Get Your CertAI-103PlayCompete
‹ All AI-103 questions

AI-103 Practice Question 12: Keyless Auth for Agents

Microsoft Azure AI Apps and Agents Developer Associate (AI-103) · Test 2 · question 2 of 10

Plan and manage an Azure AI solutioneasy

A Python web app running on Azure App Service currently calls chat completions with an API key read from Key Vault. The team is moving the app onto Foundry Agent Service, and their first attempt (reusing the same api-key header against the agent endpoint) fails to authenticate. Security has also asked that the new integration hold no secret of any kind.

What should the team do?

Select one answer
Show answer and explanation

Answer:

  • C. Enable the App Service system-assigned managed identity, assign it a Foundry role on the Foundry resource, and acquire tokens with DefaultAzureCredential

The feature support matrix in the Foundry authentication documentation is explicit: the Agents service does not support API keys at all, only Microsoft Entra ID. The same table lists managed identity as an Entra-only capability that "enables secret-less auth". A system-assigned managed identity on App Service plus a Foundry role assignment gives the app an identity with no credential to store, and DefaultAzureCredential from azure-identity acquires the bearer token (scope https://ai.azure.com/.default) automatically.

- A is wrong because rotating a key does not change the fact that the Agents service refuses key-based authentication, and it leaves a secret in the system. - B is wrong on the second requirement. An app registration with a client secret *is* Entra authentication and would work, but it reintroduces exactly the stored, expiring secret the security team asked the team to eliminate. - D is wrong because a custom subdomain is a prerequisite for *token*-based authentication, not a switch that grants the Agents service key support.

Reference: Authentication and authorization in Microsoft Foundry

Practice Test 2 ›

Study guides for AI-103

AI engineer roadmap 2026: skills, certs and the orderAI engineer roadmap for 2026: skills to learn in order, AI engineer vs ML engineer, which certifications fit each stage, and what to skip.
AI-200 exam guide: Azure AI Cloud Developer AssociateAI-200 replaced AZ-204: what the Azure AI Cloud Developer exam tests, how it differs from AI-103, price in USD and INR, format and how to prepare.
How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.
AI-901 exam guide: Azure AI Fundamentals after AI-900AI-901 replaced AI-900: learn what changed, how much Python and Microsoft Foundry you need, exam costs in India, and how to prepare.
Best AI certifications 2026: AWS, Google, Microsoft, ClaudeThe best AI certifications in 2026 from AWS, Google, Microsoft, Claude and Databricks, by level, with price, status and which one to take first.
Microsoft AI certification path 2026: which exam firstMicrosoft AI certification path for 2026 - AI-901, AB-730, AI-103, AI-200, AI-300, AB-100, AI-500 and GH-300 by role, and which exam to take first.
AI-103 Certification Guide: What Changed From AI-102The AI-103 certification replaced AI-102 in 2026. Exam format, cost, the five skill domains, what changed and how to prepare, with free practice questions.
What Is RAG? How Retrieval-Augmented Generation WorksWhat RAG is and how it works: chunking, embeddings, vector search, hybrid search, reranking, GraphRAG and agentic RAG on AWS, Google and Azure.
Prompt engineering vs RAG vs fine-tuningWhen to use prompt engineering, retrieval-augmented generation, fine-tuning or continued pre-training, compared on cost, freshness, hallucination and privacy.