AI-103 Developing AI Apps and Agents on Azure Study Guide¶

Independent AI-assisted resource — HUMAN REVIEW PENDING. The October 28, 2026 detailed refresh maps all 64 objectives in the retained teaching baseline and checks current public product evidence. See the current refresh record and sources-and-objectives record. The official blueprint is authoritative. Product/tenant execution and human review remain separate; limitations and source conflicts are stated below.

Study guide at a glance

Start here

Report an issue with AI-103

Blueprint checked2026-10-28

Review stateSources + objectives checked — human review pending

Guide-only active reading1 hr 45 min–2 hr 45 min

Prerequisites: Experience developing applications in Python, plus familiarity with general AI, generative AI, and Azure services.

Exam essentialsRead the objective map, key distinctions, and readiness checklist.

Deep understandingWork through every domain, including decisions, failure modes, and related items.

Hands-on labsBegin with Lab 1: Secure Foundry application baseline, then use the remaining labs to produce evidence you can inspect and explain.

Official objective domains

Plan and manage an Azure AI solution25–30%
Implement generative AI and agentic solutions30–35%
Implement computer vision solutions10–15%
Implement text analysis solutions10–15%
Implement information extraction solutions10–15%

The active-reading range uses 90–130 words per minute for technical material. Labs, troubleshooting, note-taking, spaced review, and prerequisite gaps add time; it is not a total preparation promise.

Current baseline: Skills measured as of April 16, 2026
Upcoming blueprint change: None announced on the official study guide checked October 28, 2026.
Official source: AI-103 study guide

How to use this guide¶

Start with the service-selection and lifecycle models, then build the labs. For each objective, be able to explain the decision, implement a small Python solution, observe its behavior, and troubleshoot one failure. Use the official blueprint as a coverage checklist; use this guide to connect its individual bullets into complete systems.

The credential page explicitly expects Python experience. For a focused learning route, follow the fictional maintenance-assistant examples below, complete Lab 8, and attempt all sixteen knowledge checks before reading their answer checkpoints. The local retrieval-metric example needs only Python; cloud labs require your own authorized, cost-capped environment and current SDK versions.

About related items: A Related item: callout adds prerequisite, operational, architectural, or adjacent context that makes the current topic easier to understand. It is useful supporting knowledge, not a claim that the item appears verbatim in the published exam objectives.

Living-guide watch — September 27, 2026¶

The recurring Content Understanding release notes are now the preferred lifecycle companion to the static blueprint. They distinguish the 2025-11-01 GA API from the 2026-06-01-preview API and agentic workflow, including preview limitations and ongoing analyzer changes. These API dates are not Python package versions. This supports the detailed historical/current crosswalk later in the guide; it does not erase the blueprint's older single-task/pro-mode wording.

O'Reilly, Udemy, Pluralsight, LinkedIn Learning, LevelUp, and community video resources in Places to learn offer alternative implementations. Treat their SDK calls and portal steps as versioned examples, and validate them against the release notes before lab use.

Current Foundry documentation also distinguishes legacy Agent Applications from the newer agent-owned endpoint and identity model. Review the migration example in Part 2 before copying older publishing steps. The evaluation workflow in Part 5 connects current APIs to explicit failure criteria; it does not assume that a successful tool response means the task succeeded.

Objective map¶

Domain	Weight	Central question
Plan and manage an Azure AI solution	25–30%	Which service, model, deployment, security, and operating model fits?
Implement generative AI and agentic solutions	30–35%	How do generation, retrieval, tools, memory, orchestration, and evaluation work together?
Implement computer vision solutions	10–15%	How should visual generation, understanding, accessibility, and safety be implemented?
Implement text analysis solutions	10–15%	When should prompts, language tools, speech, or translation be used?
Implement information extraction solutions	10–15%	How does heterogeneous content become grounded, searchable structure?

The exam role is an Azure AI engineer who writes Python and collaborates across architecture, data science, DevOps, security, and business teams. Expect design and operational judgment in addition to API knowledge.

1. Build the platform mental model¶

An AI application is more than a model endpoint. Treat it as a pipeline with independently testable layers:

user or system
   ↓
application and identity boundary
   ↓
orchestration: prompt, workflow, or agent
   ├── model deployment
   ├── tools and APIs
   ├── retrieval and knowledge
   ├── memory or conversation state
   └── safety and approval controls
   ↓
evaluation, tracing, monitoring, and feedback

Microsoft Foundry provides a unified resource and project environment for models, agents, tools, evaluation, and observability. Azure services such as AI Search, Content Safety, Speech, Translator, and Content Understanding supply specialized capabilities. Your design should make each dependency and trust boundary explicit.

Distinguish current Foundry from Foundry (classic)¶

Unless a passage is explicitly labeled FOUNDRY (CLASSIC), this guide uses Microsoft Foundry to mean the current Foundry portal, Foundry resources and projects, and current SDK/API generation. Microsoft has used Azure AI Studio, Azure AI Foundry, and Microsoft Foundry for successive generations, so a product name by itself is not enough to identify the architecture. Use the resource, project, SDK, endpoint, and agent vocabulary instead.

Signal	Current Microsoft Foundry	FOUNDRY (CLASSIC)
Portal	New Foundry experience; current navigation includes Discover, Build, Operate, and Manage	Classic portal; older material commonly uses Management center and a single left navigation pane
Resource/project model	A Foundry resource with child Foundry projects	Azure OpenAI or Azure AI services connected to an Azure AI Hub and hub-based projects
Project SDK	`azure-ai-projects` 2.x and the current project endpoint	`azure-ai-projects` 1.x, `azure-ai-inference`, `azure-ai-generative`, or hub workflows through `azure-ai-ml`
Model client	Standard `OpenAI()` client and v1 routes where documented	`AzureOpenAI()` or `azure-ai-inference` examples with dated `api-version` routes
Agent API	Responses API; conversations, items, responses, and agent versions	Assistants API; threads, messages, runs, and assistants/older agents
Portal test	Instructions explicitly say the New Foundry toggle is on	Instructions say the toggle is off or the page says it applies only to Foundry (classic)

The official classic-to-current migration guide is the terminology crosswalk. FOUNDRY (CLASSIC) material can still be relevant when maintaining hub-based projects, but do not mix its SDK versions, endpoints, portal steps, or agent objects into a current Foundry implementation. An old /azure/ai-foundry/ link slug is not conclusive by itself because some old URLs redirect to current pages; check the page's applicability banner and canonical destination.

Choose a capability before choosing a product¶

Need	Likely capability	Selection questions
Generate or transform language/code	Generative model	Quality, latency, context, safety, cost, region, modality
Run a constrained local or high-volume task	Small language model	Is task-specific quality sufficient? Can lower latency/cost outweigh generality?
Interpret images, video, or audio with text	Multimodal model or specialized tool	Is open-ended reasoning or deterministic extraction needed?
Ground an answer in changing enterprise content	Retrieval plus generation	How are documents chunked, secured, updated, ranked, and cited?
Perform actions	Agent with tools/functions	What identity, input validation, approval, retry, and audit controls apply?
Extract repeatable document fields	Content Understanding or another extraction service	Are layout, OCR, tables, confidence, and custom schema important?
Search a knowledge corpus	Azure AI Search	Are lexical, semantic, vector, filtering, enrichment, or hybrid retrieval required?

The best design can combine specialized tools with models. Do not send every problem to the largest model. A rules engine can enforce deterministic policy, Search can retrieve evidence, Content Understanding can normalize a document, and an LLM can synthesize the final response.

Related item: A model router applies the same architectural principle as any policy-based router: classify the request, select an eligible backend, capture the decision, and provide a fallback. It can optimize cost and latency, but it also creates a new component to evaluate and monitor.

Choose a model with evidence¶

Build an evaluation set representing normal, difficult, unsafe, and adversarial cases. Compare candidate models using:

task quality and groundedness;
safety and refusal behavior;
modality and context-window needs;
throughput, latency, quotas, and regional availability;
token and infrastructure cost;
operational features and deployment constraints.

Use the Foundry Models overview to filter by task and modality, but benchmark the deployed configuration, not an abstract model name. Prompts, retrieval, tools, safety settings, and model version all affect the outcome. Foundry’s model benchmarks can inform a shortlist across quality, safety, performance, and cost; they do not replace evaluation on the application’s own cases.

VERIFY CURRENT: Model names, versions, regions, quotas, retirement dates, pricing, and deployment types change frequently. Check the model catalog and service documentation when studying and before implementation.

2. Set up, deploy, secure, and operate Foundry solutions¶

Design the Azure infrastructure¶

Separate concerns even if a small lab uses one resource group:

Concern	Design decisions
Resource organization	Subscription, resource groups, naming, tags, ownership, policy
Environments	Development, test, staging, production, promotion boundary
Identity	User/developer roles, workload managed identities, service principals, least privilege
Network	Public access, private endpoints, managed virtual network, DNS, egress dependencies
Secrets	Keyless access where supported, vault use where secrets remain, rotation
Data	Storage/search region, encryption, retention, data classification, residency
Reliability	Regional dependencies, retry and timeout policy, capacity, degradation plan
Observability	Traces, application metrics, evaluation results, safety events, cost data

Prefer managed identity and role-based access over embedded API keys. A managed identity removes credential distribution, but it does not automatically grant the right access; assign the minimum data-plane and control-plane roles required. Test access using the workload identity, not only an administrator account.

The current Foundry RBAC guide distinguishes project builders, project managers, account owners, and agent consumers and warns that key authentication does not provide the same role granularity. Role names are actively transitioning, so understand scope and permission intent and VERIFY CURRENT labels in the portal.

Network troubleshooting order¶

When a private solution fails, check:

the caller's identity and token audience;
role assignments at the effective scope;
endpoint and public-network configuration;
private endpoint approval and DNS resolution;
managed-network outbound rules and dependent services;
application timeout, retry, and SDK configuration.

Do not diagnose an authorization failure as a network failure merely because both can surface as a failed request.

Related item: Zero Trust is useful here as an operating model: verify explicitly, grant least privilege, and assume breach. Private networking reduces exposure; it does not replace workload authentication, authorization, validation, logging, or data governance.

Worked identity example: the same definition can have different permissions¶

Our fictional maintenance assistant reads approved manuals, describes an equipment photo, transcribes a technician's request, and proposes a work order. A person approves any write. Record identities at each boundary:

Boundary	What to verify	A useful negative test
Developer or CI process → Foundry project	Actual credential principal and project-scoped role	A reader cannot change an agent definition
Client application → agent endpoint	Invocation authorization and selected endpoint/version	An unauthorized caller is rejected
Agent/tool → Search or work-order API	Credential actually used by that tool and downstream scope	A different site's records cannot be read or changed
Retrieved evidence → requesting technician	Application-enforced document authorization	A broad service identity does not expose all its documents to every user

The migration guide says newly created agents have their own identity and stable endpoint; older Agent Applications remain supported during the transition. Copying an old agent definition into a new agent does not transfer downstream role assignments. Reauthorize the new identity and verify caller access at the documented scope. Do not assume an end-of-support date that Microsoft has not supplied.

Failure drill: the developer can query Search locally, but the deployed agent receives an authorization failure. Identify the runtime principal, resource, action, and scope before changing permissions. A successful local request proves only the developer's path. Follow agent identity concepts and the selected tool's authentication contract; not every tool necessarily uses the same identity. After repair, repeat both allowed and denied cases.

Treat deployments as versioned configuration¶

A deployment binds an application-facing name to a model/version and capacity configuration. Keep application code insulated from unnecessary provider details, and record the exact evaluated version. Promotion should include:

infrastructure-as-code validation;
application and prompt changes under version control;
repeatable deployment configuration;
offline evaluation and security tests;
a small live or shadow test where appropriate;
an approval and rollback decision;
post-deployment monitoring.

Prompts, tool schemas, search index definitions, evaluation datasets, safety thresholds, and agent instructions are release artifacts. A code-only pipeline misses much of the system.

The current model deployment guide makes model availability and quota explicit deployment prerequisites. A deployment type determines hosting, billing, data-processing location, capacity behavior, and supported models; VERIFY CURRENT those choices rather than memorizing a SKU list.

Related item: Evaluation gates are the AI equivalent of regression tests, but statistical behavior requires thresholds and distributions rather than one exact expected string. Preserve representative datasets and inspect failures instead of optimizing only a composite score.

Manage quota, scale, rate limits, and cost¶

Distinguish these signals:

Signal	Meaning	Common response
Rate-limit response	Request or token rate exceeded	Backoff with jitter, reduce concurrency, request capacity, route eligible traffic
High latency without throttling	Slow model/tool/retrieval path	Break down trace spans; optimize the slow stage
Token growth	Larger prompts, retrieval, history, or output	Trim context, improve retrieval, summarize state, set output limits
Search indexing lag	New content not yet retrievable	Inspect data source/indexer status and freshness objective
Agent loop growth	Tool errors or weak termination conditions	Add budgets, state checks, bounded retries, and escalation

Track cost per successful business outcome, not only total tokens. A cheaper call that causes more retries or poor decisions may raise total cost.

Foundry quota management separates subscription/region/model quota allocation from a deployment’s observed rate limit. Treat 429 as a symptom: inspect response guidance, request/token bursts, assigned quota, backend capacity, and retry safety before simply increasing retries.

Observe the entire system¶

A useful trace correlates the request across application, retrieval, model, tool, and response stages. Capture inputs safely, selected model/deployment, retrieved document identifiers, latency breakdown, token use, tool decisions, safety results, and outcome feedback. Apply privacy, retention, access, and redaction controls to telemetry.

Foundry’s agent tracing overview uses OpenTelemetry-style spans across model calls, tools, state, and multi-agent collaboration and explicitly warns that traces can contain sensitive inputs, outputs, and tool data. VERIFY CURRENT: preview status and support vary by agent type and integration.

Monitor four different things:

service health: errors, throttling, latency, capacity;
data and retrieval health: ingestion freshness, indexing errors, coverage, relevance;
model/application quality: groundedness, task success, fabrications, drift;
safety and governance: harmful content, prompt attacks, prohibited tool use, approval and audit evidence.

Related item: Observability and privacy can conflict. More captured context makes debugging easier but increases sensitive-data exposure. Decide what to log, hash, redact, sample, restrict, and retain before production.

3. Responsible AI is a lifecycle control¶

Responsible AI is not one content filter after generation. Apply controls at design, input, retrieval, tool execution, output, deployment, and monitoring stages.

Threat and control map¶

Risk	Example	Controls
Harmful input/output	Hate, violence, sexual, self-harm content	Classification, thresholds, block/transform/escalate policy
Direct prompt attack	User asks agent to ignore policy	Prompt Shields, instruction hierarchy, scope constraints, monitoring
Indirect prompt injection	Retrieved page or image contains malicious instructions	Treat content as data, isolate instructions, restrict tools, validate outputs
Fabrication	Unsupported answer appears confident	Grounding, citations, groundedness evaluation, abstention, human review
Excessive agency	Agent performs irreversible action	Least-privilege tools, preview, limits, approval, idempotency, audit
Sensitive-data leakage	Model or trace returns restricted data	Access-aware retrieval, minimization, DLP, redaction, output checks
Bias or quality disparity	Performance differs by group or scenario	Representative evaluation, slice analysis, review, mitigation

Configure Content Safety and guardrails according to the use case and organizational policy. Understand false positives and false negatives. Record exceptions with an owner, rationale, scope, expiry, and compensating control.

Azure AI Content Safety covers supported text/image harm detection and prompt-protection capabilities, while current Foundry guardrails compose controls around a deployment or application. Neither source claims one control covers authorization, grounding, or every policy risk; keep the layered threat map above.

Human oversight modes¶

Use escalating autonomy:

Suggest: agent drafts; human performs the action.
Confirm: agent prepares an action; human approves the exact parameters.
Act within bounds: agent acts only within defined low-risk limits.
Escalate: uncertainty, risk, policy match, or repeated failure sends work to a person.

The action's reversibility, financial or safety impact, data sensitivity, confidence, and legal obligation determine the oversight mode—not the model's fluency.

Related item: Model risk management treats each deployed configuration as a governed system with an owner, intended use, validation evidence, limitations, change control, monitoring, and retirement plan. This complements, rather than replaces, technical safety filters.

4. Build generative applications and retrieval-augmented generation¶

Control generation deliberately¶

Prompts should state the role, task, trusted context, output contract, constraints, and failure behavior. Prefer structured output with schema validation when software consumes the response.

Common parameters affect behavior but do not guarantee truth:

temperature/top-p: alter sampling diversity; change one strategy deliberately rather than randomly tuning both;
maximum output tokens: bounds response length and cost but can truncate a result;
stop conditions: end generation at known delimiters where supported;
tool choice: can constrain, require, or allow a model to select tools.

Validate structured output, enforce application constraints, and retry only failures likely to be transient. Repeating the same unsafe or structurally invalid request without changing anything is not a recovery strategy.

Understand the RAG pipeline¶

source → parse/OCR → normalize → chunk → enrich → embed/index
                                              ↓
question → query rewrite → retrieve/filter → rank → prompt → answer/citations
                                              ↓
                                      evaluate and improve

Each stage has a distinct failure mode:

Symptom	Likely layer to inspect
New document never appears	Data source, indexer, parsing, indexing status
Correct document ranks low	Query, fields, filters, vectorization, hybrid search, semantic ranker
Good chunk retrieved but answer wrong	Prompt, context ordering, model behavior, output constraints
User sees unauthorized evidence	Retrieval security filter and identity propagation
Citations do not support answer	Chunk metadata, citation mapping, groundedness logic

Lexical search matches terms and is strong for exact identifiers. Vector search retrieves semantic similarity. Hybrid search combines text and vector queries. Semantic ranking reranks an initial result set for relevance. They are complementary, not interchangeable synonyms.

The current Azure AI Search references explain vector search, hybrid search, and semantic ranking. Hybrid retrieval executes text and vector paths and fuses their result lists; semantic ranking reranks eligible initial results. VERIFY CURRENT: tiers, limits, supported vectorizers, ranking options, and preview features.

Chunking should preserve meaning and useful metadata. Oversized chunks dilute retrieval and consume context; undersized chunks lose relationships. Test chunk size, overlap, document structure, metadata filtering, and top-k choices against real questions.

Related item: Permission-aware RAG requires document authorization at retrieval time. Hiding an unauthorized citation in the final UI does not undo disclosure if the document already entered the model context.

Evaluate the application, not only the model¶

Use an evaluation dataset with question, expected traits or evidence, scenario tags, and unacceptable outcomes. Measure retrieval relevance, groundedness, task completion, response quality, safety, latency, and cost. Review disagreement and failure slices manually.

Avoid leaking a fixed evaluation set into prompt tuning until the system overfits it. Maintain held-out or newly sampled cases and monitor live feedback with privacy controls.

Worked retrieval example: separate finding evidence from using it¶

For a synthetic maintenance question, a human labels D1 and D2 as relevant, authorized documents. Search returns D1, D3, and D4; the last two are irrelevant. With unique document IDs, precision is 1/3 and recall is 1/2. A polished answer citing only D1 can still omit information available only in D2. Conversely, retrieving both useful documents does not ensure the model uses them correctly.

This small local exercise computes set-based precision and recall. It is a teaching calculation, not an Azure SDK call, a ranking metric, or a substitute for claim-level groundedness evaluation:

def retrieval_scores(relevant_ids, retrieved_ids):
    relevant, retrieved = set(relevant_ids), set(retrieved_ids)
    hits = len(relevant & retrieved)
    precision = hits / len(retrieved) if retrieved else 0.0
    recall = hits / len(relevant) if relevant else None
    return precision, recall


assert retrieval_scores(["D1", "D2"], ["D1", "D3", "D4"]) == (1 / 3, 0.5)
assert retrieval_scores(["D1", "D2"], ["D1", "D2"]) == (1.0, 1.0)
assert retrieval_scores(["D1"], []) == (0.0, 0.0)
assert retrieval_scores([], []) == (0.0, None)
assert retrieval_scores(["D1"], ["D1", "D1"]) == (1.0, 1.0)

The empty-result precision convention is explicitly zero here. Recall is undefined when no documents are labeled relevant; keep those questions in a separate abstention evaluation slice. Deduplication prevents repeated IDs from inflating this metric, but can hide wasted retrieval slots, so inspect ranking and duplicates separately.

Change one retrieval setting at a time on a fixed evaluation set: chunk boundaries, lexical/vector/hybrid retrieval, filters, then ranking. Record which IDs entered the prompt, which claims were supported, and whether the answer completed the task. Fix missing or incorrectly authorized evidence before trying a more capable generator. A citation's presence or valid ID establishes provenance linkage, not that the cited passage supports the claim.

Chang Liu's RAG debugging article is useful for this separation of retrieval and response evaluation. Its November 2025 clients and evaluation code are versioned examples; use current Foundry documentation for implementation and test any claimed advantage of agentic retrieval on your own workload.

5. Build and operate agents¶

An agent adds state, tools, and decisions around a model. Define:

role and bounded goal;
trusted instructions and prohibited behavior;
conversation-state and memory policy;
available tools and JSON schemas;
authentication and authorization per tool;
budgets for time, turns, tokens, and tool calls;
approval and escalation conditions;
termination and failure behavior;
telemetry and evaluation criteria.

The current Foundry Agent Service overview distinguishes prompt agents, hosted agents, and application-owned use of the Responses API. Choose by how much runtime/orchestration code the team must control, then verify identity, tool, state, deployment, and observability support for that agent type. FOUNDRY (CLASSIC): courses or samples centered on the Assistants API, threads, messages, runs, or older persistent-agent objects describe the previous agent generation.

VERIFY CURRENT — shared tool releases: A Foundry Toolbox exposes curated tools through an MCP endpoint. Promoting its default version can change consuming agents' tool sets without an agent redeployment. Record toolbox identity/version, effective default, tool definitions, consumer identities and regression/rollback evidence; endpoint equality is not candidate equality. Not every direct tool is supported through Toolbox: client-side function calling has a different execution path. A newly advertised write tool still requires downstream authorization.

Safety detection versus enforcement: Prompt Shields can return an attack detection that the application must act on. In Foundry, configured filtering can block; a detection annotation is not the same as a filtered response. Treat direct user attacks, retrieved-document attacks and tool-result scanning as distinct supported paths with their own defaults/preview state. In a synthetic detected=true, filtered=false case, explain the application's block/quarantine route and independently reject an unapproved wrong-asset write. Do not claim this fixture was returned by a real detector.

Design tools as security-sensitive APIs¶

Use precise names, descriptions, types, allowed values, and validation. The application—not the language model—must enforce authorization and business rules. Avoid a general-purpose tool when several narrower operations express policy more safely.

For a side-effecting call:

validate and normalize arguments;
authenticate as the correct workload or user;
authorize the requested resource and action;
show a preview or request approval when required;
use an idempotency key where possible;
execute with timeout and bounded retry;
return a structured success or error result;
record an audit-safe trace.

Separate conversation state, memory, and knowledge¶

Mechanism	Purpose	Risk
Current conversation	Immediate multi-turn continuity	Context growth and sensitive content
Summarized state	Compact durable facts for the active task	Summary errors become future assumptions
User memory	Reusable preference or fact across sessions	Consent, accuracy, deletion, access scope
Knowledge retrieval	External evidence selected for a request	Freshness, authorization, injection

Do not treat every conversation detail as durable memory. Define what is stored, why, for how long, how users correct it, and which agents can access it.

Multi-agent orchestration¶

Use multiple agents when bounded specialization, independent security boundaries, or parallel work creates clear value. Define the orchestrator's routing, handoff contract, shared state, timeout, retry, and conflict resolution. More agents create more latency, cost, nondeterminism, and failure paths.

Common patterns include supervisor-and-workers, sequential handoff, and event-driven collaboration. Evaluate the full workflow and each component. A final correct answer can conceal repeated waste; a component score alone can miss a broken handoff.

Related item: Distributed-systems practices apply to agents: correlation IDs, deadlines, idempotency, circuit breakers, compensation, bounded retries, and explicit state transitions are often more valuable than another prompt paragraph.

Diagnose an agent failure by phase¶

Phase	Questions
Perception/context	Did it receive the right user input, state, and authorized knowledge?
Planning/routing	Did it select the correct tool, agent, or workflow?
Invocation	Were arguments valid and identity/permissions correct?
Execution	Did the external system succeed, time out, or partially act?
Interpretation	Did the agent correctly use the tool result?
Termination	Did it stop, escalate, or loop?

Worked tool and evaluation example: a success response can hide a wrong action¶

The technician asks to draft a work order for asset P-104. An extracted document contains P-140, and the agent incorrectly chooses that identifier. The work-order tool returns HTTP 200. The transport succeeded, but the wrong asset was selected; if a work order was submitted without approval, the action boundary also failed.

Use the agent evaluator definitions to choose checks that distinguish these failures:

Question	Evaluation evidence
Was this tool needed for the request?	ToolSelection and a human-reviewed expected workflow
Did arguments reflect the user's asset, operation, and constraints?	ToolInputAccuracy plus deterministic ID/schema checks
Did the tool execute without technical error?	ToolCallSuccess and the recorded tool result
Was the permitted business outcome achieved?	TaskCompletion, TaskAdherence, and independent application invariants
Did the final answer use the returned information faithfully?	ToolOutputUtilization and claim/evidence review

Evaluator names, applicability, and preview status are volatile; TaskCompletion and TaskAdherence are documented as preview at this review. A probabilistic evaluator cannot authorize a write. The API must validate the caller, asset access, allowed operation, and approval bound to the exact proposed action. Keep the draft and approved submission as separate states.

Timeout drill: submission times out after approval. Mark its outcome unknown, look up the existing operation using the same idempotency key, and reconcile before retrying. A new key can create a duplicate. The service's idempotency contract, retention window, and status lookup must actually support this design; the model cannot create those guarantees through prompting.

For a current Foundry implementation, follow evaluate agents: create the evaluation and dataset, select the supported agent target, launch a run, and inspect per-item results. Pin the agent version for comparisons; omitting it can evaluate the latest version. Supply the instructions, tool calls, and tool outputs required by trajectory evaluators, rather than only the final answer. Bound polling with a deadline and record errored, missing, or timed-out cases separately from passes. Save the dataset version, evaluator configuration, run ID, tested agent version, and release decision.

6. Implement computer vision and multimodal workflows¶

Generation and editing¶

Image and video workflows need a prompt/reference input, selected generation controls, output storage, content policy, provenance, and human review appropriate to the use case. Inpainting changes a masked region while preserving the rest; prompt-driven edits may transform broader properties. Video adds temporal consistency and far greater processing/storage cost.

Use the current product guidance for image generation and editing and video generation, because eligible models, inputs, editing operations, regional availability, preview status, and safety restrictions change quickly.

Use reference media only when its rights and consent allow the intended transformation. Validate format, dimensions, size, duration, and output constraints. Preserve original and generated asset identifiers when audit or rollback matters.

Version-bounded Sora 2 edit/remix workflow¶

Preview boundary (checked September 5, 2026): Microsoft's current Sora 2 video guidance documents text-to-video, image-to-video, and generated-video-to-video remix through the Azure OpenAI v1 API. The model, regions, SDK surface, input/output limits, retention, concurrency, content rules, and preview status can change; verify them before implementation.

Treat a remix as an asynchronous, auditable job:

Use a supported Azure OpenAI resource and Sora 2 deployment. Authenticate with Microsoft Entra ID where supported, authorize the caller narrowly, and keep prompts and media free of secrets.
Start from the ID of a successfully completed generated video. Call client.videos.remix(video_id=source_id, prompt=edit_prompt) with one narrow change so the expected preservation and edit are testable. A source video file is not interchangeable with a completed generation ID.
Persist the source ID, returned remix ID, deployment/model, prompt, policy result, requested output settings, owner, and creation time. The returned job can begin in queued state.
Poll client.videos.retrieve(remix_id) with bounded backoff and an overall deadline while status is queued or in_progress. On failed or cancelled, capture the structured error and correlation data; do not blindly retry moderation, invalid-input, quota, or unsupported-region failures.
On completed, download through client.videos.download_content(remix_id, variant="video") before the documented job retention expires. Store it in an access-controlled location rather than trusting a transient URL or local notebook file.
Compare source and remix for the requested change, unwanted scene/layout/motion changes, temporal artifacts, audio, accessibility, policy, rights, and brand constraints. Keep the source immutable so rejection means discarding the remix, not reconstructing the original.

Input and output moderation do not replace application policy or human review. Separate policy rejection from capacity/rate limit, expired job, invalid media, authentication/authorization, regional/model availability, timeout, download, and quality failures; each requires different retry or escalation behavior.

Visual understanding¶

Multimodal models can caption, compare, answer questions, and reason over visual evidence. Content Understanding can produce structured or Markdown representations from multimodal inputs. Choose based on output contract:

open-ended explanation or question answering → multimodal generation;
repeatable fields, regions, layout, or downstream schema → extraction/analyzer pipeline;
searchable corpus → normalized representation plus Search indexing.

Microsoft’s vision-enabled model guide shows open-ended image understanding, while Content Understanding is the structured extraction and representation surface across document, image, audio, and video inputs. Test evidence fidelity rather than treating either output as ground truth.

An accessible alt-text workflow should describe information needed for the page's purpose, not inventory every pixel. Decorative images may need empty alternative text; complex diagrams may need a concise label plus a longer description. Include human review for consequential content.

Related item: Accessibility is a product requirement, not simply a captioning feature. Context determines useful alternative text, and generated descriptions still require testing with the interface and assistive-technology workflow.

Multimodal safety¶

Inspect both the media and embedded text. An image can contain harmful content, private information, disallowed branding, or text that attempts indirect prompt injection. Keep untrusted visual content subordinate to system instructions and restrict any tools reachable from the analysis flow.

Enforce visual policy as a release workflow¶

The blueprint names watermarking, prohibited symbols, brand rules and inappropriate content. Turn each rule into an observable release decision; a generic safety score does not implement an organization's brand policy.

Rule	Evidence and control	Hold the output when
Disclose generated or altered media	Preserve supported provenance and apply the organization's approved visible mark in its authorized publishing workflow; inspect the exported artifact	Required marking is absent, removed or unverifiable
Flag a prohibited symbol	Use a validated detector or qualified reviewer with known false-positive/negative cases	The detection is positive or uncertain under the policy's threshold
Use an approved brand asset	Compare the asset/version, permitted treatment and destination with the brand owner's rules	The asset is unapproved, distorted or used outside the allowed context
Block inappropriate content	Apply supported content classification, application thresholds and human escalation	A blocking category matches or required review is incomplete

Foundry provenance and disclosure guidance distinguishes provenance metadata and watermark mechanisms with their limits. Do not equate C2PA metadata with a visible business watermark or assume every API automatically supplies one. The table is an application design, not a claim that one Azure filter implements all four controls. Retain input/output hashes, policy/version, rule result, reviewer and release decision. VERIFY CURRENT: model/feature support and the organization's actual policy. No image generation, classifier or watermark operation was executed here.

Worked visual example: observable evidence and useful alt text¶

The maintenance photo shows a pump beside a small pool of liquid; its serial-number plate is blurry. A grounded description can report those visible features and state that the serial number cannot be read. It should not invent the serial number, diagnose the liquid, or conclude that the pump is unsafe from the photograph alone.

For a maintenance report, concise alt text might be “Pump beside pooled liquid; identification plate unreadable.” For a detailed inspection view, supply an expanded description and request another image for identification. Evaluate usefulness for the page's purpose, visible-evidence support, and accessibility separately from fluency. A generated replacement image is an illustration and must not become inspection evidence.

7. Implement text, speech, and translation solutions¶

Use generative prompting for flexible extraction, summarization, classification, and structured JSON when the task benefits from contextual reasoning. Use specialized language tools when their capability, predictability, latency, or supported domain is a better fit.

Text analysis controls¶

Define the output schema and allowed labels.
Include edge cases, negation, multiple languages, and long inputs in evaluation.
Separate sentiment from intent, tone, safety, and business risk.
Preserve source spans or citations when reviewers need evidence.
Treat confidence as one signal, not proof.
Protect sensitive text in prompts, logs, and evaluation datasets.

For translation, decide whether fidelity, terminology control, conversational fluency, document layout, or streaming speed matters most. Evaluate names, numbers, negation, domain terms, and low-resource languages—not only natural-sounding prose.

Azure Translator provides purpose-built text/document translation capabilities, while LLM-powered translation can support more contextual flows. VERIFY CURRENT: API versions, supported languages, adaptive/custom features, quotas, data residency, and model eligibility.

Structured output: syntax, schema and business meaning¶

Azure OpenAI structured outputs constrain supported direct-inference output to a JSON Schema subset. Chat Completions uses response_format; Responses uses text.format. Set required fields and additionalProperties: false, and check the exact model/API support. This reference explicitly excludes Foundry Agents Service and audio models from its supported combinations; do not assume the same capability on every agent or audio path.

For a synthetic maintenance draft, request an object containing asset_id, action and evidence. Limit the action to draft or ask. Parse JSON, validate the supported schema, and then validate source facts and application rules independently. Refusal, truncation, missing evidence and unavailable output are failure states to handle, not permission to fill missing values.

The following original local check illustrates a narrow application boundary after parsing. It does not replace a complete JSON Schema validator or authorize a tool:

import re

def validate_maintenance_draft(record):
    expected = {"asset_id", "action", "evidence"}
    if type(record) is not dict or set(record) != expected:
        raise ValueError("Unexpected output shape")
    if type(record["asset_id"]) is not str or not re.fullmatch(r"P-\d{3}", record["asset_id"]):
        raise ValueError("Invalid asset identifier")
    if type(record["action"]) is not str or record["action"] not in {"draft", "ask"}:
        raise ValueError("Only draft or ask is permitted")
    evidence = record["evidence"]
    if type(evidence) is not str or not evidence.strip() or len(evidence) > 512:
        raise ValueError("Missing or excessive evidence")
    return record

A well-formed P-104 can still be the wrong asset. Compare it with the user's request and permitted source record; verify authorization and approval before any later submission. Schema conformance cannot turn draft into permission to execute a write. Local synthetic checks are recorded in the refresh evidence; no inference or service call is implied.

Speech pipeline¶

audio → speech recognition → language/agent processing → text-to-speech

Streaming voice agents also need turn detection, interruption handling, latency budgets, noise testing, transcript protection, and clear disclosure. Custom speech can improve domain recognition but introduces dataset, evaluation, deployment, and lifecycle responsibilities.

Use the Azure Speech documentation for current speech-to-text, text-to-speech, translation, custom-model, language, SDK, and real-time support; the exam expects solution choice and implementation judgment, not memorization of every voice or locale.

Choose custom recognition and audio-native reasoning deliberately¶

For custom speech, first compare the base recognizer with human reference transcripts on a held-out, representative corpus. Inspect vocabulary and acoustic errors; decide whether text adaptation or audio with reference transcriptions fits the failure. Keep training and test sets separate, train only with authorized data, compare word error rate and business-critical terms, and choose deployment/lifecycle monitoring from the real-time or batch path. Real-time use needs a supported endpoint; batch has a different endpoint requirement. VERIFY CURRENT: language, region, data, cost and model lifecycle. Do not confuse adapting recognition with creating a custom synthetic voice.

An audio-enabled model can receive supported audio directly; a speech-to-text → text-model pipeline receives only the transcript and selected metadata. Choose the former when the task needs information retained in the audio modality, and the latter when inspectable words/terminology and explicit component control fit. Neither path establishes accurate emotion, identity, consent or action authority. Test identical wording with different timing/noise or speaker overlap, missing audio, negation and critical numbers. Measure recognition, interpretation, supported audio grounding and end-to-end latency separately. Do not copy structured-output support from a text-only path into an audio model.

Related item: Voice interfaces add a real-time state machine. Barge-in, silence, partial transcripts, retries, and channel failure need explicit behavior even when the language model is working correctly.

Worked speech example: preserve intent across modalities¶

A technician says, “Do not close work order 104; record pressure as fifteen kilopascals.” Sentiment classification cannot determine whether closing the order is authorized. The application needs the finalized transcript, negation, identifier, unit, and permitted action. A partial transcript such as “close work order 104” must not trigger a write while recognition is still in progress.

Evaluate recognition errors separately from intent extraction and translation. Use a fixture containing the expected ID 104, value 15, unit kPa, and instruction not to close. If a translation changes the unit or loses negation, stop the action and request correction. Confirm the proposed structured change before submission and handle interruptions without replaying an already completed operation. Measure end-to-end response time as well as each speech/model/tool stage.

8. Implement information extraction and search¶

Information extraction converts unstructured or multimodal sources into reliable representations for people, systems, retrieval, and agents.

Ingestion design¶

For each source, define:

connector and authentication;
supported formats and maximum sizes;
change/deletion detection and freshness target;
OCR, layout, transcription, or video segmentation;
enrichment and normalization;
chunk and document schema;
permissions and metadata filters;
failure queue, retry, and reconciliation;
quality and coverage checks;
retention and source lineage.

Built-in and custom enrichment skills can extract or transform content before indexing. Content Understanding analyzers can produce fields or Markdown suited to downstream reasoning. Preserve page, region, timestamp, source URI, and version metadata when citations or auditability depend on them.

The Content Understanding overview and multimodal quickstart demonstrate asynchronous analysis and structured/Markdown results for documents, images, audio, and video. VERIFY CURRENT: analyzer modes, API versions, model dependencies, supported formats, limits, pricing, and regions.

OCR is a stage, not the finished answer¶

OCR recognizes text. Layout analysis adds spatial and structural relationships. Field extraction maps evidence to a schema. A multimodal reasoning stage can interpret relationships, but it should not erase the underlying evidence or confidence.

Related item: Data contracts stabilize AI pipelines. Version the normalized schema and downstream expectations so an analyzer or index change does not silently break retrieval, agents, or business automation.

Search relevance loop¶

Create a labeled query set, record expected documents, run retrieval, inspect false positives and misses, adjust query/index/chunk/ranking choices, and retest. Measure freshness and security separately from relevance. A highly relevant stale or unauthorized result is still a failure.

Worked extraction example: confidence is one input to validation¶

A synthetic invoice has two units at 120.00 each and a printed total of 240.00. OCR reads the text correctly, but an extractor maps 120.00 to total. The defect is in layout/field association or schema mapping, not necessarily OCR. Inspect the field's source region, table row/column relationships, and schema description before changing the language model.

Check numeric types and currency, compare quantity × unit price with the total under an explicit tax/discount policy, and route contradictory evidence for review. Do not silently overwrite the printed total with your calculation. Missing values remain missing; a plausible guess is not an extracted fact. Confidence thresholds need calibration on representative documents and field-level error costs.

The August Content Understanding article distinguishes a GA refresh from preview capabilities. Use it to identify experiments, then check the release notes and mode table below. Start with standard extraction for straightforward fields. Evaluate agentic mode when evidence is distributed and additional reasoning might justify its latency and cost; the current document-only, single-input-file preview is not a drop-in replacement for retired pro workflows. Publication-level accuracy or token-saving figures are not your workload's acceptance criteria.

9. Implementation and operational playbook¶

Create a deployment manifest¶

Treat the evaluated AI configuration as a releaseable bundle. A deployment manifest can record:

application_version: 2.3.0
model:
  deployment_name: support-router-prod
  model_version: VERIFY-CURRENT
  deployment_type: VERIFY-CURRENT
prompt_bundle: prompts/2.3.0
tool_schema_bundle: tools/1.8.0
search:
  index_schema: support-v5
  embedding_deployment: support-embed-v2
safety_policy: safety/3.1.0
evaluation_set: evals/release-2026-08
release_thresholds:
  groundedness: organization-defined
  task_success: organization-defined
  critical_safety_failures: 0

The example deliberately avoids a real model name or threshold: those values must come from the current catalog and the application's evidence. Store hashes or immutable artifact references when possible. Record region, capacity/quota dependency, connected resources, and identity assignments outside the file if the deployment system owns them.

A safe CI/CD flow is:

lint/unit tests
  → infrastructure validation
  → deploy isolated candidate
  → smoke test connectivity and identity
  → offline quality/safety evaluation
  → scan dependencies/configuration
  → approval
  → canary or controlled promotion
  → live monitoring and rollback decision

Do not reuse production secrets or private evaluation data in an untrusted pull-request workflow. Use workload federation/managed identities and environment approvals. Make rollback cover prompts, tools, index schemas, guardrails, and agent configuration—not only application code.

Related item: Database and search-index changes have compatibility windows. Use additive schema changes or dual-read/dual-write migration where necessary so the application can roll back without depending on a now-incompatible index.

Design the Python application boundary¶

Foundry SDK surfaces change, so isolate provider-specific code behind an adapter. The durable application contract is more important than memorizing a preview method name.

Before implementing that adapter, use the SDK and endpoint reference to select a compatible package set, endpoint, authentication audience, and operation. A project endpoint for agents/evaluations and a model inference endpoint are different contracts. Record exact installed versions in the lab evidence rather than relying on an unbounded installation command. Current docs also use renamed Foundry RBAC roles; compare the role definition and scope when older tutorials show the Azure AI names.

from dataclasses import dataclass
from typing import Protocol

@dataclass(frozen=True)
class GenerationRequest:
    task: str
    evidence: tuple[str, ...]
    correlation_id: str

@dataclass(frozen=True)
class GenerationResult:
    answer: str
    citations: tuple[str, ...]
    deployment: str

class Generator(Protocol):
    def generate(self, request: GenerationRequest) -> GenerationResult: ...

The concrete Foundry adapter should use the current documented credential and client, specify a timeout, target a configuration-supplied deployment name, validate structured output, translate provider errors into application error categories, and emit trace spans. The business layer should not handle raw credentials or assume every HTTP error is retryable.

Use DefaultAzureCredential carefully: its credential chain is convenient across local and hosted environments, but production should have a predictable managed identity/workload identity and explicit role assignments. Test using that identity. A developer's broad Azure login can conceal missing production access.

Error taxonomy¶

Error	Retry?	Response
Authentication/authorization	No automatic blind retry	Verify identity, token audience, role, and scope
Invalid request/schema	No	Correct request or handle unsupported input
Rate limit	Yes, bounded	Respect retry guidance, back off with jitter, control concurrency
Transient service/network	Yes, bounded	Retry idempotent work; apply deadline/circuit breaker
Safety policy block	No identical retry	Follow product policy: explain, transform safely, or escalate
Tool side effect timed out	Not until outcome known	Reconcile by idempotency key/status before retry

Engineer a retrieval index¶

A useful chunk schema commonly needs more than text and an embedding:

Field	Purpose
`chunk_id`	Stable citation and update identity
`document_id`	Groups chunks and supports deletion/reconciliation
`content`	Searchable/retrievable text or normalized representation
`content_vector`	Vector representation when vector search is used
`title`, `heading`, `page`, `region`	Human-verifiable citation context
`source_uri`, `source_version`	Provenance and freshness
`allowed_principals` or security filter key	Retrieval-time authorization
`language`, `content_type`, business metadata	Filtering and ranking features
`updated_at`	Freshness measurement

Do not place a large unrestricted principals list on every chunk without evaluating index limits and authorization design. Options include group-based filters, security-trimmed indexes, query-time filters, or separate indexes for hard boundaries. The application must construct security filters from trusted identity claims, never from a user-supplied principal string.

Retrieval experiment matrix¶

Run the same labeled queries through:

lexical search only;
vector search only;
hybrid search;
hybrid plus semantic ranking where eligible;
the chosen method with metadata/security filters and query rewrite.

Measure recall at a chosen cutoff, ranking quality, no-result behavior, latency, and authorized coverage. Then judge generated groundedness separately. A retrieval system can find the correct document while generation misuses it; a fluent model cannot repair evidence it never received.

Related item: Reciprocal rank fusion is used by Azure AI Search to merge independently ranked result lists in hybrid search. You need the mental model—fusion combines signals—not a hand-calculated constant. See the current hybrid search overview.

Build a stateful agent as a state machine¶

Make the orchestration state explicit:

RECEIVED
  → CONTEXT_READY
  → PLAN_OR_ROUTE
  → TOOL_PENDING
      ↘ APPROVAL_REQUIRED → APPROVED or DENIED
  → TOOL_RESULT
  → RESPOND | ESCALATE | FAILED | CANCELLED

Persist only what is needed to recover the workflow. A state record can include conversation/thread identifier, current step, attempt count, deadline, tool request hash, idempotency key, approval identity/time, last safe result, and trace correlation. Do not store hidden model reasoning as an application requirement. Store decisions, tool inputs/outputs, evidence, and concise explanations that are appropriate for audit and troubleshooting.

Tool contract example¶

{
  "name": "create_support_case",
  "description": "Create a low-severity support case after explicit user confirmation.",
  "input": {
    "summary": "string, 10-500 characters",
    "category": "one of the approved categories",
    "user_confirmation_id": "server-issued identifier"
  },
  "server_controls": [
    "authenticate caller",
    "authorize tenant and action",
    "validate confirmation",
    "enforce severity limit",
    "deduplicate idempotency key",
    "write audit record"
  ]
}

The server_controls are documentation; the API implementation must enforce them. Returning an error in a structured, model-readable form helps the agent decide whether to correct input, ask the user, or stop.

Orchestrate multiple models, agents, and rules¶

Pattern	Use when	Main risk/control
Model router	Tasks differ enough to justify eligible models	Misrouting; evaluate routing and fallback
Rules then model	Policy can reject/shape work deterministically	Rule drift; version and test the policy
Model then validator	Flexible generation must meet a strict contract	Validator gaps; fail closed for critical invariants
Supervisor and workers	Bounded specialists need coordinated work	Cost/loops/conflict; budgets and typed handoffs
Sequential handoff	Stages have clear ownership and output contracts	Error propagation; validate each boundary
Parallel candidates/judging	Independent proposals improve selected quality	Cost and correlated failure; use evidence-based selection

Multi-agent is not automatically more agentic or more accurate. Use it when separate tools, security boundaries, expertise, or parallelism create measurable value. Keep authorization at each tool/resource and do not assume the orchestrator's trust transfers to every worker.

Evaluate reflection and self-critique safely¶

The blueprint includes reflection, self-critique, and chain-of-thought evaluation concepts. Implement them as observable quality-control stages—for example, require a verifier to check citations, a schema validator to reject invalid output, or a separate model/configuration to score an answer against a rubric. Do not require storage or disclosure of private hidden reasoning. Evaluate the final decision, evidence, tool path, explanation, and outcome.

A critique loop needs a maximum iteration count and a stopping rule. Otherwise it can increase latency and cost without improving quality. Compare:

first-pass outcome;
outcome after critique/revision;
additional tokens and latency;
failure categories improved or introduced;
whether the evaluator shares the same blind spots as the generator.

Related item: An LLM evaluator is itself a model with variance and bias. Calibrate it against human judgments, use explicit rubrics, and inspect disagreement rather than treating its score as ground truth.

Create evaluation gates and production feedback¶

Use multiple slices rather than one aggregate:

Slice	Example gate
Core task	Minimum task-success rate with confidence interval/review
Grounding	Citations support claims; critical unsupported claims fail
Safety	Zero allowed critical prohibited-action cases
Authorization	No restricted item appears for unauthorized test identities
Tool behavior	Correct tool/arguments and no duplicate side effects
Operations	P95 latency/cost within the product budget
Accessibility/language	Required scenarios meet defined rubric

Production feedback should connect a rating or incident to the configuration version and trace without collecting unnecessary personal data. Sampling for evaluation needs notice, access controls, redaction, retention, and a process for correcting mislabeled cases.

Implement multimodal and Content Understanding modes¶

For image/video generation and editing, keep the original input, mask/reference identifiers, prompt/configuration, safety result, output identifier, and human decision when provenance matters. Inpainting constrains change to a masked region; prompt-driven editing may change broader content. For the current preview Sora 2 remix sequence, use the version-bounded workflow in Section 6. VERIFY CURRENT: eligible models and exact editing APIs.

Map the blueprint's Content Understanding modes to documented versions¶

The AI-103 blueprint says single-task and pro-mode, while Microsoft's retained 2025-05-01-preview REST reference calls the operational modes standard (the default) and pro. Current agentic-mode guidance says that pro mode and its preview API are retired. Treat the blueprint wording as a historical crosswalk; do not invent an API property named single-task or use the retired API for a new workload.

Blueprint/product concept	Documented configuration path	Evidence and boundary
Single-task (blueprint) / standard mode (`2025-05-01-preview`)	In the historical API, standard was the default analyzer mode. Define the analyzer and field schema, submit one representative input for the assessed single-task case, poll the asynchronous operation, and validate the structured result and source evidence.	Standard handled straightforward structured extraction across supported document, image, audio, or video inputs. For a live solution, use the current GA analyzer workflow instead of the retired preview API.
Pro mode (`2025-05-01-preview`)	In the historical API, select pro for document workflows that needed multiple inputs, multistep reasoning, validation or enrichment, and optional reference knowledge; test cross-document conclusions and missing-reference behavior.	Pro was document-only and added multiple input files, reasoning, aggregation/validation, and external reference data. Its API retired July 15, 2026; this row is exam-version history, not a runnable recommendation.
Current standard/default	Pin the `2025-11-01` GA API, select a prebuilt analyzer or build a supported custom analyzer in Content Understanding Studio, and submit supported `inputs`. Capture the returned `Operation-Location`, poll until `Succeeded` or a terminal failure, and validate returned fields/Markdown, source regions/timestamps and confidence where provided.	This is the supported production-oriented implementation path, but Microsoft does not label it `single-task`. Foundry (new) and Studio expose different authoring features, so choose the documented surface deliberately.
Current agentic mode (`2026-06-01-preview`)	For a document analyzer, set `config.workflow` to `"agentic"` at creation; the service resolves it to a versioned `agentic.*` value.	Agentic mode is the current reasoning option but is not a drop-in rename of pro mode. The initial preview accepts one input file, is document-only, does not support `extract` fields or labeled samples, costs more and takes longer, and requires preview governance.

For either a historical comparison or current analyzer, make the output contract concrete: analyzer ID and API version, base analyzer/template, schema and field methods, supported media/input limits, model deployment where required, source and reference-data permissions, asynchronous status/deadline handling, output fields or Markdown, grounding regions/timestamps, confidence and human-review thresholds, cost/latency budget, and versioned test set. Never run new work against the retired pro endpoint merely to satisfy the blueprint wording.

For video:

validate duration, codec, rights, and safety;
segment or use the supported analyzer path;
preserve timestamps and detected regions/components;
evaluate events across segment boundaries;
return evidence-linked results;
test missing audio, cuts, overlays, and embedded text attacks.

Related item: Provenance metadata helps a reviewer trace generated or extracted content, but watermarking and metadata can be removed. Use layered disclosure, access, audit, and policy rather than treating one provenance signal as tamper-proof.

Operate speech as a latency budget¶

Break end-to-end voice delay into endpointing/turn detection, speech recognition, orchestration/retrieval/tools, generation, and synthesis. Stream partial output where appropriate, but do not speak an unvalidated consequential action as if it completed.

Test accents, languages, code switching, domain vocabulary, background noise, interruption, silence, dropped connections, repeated partial transcripts, and accessibility alternatives. Protect raw audio and transcripts according to their sensitivity. Custom speech introduces training-data rights, deployment versioning, and regression evaluation.

10. Production architecture and incident drills¶

Current SDK and retrieval preflight — October 28, 2026¶

The current SDK overview documents Python 3.10+, azure-ai-projects >= 2.3.0 and openai >= 3.0.0; the agent-evaluation tutorial requires azure-ai-projects >= 2.8.0 for its operations but still names Python 3.8 in its prerequisites. Preserve that discrepancy. A generic 2.x label is insufficient: choose a Python/package combination that meets the actual selected distribution and task requirements, then pin tested versions. These are documented minimums, not a verified environment or an instruction to upgrade this repository. Record endpoint, token audience, agent/API generation and required operation before adapting a sample.

Vector filter placement affects retrieval quality without changing source permission. preFilter applies the predicate during traversal; postFilter filters per-shard candidates afterward; preview strictPostFilter filters the global candidates afterward. Selective post-filtering can miss permitted relevant documents. A simplified ordered list restricted, restricted, allowed, allowed with k=2 illustrates how global filtering can return none while prefiltering may find the two allowed items. It is not an HNSW or sharding simulation. Keep the authorization predicate, inspect index/API/mode, and compare allowed recall, latency and cost; never remove access filtering to fill the result count.

The October Content Safety update stages text-harm and Prompt Shields changes from Spain Central. It does not establish a simultaneous update to image safety, PII, task adherence, egress, Spotlighting, blocklists or protected material. Record region/configuration and test reviewed benign and attack slices; rollout news is not a measured improvement or proof that every region is updated. VERIFY CURRENT: exact feature, region and model/filter behavior.

Draw trust boundaries before selecting controls¶

An AI application crosses more boundaries than the model endpoint. Start with a data-flow diagram:

user/channel
  -> application/API
  -> orchestration or agent
     -> model deployment
     -> search/knowledge
     -> tools and business systems
  -> response

telemetry/evaluation <- every stage
deployment pipeline  -> application, prompts, indexes, agents, policies

For every arrow, record the calling identity, authentication method, authorization scope, network path, data classification, logging behavior, timeout, retry rule, and failure owner. This turns “secure the AI” into concrete boundaries.

Boundary	Minimum design questions
User to application	How is the user authenticated, authorized, rate-limited, and separated from other tenants?
Application to Foundry/model	Can managed identity or another keyless credential replace a stored key? Which deployment and actions are permitted?
Agent to tool	Is the tool allow-listed, schema-validated, least-privileged, idempotent where needed, and approval-gated for high impact?
Retrieval to content	Is the user's content entitlement enforced before evidence reaches the model? Can retrieved text contain indirect instructions?
Service to telemetry	Which prompt, response, document, identity, or tool fields are sensitive? Who can query or export them?
CI/CD to production	Which identity deploys, which immutable artifacts/configurations are promoted, and which evaluations block release?

Private networking changes reachability; it does not grant data-plane authorization. Managed identity removes application-held credentials; it does not choose least-privilege roles automatically. Content filters detect supported risk categories; they do not validate business authorization or guarantee factual answers. Use controls in combination and verify current Foundry networking constraints in Microsoft's network-isolation guidance.

Security review scenario¶

A private RAG application returns a confidential document to an authenticated employee. Work backward:

Preserve the request, trace, retrieved document identifiers, filter expression, user/tenant claims, index version, and deployment version under incident controls.
Determine whether the source ACL was wrong, ingestion omitted it, the index did not store it, the query failed to filter, caching crossed identity boundaries, or the tool used an overprivileged service identity.
Contain at the narrowest reliable point—for example, disable the affected index/route or block the faulty retrieval version—without deleting evidence.
Correct the entitlement path and add a regression case for an allowed and denied user.
Reindex or invalidate caches if derived content carries the faulty access state.
Review logs, downstream outputs, notifications, and required response obligations.

Prompt wording cannot repair missing authorization. The model must receive only evidence the caller is permitted to use.

Related item: Security trimming is end-to-end data lineage. An access label must survive source ingestion, transformation, chunking, indexing, filtering, citations, caches, and deletion. A break at any stage can become disclosure.

Debug RAG by separating its quality stages¶

When an answer is weak, score the stages rather than immediately changing the model:

Failure class	Evidence to inspect	Likely experiment
Source coverage	Is the authoritative answer present and current in the corpus?	Add or repair the source, owner, or freshness process
Extraction	Did OCR, layout, or transcription preserve the relevant content?	Compare the raw source with structured extraction
Chunking	Is the needed evidence split, merged, or stripped of context?	Change chunk boundary, overlap, and metadata strategy
Indexing	Are text, vectors, filters, and semantic fields populated with the expected version?	Validate sample documents and rebuild a test index
Query transformation	Did rewriting preserve names, dates, codes, exclusions, and intent?	Evaluate the original versus rewritten query
Retrieval	Does the relevant chunk appear in candidate results?	Compare keyword, vector, and hybrid retrieval and tune top-k
Reranking/filtering	Was good evidence removed by a filter or ranked too low?	Inspect the filter and pre/post-rerank positions
Grounding context	Did truncation, ordering, duplication, or token budget obscure evidence?	Change context selection and ordering
Generation	Did the answer ignore, distort, or overstate supplied evidence?	Tighten the instruction/output contract and compare deployments
Citation rendering	Does the displayed citation point to the exact evidence used?	Validate citation IDs through the full response mapping

Azure AI Search hybrid search runs full-text and vector queries together and merges ranked results. Keyword retrieval helps exact identifiers and specialized terms; vector retrieval helps semantic similarity. Neither is universally better. Microsoft documents the current mechanics in the hybrid-search overview.

Build a small judged query set with expected evidence, not only expected prose. Track retrieval metrics separately from answer metrics. If the correct passage never enters the context, a fluent answer score can conceal the real defect. If retrieval is strong but groundedness is weak, index tuning alone is unlikely to fix it.

Freshness and deletion drill¶

For an updated or deleted source, trace:

source event -> ingestion job -> extracted representation -> chunks
             -> embeddings/index -> cache/knowledge connection
             -> retrieval result -> response/citation

Record expected freshness lag, retry/dead-letter behavior, tombstone or deletion semantics, index alias/version change, and proof that stale evidence stops being retrievable. A successful ingestion job count does not prove the current document version is searchable.

Design an evaluation set that can reject a release¶

An evaluation dataset should represent the workload's decisions and risks. Include ordinary cases, rare/high-impact cases, ambiguous requests, unanswerable questions, adversarial instructions, multilingual or modality-specific examples, tool failures, access-denied cases, and regressions from real incidents.

Evaluation layer	Example measures	Release question
Retrieval	Evidence recall, relevance, rank, ACL correctness	Did the right permitted evidence enter context?
Response quality	Task completion, relevance, groundedness, citation correctness, schema validity	Did the application answer the task using evidence?
Safety/security	Harm categories, prompt-attack resistance, data leakage, prohibited tool attempt	Did the system remain within policy under attack and edge cases?
Agent behavior	Tool-selection accuracy, argument validity, step success, approval compliance, recovery	Did it take only authorized actions and recover safely?
Operations	Latency percentiles, token/tool cost, throttles, timeouts, error rate	Can the version meet its service objective at expected load?
Human outcome	Reviewer agreement, escalation quality, user success, correction rate	Is the measured proxy consistent with the business result?

Define thresholds before seeing the candidate's result. Compare against the approved baseline on identical cases and inspect slice-level regressions; an improved average can hide worse results for a critical language, document type, tool, or risk class. Store dataset version, configuration, model/deployment, evaluator version, code commit, and run output so the decision can be reproduced.

Microsoft Foundry separates evaluation, tracing, and production monitoring while connecting all three across the lifecycle. Its current observability guidance describes quality, RAG, safety, and agent evaluators, plus preproduction and postproduction use. VERIFY CURRENT: evaluator availability, regions, quotas, pricing, and preview status.

Related item: An LLM-based evaluator is another model measurement, not ground truth. Calibrate it against reviewed examples, retain deterministic checks for schemas and policies, and sample disagreements for human adjudication.

Choose evaluator inputs, not only names. The current agent evaluator reference distinguishes current checks from deprecated Quality Grader and preview composite evaluators. Use full output items/tool trajectories when judging a tool-using workflow; final text alone can hide an unauthorized intermediate action. A reviewed rubric or composite score can reduce repeated judge calls, but deterministic asset, permission and approval invariants still block release. Record unsupported, missing and failed evaluation cases; no universal vendor sample threshold replaces application criteria.

Roll out an agent change as an operational experiment¶

A change to a model, system instruction, tool, knowledge source, safety configuration, or orchestration rule can alter behavior. Package these as one versioned release unit or record their exact independent versions.

Use a progression appropriate to risk:

static and contract tests for code, schemas, permissions, and tool mocks;
offline evaluation on fixed and newly added regression sets;
isolated integration tests with nonproduction resources;
shadow or replay evaluation where privacy and terms permit;
limited traffic or user cohort with enhanced monitoring;
controlled expansion after quality, safety, cost, and latency gates pass;
rapid route-back to the last approved version if a stop condition triggers.

Define stop conditions such as unauthorized tool attempts, access-control failures, safety regression, error/timeout increase, groundedness drop, or cost/latency breach. Rollback must address more than application code: prompts, agent definitions, connections, tool versions, index aliases, model deployments, content filters, and feature flags may all affect behavior.

During an incident, a trace should connect the user request to model calls, retrieval, tool calls, evaluations, and dependencies without giving every operator unrestricted access to sensitive content. Microsoft Foundry tracing can integrate with Application Insights; plan sampling, retention, redaction, access, and correlation before production. See the agent tracing overview.

Budget latency and cost across the complete call graph¶

One user turn may invoke query rewriting, embeddings, search, reranking, a planning model, multiple tools, reflection, a final model, safety checks, speech, and retries. Estimate and measure each stage:

Stage	Latency/cost lever	Risk of aggressive reduction
Retrieval	Query count, top-k, reranking, document size	Missing evidence or losing exact matches
Generation	Model/deployment, input/output tokens, number of calls	Lower task quality, truncation, or weaker reasoning
Agent tools	Parallelism, timeout, retry, cache	Duplicate side effects or stale business data
Evaluation/safety	Synchronous versus sampled/asynchronous checks	Undetected unsafe or low-quality behavior
Speech/multimodal	Media duration/size, streaming, preprocessing	Worse recognition, incomplete context, inaccessible output

Set a total service objective, allocate a stage budget, and monitor percentiles rather than only averages. Use bounded retries with a total deadline and idempotency where a tool changes state. A cheaper model that triggers more retries, tool calls, corrections, or human escalation may increase total cost.

11. Hands-on labs¶

Lab 1: Secure Foundry application baseline¶

Create a development project and deploy an eligible model. Connect a small Python application using keyless authentication where supported. Record the identity, role assignment, endpoint, deployment name, timeout, and trace correlation. Prove that removing the role causes authorization failure and restore it.

Lab 2: Evidence-grounded RAG¶

Index a small public document set in Azure AI Search. Compare lexical, vector, hybrid, and semantic-ranking results for at least ten questions. Build answers with citations, add one permission-filter field, and test a user who must not retrieve a restricted document.

Lab 3: Tool-using agent with approval¶

Build an agent with one read-only tool and one simulated side-effecting tool. Validate tool arguments, require approval for the second tool, use an idempotency key, and cap turns. Create tests for malformed input, denied access, timeout, repeated request, and prompt injection.

Lab 4: Evaluation and deployment gate¶

Create normal, difficult, unsafe, and adversarial cases. Evaluate groundedness, task success, safety, latency, and cost for two configurations. Define a release threshold and document why a single average score would hide important failures.

Lab 5: Multimodal accessibility workflow¶

Produce concise alt text and a long description for different public images. Add unsafe-content and embedded-instruction tests. Compare generated output with the image's context and accessibility purpose.

Lab 6: Document-to-agent pipeline¶

Run public documents through OCR/layout or Content Understanding, generate structured or Markdown output, index it, and query it through an agent tool. Preserve citations from response to extracted region or page.

Lab 7: Video remix and Content Understanding mode boundaries¶

Use synthetic or expressly licensed media in an authorized, cost-capped sandbox. If Sora 2 is available, create a short baseline clip, wait for completion, remix exactly one visual property from the completed video ID, poll with a deadline, download the result, and record moderation, job, provenance, quality and cleanup evidence. If preview access or budget is unavailable, use captured Microsoft sample responses to write and test the state machine without submitting media.

Then configure a current 2025-11-01 GA Content Understanding analyzer over a small public single-file set: define the schema, submit analysis, capture Operation-Location, poll to a terminal state, and assess fields/Markdown and evidence. Complete a paper-only comparison of the blueprint's single-task/pro-mode terms, the retired Standard/Pro task paths, and current default/agentic workflows. Do not call the retired 2025-05-01-preview pro endpoint. Include a migration checklist that identifies which pro assumptions—multiple input files, reference data, field methods, evidence, cost and latency—must be revalidated rather than carried into agentic mode.

Lab 8: Trace the maintenance assistant end to end — 60–90 minutes¶

Start offline with synthetic fixtures: the retrieval IDs above, the ambiguous photo description, the finalized speech request, the invoice fields, and a stub work-order API. Run the Python retrieval calculation and write an expected result for each fixture before inspecting a proposed answer. Real medical, financial, customer, or operational records are unnecessary.

Draw the identity and evidence path from technician to authorized retrieval, model, proposed tool call, approval, and result.
Diagnose four deliberate failures: missing D2, wrong asset P-140, a successful HTTP response for the wrong action, and an unknown submission outcome after timeout.
For each failure, name the first component to inspect, its observable evidence, one preventive control, and a negative test.
Make a release table with quality, authorization, approval, duplicate-prevention, latency, and cost criteria. Treat unknown results as needing investigation, not a pass.
Optionally implement the adapter using the current SDK docs and a pinned dependency environment. Record actual endpoint, agent version, credential type, run IDs, and cleanup steps. A paper design or stub run does not verify Azure integration.

Answer checkpoint: missing evidence is a retrieval problem; P-140 is an argument/identity-binding problem; HTTP success does not prove task completion; a timeout requires reconciliation before another write. The spoken negation prevents closing the order. A blurry plate supplies no trustworthy ID. The invoice's arithmetic catches a mapping inconsistency but does not authorize changing the source document.

Lab 9: Policy, output and speech evidence worksheet¶

Use synthetic input and expected outcomes. Define the four visual release controls above, including an uncertain detector result and an absent watermark. Run the local draft validator on valid, missing-field, wrong-type, extra-key and forbidden-action objects, then show a schema-valid but source-wrong asset that still needs rejection. Design a held-out speech comparison and an audio-versus-transcript experiment; mark product-dependent observations as unexecuted. Retain the policy/schema/version, expected/observed local result, missing service evidence and release decision. Do not publish images, train voices, upload personal audio or submit maintenance actions to complete the worksheet.

12. Scenario checks and exam distinctions¶

Knowledge checks¶

A RAG app returns fluent answers with irrelevant citations. Which pipeline stages do you test before changing the model?
A private-endpoint deployment works for an administrator but not the application. How do you distinguish identity, RBAC, DNS, and network causes?
An agent sometimes sends the same order twice after a timeout. Which API and orchestration controls are missing?
A team wants to store every conversation forever to improve quality. Which privacy, consent, access, and evaluation questions must be answered?
A document field is frequently wrong even though OCR text is accurate. Which extraction stages should you inspect?
A smaller model is slightly less fluent but meets task quality at much lower latency and cost. What evidence supports or rejects routing this use case to it?
Relevant documents are D1 and D2; retrieval returns D1, D3, and D4. What are set-based precision and recall, and what do they leave unmeasured?
A migrated agent has the same instructions, but its Search tool now fails authorization. What must you compare?
A tool returns HTTP 200 after acting on the wrong asset. Which evaluations and controls reveal the problem?
A streaming transcript temporarily omits “do not.” When may an application act on the request?
A photo's serial number is unreadable. Should a confident multimodal answer supply the most likely number?
An evaluation run omits the agent version and has several errored rows. Can its successful rows alone justify release?
Does valid structured JSON establish the correct asset and permission to act?
Does a generic image-safety result implement watermark and brand rules?
What must be measured before choosing custom speech instead of the base recognizer?
What information does an audio-native path retain that a text-only transcript path may lose, and what does neither authorize?

Answer checkpoints¶

Inspect ingestion, chunking, authorized filtering, retrieval/ranking, and the actual prompt context; then evaluate whether claims use that evidence. Changing the generator cannot recover documents it never received.
Compare the actual runtime principal with the administrator, check the denied action and RBAC scope, then inspect DNS resolution, route/private-endpoint reachability, and firewall behavior. Use the observed error and request path to distinguish authentication, authorization, and connectivity.
Bind approval to one proposed operation, use server-supported idempotency, persist operation state, and reconcile unknown outcomes before retrying. Retry limits alone do not prevent duplicate side effects.
Establish purpose, lawful/consented use where applicable, minimization, retention/deletion, user access boundaries, and redaction. Prefer a curated evaluation dataset over retaining all raw conversations indefinitely.
Inspect document layout, field/schema definitions, table association, evidence regions, and normalization/business validation. Correct characters can still be assigned to the wrong field.
Compare representative and difficult slices, task success, safety, grounding, latency, cost, and fallback behavior with a fixed dataset. Fluency is only one dimension; deploy gradually and monitor regressions.
Precision is 1/3; recall is 1/2. These do not measure ranking, answer support, task completion, or authorization correctness. Labels must represent relevant documents the user may access.
Compare old and new runtime identities, downstream role assignments, endpoint, and caller authorization. Copying a definition does not copy permission grants. Revalidate denied access as well as successful retrieval.
ToolInputAccuracy and ID validation expose incorrect arguments; TaskCompletion/TaskAdherence and application invariants expose an incorrect outcome. ToolCallSuccess can still pass. Authorization and approval must be enforced outside the model.
Wait for a finalized interpretation, preserve negation and identifiers, validate the proposed structured operation, and obtain the required approval. Partial recognition is unsuitable authorization for a write.
No. Report the missing evidence and request a clearer image or another trusted identifier. A confidence signal cannot make unreadable detail observable.
No. Pin the target version, record errored/missing cases, investigate failure patterns, and apply the predeclared release criteria. A changing target and silently excluded failures undermine the comparison.
No. Shape/types are one gate; verify source identity, meaning, user authorization and any action-bound approval separately.
No. Define each policy, its detector or human review, the actual exported marking/provenance and a release gate.
Use held-out reference transcripts, word error rate and critical-term performance, then compare training data, deployment, cost and lifecycle requirements.
Supported audio input can preserve nontextual/timing context for the task; a transcript omits information it does not encode. Neither proves identity, consent, accurate emotion or write authority.

Distinctions to explain without notes¶

Contrast	Remember
Model vs deployment	Capability/version versus configured endpoint and capacity
Model parameter vs prompt	Sampling/output control versus task/context instructions
Lexical vs vector search	Term matching versus semantic similarity
Hybrid search vs semantic ranking	Combine retrieval methods versus rerank an initial result set
OCR vs layout vs field extraction	Text recognition versus structure versus schema mapping
Conversation state vs memory vs knowledge	Active interaction versus retained facts versus external evidence
Workflow vs agent	Predetermined steps versus model-mediated decisions within constraints
Tool schema vs authorization	Describes valid arguments versus enforces who may act
Content filter vs groundedness evaluation	Harm classification versus evidence support
Retry vs compensation	Repeat a safe operation versus undo/offset a completed side effect
Trace vs audit record	Diagnostic execution detail versus controlled evidence of accountable action
SDK adapter vs business logic	Volatile provider client versus stable application contract
Index relevance vs answer groundedness	Correct evidence retrieval versus claims supported by that evidence
Model critique vs deterministic validation	Probabilistic review versus enforced schema/business invariant
Agent trace vs hidden reasoning	Observable decisions/actions/evidence versus private internal computation
Runner/retry success vs business success	Technical completion versus intended outcome without duplication

Readiness checklist¶

Primary references¶

All Foundry references in this list target the current experience unless their label explicitly says FOUNDRY (CLASSIC).

Recheck model versions, deployment types, SDKs, quotas, pricing, regions, preview status, and product naming before the exam.

Places to learn¶

Targeted blog reading¶

Article	Author and date	Learning task and limits
How to debug and optimize RAG agents	Chang Liu; November 20, 2025	Free; allow 20–30 minutes with notes. Diagnose retrieval and generation separately using Part 4. Treat its SDK/API examples as historical and compare with current evaluation docs; do not assume agentic retrieval always wins.
Content Understanding updates, August 2026	Peyton Fraser, Krishnakumar Muthukrishnan, Joe Filcik; August 12, 2026	Free; allow 15–25 minutes with notes. Classify GA versus preview capabilities and design the invoice experiment. Internal benchmark figures and feature announcements require workload and current-version validation.

Both Microsoft articles were publicly readable on September 27; no separate update date was shown in the reviewed article text. They supplement current documentation and supply learning context, not exam questions or guaranteed performance.

Courses and practice¶

Commercial durations and update dates below are retained historical catalog observations. The September 27 review checked public access and first-party references; it did not inspect paid lessons or sign-in-only assessment questions. Verify a course's current SDK generation, recording availability, and price before choosing it.

This is a curated starting point, not a complete list. You are not meant to consume every resource. Start with the official blueprint, then pick the instructor, format, examples, and hands-on work that help you close specific gaps. Times are approximate consumption time at normal speed; labs, note-taking, review, and independent practice add time.

Resource	Access	Estimated time	Best use and caveat
Microsoft Learn — AI-103 course	Free self-study; instructor-led options vary	4 days (official course)	Official objective-aligned starting point and lab sequence
Microsoft — AI-103 Practice Assessment on AI Skills Navigator	Free Microsoft account	About 1–2 hours for an attempt and review	Repeatable official readiness check; AI Skills Navigator sign-in is required, and the blueprint and product documentation remain authoritative
Microsoft Partner Skilling Hub — LevelUp AI-103	Partner login required; current exact listing details unverified	10-hour historical/journey listing, not a freshly verified session runtime	October 28 direct HTTP reached an application shell while browser access was unavailable; confirm current enrollment, exact content and eligibility with the provider. No exact successor was verified; access failure does not prove retirement
Use a custom function in an AI agent	Public MIT lab; Azure subscription, permissions, deployed model and local tooling required; charges possible	50 minutes (publisher estimate), plus setup/troubleshooting	Current create-version, conversation and Responses function-output workflow; add schema, denied-action and timeout tests; no lab executed here
Extend agents with MCP tools	Public MIT lab; eligible Azure environment, Python, VS Code and Git required	60 minutes (publisher estimate), plus setup/troubleshooting	Remote Learn MCP and local inventory server; sample automatically approves matching requests despite requesting approval, so it does not establish human enforcement; reconcile its Python 3.13 prerequisite with 3.12 test note
O'Reilly — AI-103 Crash Course with Yasir Khan	Subscription or event access	About 4 instructional hours plus breaks	Certification-focused walkthrough across all five domains; verify the event occurrence and current baseline
O'Reilly — Hands-On Microsoft Foundry	Subscription or event access	Historical 4-hour October 22 occurrence; recording/future access unverified	Supporting implementation practice; the listing uses nonstandard “Microsoft Foundry Studio” and goal/planner terminology, so confirm the demos use the current portal, project model, SDK, and Responses API
O'Reilly — Introduction to AI Agents on Azure	Subscription or event access	4 hours (published agenda)	Agent concepts and Azure implementation context; the listed live occurrence has ended
Udemy — AI-103 course by Alan Rodrigues	Purchase or subscription	32 hours 56 minutes	Long-form course shown as updated July 2026; the listing follows AI-103 despite the legacy URL slug, but does not expose lesson-level Foundry generation, so verify demos against the current-generation signals above
Udemy — AI-103 course by Luke Ginn	Purchase or subscription	30 hours 22 minutes	Deep alternative updated August 2026; includes labs and explicitly marked older lectures—treat those older lectures as FOUNDRY (CLASSIC) or adjacent content and follow the current sections
Pluralsight — Build a Generative AI Solution with Azure	Subscription	3 hours across one course and three labs	Current 2026 implementation practice for a secure Azure OpenAI pipeline, rate limits, monitoring, and data services; supports only part of AI-103
LinkedIn Learning — Azure AI for Developers: Building AI Agents	Subscription	1 hour 53 minutes	FOUNDRY (CLASSIC): released February 2025 and teaches Azure AI Foundry with the Assistants API, assistants, threads/runs, and older framework surfaces; use only for legacy comparison or durable agent concepts, not current portal/API steps

No exact Pluralsight certification path or standalone MeasureUp AI-103 practice-test page was verified during the August 31, 2026 review. Whizlabs announced a 100-question AI-103 bank in August 2026, but the reviewed public listing did not expose a stable exam-specific product URL, so it is not linked yet. The free Microsoft assessment above is available; the listed Pluralsight path supports a subset of the objectives. See the broader Places to learn catalog.