AI-103 Practice Question 95: Client Side Function Calling Credentials

Function calling runs wherever the calling application runs: "Your app executes the function and returns the output." Here that application is the customer's own authenticated browser session, which already holds the delegated token the account API requires, nothing about that token needs to exist anywhere inside Foundry for the lookup to work, and the call is authorized exactly as the customer, not as any broader identity.

- B is wrong because the OpenAPI tool is a hosted tool: Foundry invokes the API directly using the *project's* managed identity, not the signed-in customer's; the account API would need to trust a single service principal for every customer, which is the broad access the bank wants to avoid. - C is wrong for the same reason: the Azure Functions tool authenticates as the function app's own identity, running inside Foundry's environment rather than the customer's session, so it never sees and cannot use the customer's delegated token. - D is wrong because an MCP server authenticates to the downstream API with its own service credential, again substituting a shared identity for the one credential that actually carries the customer's own authorization.

Reference: Use function calling with Microsoft Foundry agents