sources behind<br/>one reusable layer" --> E["Foundry IQ knowledge base"]
B -- "The public web" --> F{"Compliance boundary<br/>matters?"}
F -- "Yes" --> G["Do NOT use Bing grounding"]
F -- "No" --> H["Web search tool, or<br/>Grounding with Bing"]
B -- "SharePoint / Microsoft 365" --> I["SharePoint tool / Work IQ"]
B -- "Structured business data" --> J["Fabric IQ / Fabric data agent"]
B -- "A live system with an API" --> K["OpenAPI tool or<br/>MCP server"] How should documents be extracted?
flowchart TD
A["Extract from documents"] --> B{"One file, or several<br/>reasoned about together?"}
B -- "One file" --> C["Content Understanding<br/>STANDARD mode"]
B -- "Several, cross-validated" --> D["Content Understanding<br/>PRO mode (preview, documents only)"]
A --> E{"Is it a known form type<br/>with a prebuilt model?"}
E -- "Yes, stable high volume" --> F["Document Intelligence"]
E -- "Bespoke schema or<br/>mixed modalities" --> C The highest-yield caveats
Identity and permissions
- Azure Owner and Contributor grant no data-plane access. A subscription Owner still cannot build in a project.
- Developer least privilege = Foundry User. Something that only calls an agent = Foundry Agent Consumer.
- Publishing an agent needs Foundry Project Manager or above.
- Fine-tuning needs both planes: only Foundry Owner has both, or combine Foundry User + Foundry Account Owner.
- Creating a project in the portal auto-assigns Foundry User to you and the project identity — SDK and CLI do not.
- A connection existing is not authorisation: the managed identity needs a role on the target resource.
- Azure AI Search over a private network requires managed identity — keys are not supported.
Quota, limits and cost
- Quota is per subscription, per region, per model, per deployment type, in TPM.
- TPM is estimated from prompt +
max_tokenswhen the request arrives — not from billed tokens. An inflatedmax_tokenscauses needless 429s. - 429 = rate limit, capacity throttling, or a temporary protective reduction (check
x-ratelimit-limit-tokens). 403 = AI Gateway total token quota exhausted. - Dynamic quota can only raise the effective limit, never lower it.
- Global Standard gets new models first and the highest default quota; geography-based types arrive last.
- Global/Data Zone Standard deployments are affected by a primary-region outage — global routing is not disaster recovery.
Guardrails and responsible AI
- Severity is inverted from intuition: Low is the most restrictive, High is the most permissive.
- Models can annotate or annotate and block; agents can only annotate and block.
- An agent inherits its model deployment's guardrail unless one is assigned to it; an agent guardrail fully overrides the model's.
- Tool call and tool response intervention points exist for agents only, in preview.
- Spotlighting and groundedness controls are models only — not agents.
- Guardrails do not apply to audio transcription models.
- Turning filters off requires Limited Access approval for modified guardrails.
- Playground evaluations are on by default and billed.
Retrieval and search
- Filters and semantic ranking are text-only — they do not apply to vectors.
- RRF merges parallel ranked lists by inverse rank; hybrid scores are uniformly smaller than single-query scores.
- Semantic ranker = L2 rerank + captions and answers + optional query rewrite.
- Hybrid + semantic ranking is the benchmarked best configuration for grounding relevance.
- Azure OpenAI embeddings use cosine similarity.
vectorFilterModechooses pre- or post-filtering around the vector search.- Indexer stages: cracking → field mappings → skillset → output field mappings → index.
- Knowledge store is for non-search consumption; enrichment caching saves re-running expensive OCR.
Vision, text and speech
- Inpainting needs a same-size mask with an alpha channel; transparent pixels are what changes.
- No mask means the whole image is reinterpreted.
- Video generation is asynchronous — submit, poll, download.
- Content Understanding Extract is documents-only; Classify and Generate work across modalities.
- Video segmentation consumes tokens even when you define no fields, and video supports one
contentCategoriesobject. - Classification requires an
othercategory, or everything is forced into your list. Document classification is page-level. - Good alt text states purpose, is short, never begins "image of", and is empty for decorative images.
- Custom neural voice, personal voice and custom avatar are Limited Access; personal voice output is watermarked.
- Custom sentiment, custom text analytics for health and custom summarisation were retired in January 2025.
- Text embedded in an image is an indirect prompt injection (XPIA) vector.
Scenario → answer lookup
| The scenario says… | The answer is… |
|---|---|
| "A single boundary for RBAC and networking across all AI workloads" | One Foundry resource, multiple projects |
| "We need to deploy a Hugging Face model" | Managed compute — which needs a hub |
| "Prompts must stay inside the EU" | Data Zone deployment type |
| "Latency spikes under sustained load" | Provisioned throughput (PTUs) |
| "Classify 2 million documents overnight, cost matters" | Batch deployment type |
| "The Contributor cannot create an agent" | Assign Foundry User |
| "A service principal should only invoke the agent" | Foundry Agent Consumer |
| "The agent invents policies that do not exist" | Ground it, instruct it to refuse when unsupported, measure with groundedness |
| "The answer is true but off-topic" | Relevance evaluator |
| "The agent keeps choosing the wrong tool" | Better tool names, descriptions and schemas; tool search at scale |
| "Dozens of tools are blowing up the context window" | Tool search in a toolbox |
| "Update tools without redeploying every agent" | Toolbox versioning |
| "Refunds must be approved by a person" | Approval-required tool (+ checkpointing if the wait is long) |
| "Route the customer to a specialist who takes over the case" | Handoff orchestration |
| "Ask a specialist for one sub-answer and carry on" | Agent-as-tool |
| "Independent reviews of the same document, in parallel" | Concurrent orchestration |
| "A fixed, auditable sequence of stages" | Sequential orchestration |
| "Trigger the agent when an invoice arrives, and wait for a manager" | Azure Logic Apps + Foundry agent |
| "Answers must cite the source document" | Azure AI Search tool (inline citations) or file search |
| "Users must only see documents they are allowed to see" | Azure AI Search with security filters / Foundry IQ permission-aware knowledge |
| "Recall the user's preferences next month" | Semantic memory, not conversation state |
| "Conversation history across a session" | Conversation object (or previous_response_id) |
| "We must own the conversation store for compliance" | Bring your own Azure Cosmos DB |
| "Validate an invoice against a PO and a contract" | Content Understanding pro mode |
| "Extract 12 fields with a confidence score each" | Content Understanding with estimateFieldSourceAndConfidence |
| "Charts in the PDF are invisible to search" | enableFigureDescription / figure analysis |
| "One PDF contains several different documents" | Classification + segmentation (enableSegment) |
| "Redact personal data before storage, on-premises" | Azure Language PII container |
| "Tell me the aspect the complaint is about" | Opinion mining |
| "Detect abusive posts in a forum" | Content Safety, not sentiment analysis |
| "The assistant mis-hears our product names" | Custom speech |
| "It must sound like our brand voice" | Custom neural voice (Limited Access) |
| "Users must be able to interrupt the assistant" | Voice Live API |
| "Transcribe an archive of recordings" | Batch transcription |
| "Change only the sofa in the photo" | Mask-based inpainting |
| "Find the brand mentions in this footage" | Content Understanding video — not Sora |
| "Hidden text in an uploaded image told the agent to exfiltrate data" | Indirect attack detection, spotlighting (models), tool-call guardrails, least privilege |
| "Prove which agent version produced this answer" | Tracing + agent versioning |
| "Fail the build if answer quality regresses" | Evaluation as a CI gate |
| "Quality has slowly degraded in production" | Scheduled evaluation against a fixed dataset (drift detection) |
| "Probe for jailbreaks before release" | AI red teaming agent (PyRIT) |
| "Cut cost without losing quality" | Model routing — SLM first, escalate the hard cases |
| "Eligibility must be decided by policy, not the model" | Hybrid: rules engine decides, model explains |
Question formats and tactics
| Format | Tactic |
|---|---|
| Multiple choice / multiple response | Read the constraint sentence first ("must not leave the EU", "least privilege", "minimise cost"). It usually eliminates two options before you evaluate anything |
| Drag-and-drop ordering / build list | Anchor the first and last steps, then fill the middle. Remember canonical orders: indexer stages; the agent loop; the RAG ingestion flow |
| Hotspot / dropdown | Each dropdown is scored independently — never leave one blank |
| Yes/No statement sets | Judge each statement in isolation. Statements are often three variants of one idea with one boundary changed |
| Code snippets | Identify the client and API surface first (classic vs current), then look for the missing loop, the missing call_id, the wrong endpoint or a key where keyless is required |
| Case studies | Read the requirements section before the narrative, and treat non-functional requirements — residency, latency, cost, least privilege — as the real question |
| Repeated-scenario sets | Where several questions share a scenario with different proposed solutions, more than one can be correct. Judge each on its own |
Four habits that convert knowledge into marks
- Find the constraint. Almost every scenario carries one word that decides it: least privilege, residency, on-premises, lowest cost, minimal latency, no code, existing index.
- Prefer the managed, purpose-built service over hand-rolled alternatives — unless the scenario explicitly rules it out.
- Prefer keyless and least privilege in any security question. It is the recommended pattern and it is almost always the intended answer.
- Beware the deprecated option. Classic agents, threads and runs, and hub-only paths are frequently offered and frequently wrong for new work.
Preview versus GA
Most questions cover generally available features, but commonly used preview features do appear. A great deal of Foundry is still in preview, so it is worth knowing which side of the line things sit on. Treat this as a snapshot — verify before exam day, because items move to GA regularly.
| Preview at the time of writing | Generally available |
|---|---|
| Agent guardrails and the tool call / tool response intervention points · spotlighting · groundedness control · PII control · task adherence · workflows · tool search · skills · agent optimizer · network egress controls · Content Understanding pro mode and agentic mode · instant access models · dynamic quota · Azure Vision multimodal embeddings skill and vectorizer · enrichment caching · MAI voices · Azure Language MCP server | Foundry resource and projects · Foundry Agent Service with prompt and hosted agents · Responses API and conversations · toolboxes · model guardrails · evaluations and tracing · Azure AI Search vector, hybrid and semantic search · integrated vectorization · Content Understanding standard mode · Azure Language core capabilities · Speech STT/TTS, custom speech, speech translation · A2A protocol v1.0 |
Pre-exam checklist
Two weeks out
- Build one RAG agent end to end in a real project: deploy a model, create an index, attach the tool, ask a question, read the citation.
- Add one function tool to it and watch the call loop in the trace view.
- Run one evaluation with groundedness and relevance, and read the results in the portal.
- Open the guardrail configuration and look at every risk, intervention point and action.
- Create a deployment with the CLI so the SKU names stop being abstract.
Final week
- Drill the scenario lookup table until you answer before reading the second column.
- Re-read the rebrand table and the confused pairs — the cheapest marks on the exam.
- Re-read the Foundations RBAC and deployment-type tables.
- Skim the SDK deep dive and make sure you can spot classic vs current code in three seconds.
- Take the official practice assessment on the certification page and diagnose why each miss happened — wrong fact, wrong boundary, or misread constraint.
The night before
- Read the numbers and the five caveat callouts. Nothing new.
- Check the official study guide for a change notice — the outline is revised periodically, and these notes target April 16, 2026.
- Confirm your exam logistics: ID, check-in window, workspace rules for online proctoring.
- Sleep. Ten more facts are worth less than being able to read a case study carefully.
Final reminder
These notes are an independent study aid, not a practice exam and not a substitute for the official documentation. Foundry changes weekly and Microsoft renames features often. If any detail here conflicts with Microsoft Learn, Microsoft Learn is right — and a pull request fixing it here is very welcome.