Azure AI Foundry

Vendor ID: azure-foundry · Maturity: preview · Categories: AI

Azure AI Foundry — LLMs, embeddings, images, and audio models deployed per-org. Foundry endpoints are tenant-specific; the extension accepts baseUrl + projectEndpoint config so each org points at its own deployment.

Auth

Endpoints

Each connection needs two addresses for your Foundry resource:

<resource> is the Foundry resource name (a default project's resource looks like proj-default-ne-resource) and <project> is the project name. Every model call on the connection goes to the Foundry OpenAI Endpoint; deployments are listed from the project URL.

Use the services.ai.azure.com address even though Azure also shows a *.openai.azure.com address for the same resource. Microsoft documents both as the base URL of its v1 API, but as of September 2026 Azure does not serve a valid TLS certificate for *.openai.azure.com in North Europe, so every request to that address fails before it reaches your resource. The services.ai.azure.com address reaches the same resource and the same deployments.

Certificate errors

A model call on a connection that uses the *.openai.azure.com address in an affected region fails with CAPABILITY_NOT_CONFIGURED and a message like:

The provider endpoint's TLS certificate could not be verified. (azure-foundry, gpt-5.5) Provider reported: "Hostname/IP does not match certificate's altnames: Host: <resource>.openai.azure.com. is not in the cert's altnames: DNS:*.cognitive.microsoft.com, …"

Retrying doesn't help, because the endpoint presents the same certificate every time. The model popover under Settings → Platform → Extensions names the same cause beside the connection instead of reporting "No models available".

Edit the connection and change Foundry OpenAI Endpoint from https://<resource>.openai.azure.com/openai/v1 to https://<resource>.services.ai.azure.com/openai/v1. Keep the same API key, then select Refresh models.

The same failure can block Cortex when the affected connection is the one your organization's default language model resolves to. With no default set, Scrydon selects automatically, and when several connections are enabled for the same capability it uses the most recently created one. A single connection with the *.openai.azure.com address can therefore block every automatic model call, even when your other connections are healthy. Cortex names the cause: Chat shows the certificate message, and the shared conversation in a Process Flow Wizard reports that Cortex has no usable AI model, with the certificate message under More details. Fix the connection's endpoint, or choose a default language model under Settings → Platform → Extensions → Models & defaults.

Capabilities

There are no stand-alone tool products on this vendor — every capability resolves through the extension registry.

Model discovery

After you configure and enable Azure AI Foundry, open Settings → Platform → Extensions → Available, expand Azure AI Foundry, and select a capability badge such as LLM. Scrydon discovers deployments for the exact connection and active workspace environment, then shows the cached model inventory in the popover. Use Refresh models to query Azure again after adding, removing, or reclassifying a deployment.

The configured model allowlist is policy, not a discovery cache. An empty allowlist can block execution without hiding which deployments Azure returned from the administrator inventory.

If no models appear, verify that the extension is enabled, the API key is current, and projectEndpoint/baseUrl identifies the Foundry resource that contains your deployments. Then select Refresh models. Discovery remains server-side: the browser never receives the API key or calls Azure directly.

Discovery also checks that the Foundry OpenAI Endpoint can be reached. If it cannot, for example because of the certificate error above, the connection offers none of its discovered deployments (LLM, embedding, image, OCR, TTS, or transcription) until the endpoint is corrected: a deployment that no call can reach is not offered. The capability popover shows the reason beside the connection name. Built-in Speech models do not use that endpoint and stay available.

Regions and built-in Speech models

Set Azure Region on each Foundry connection to the resource's Azure region, for example northeurope, swedencentral, or westeurope. This is separate from Environment, which controls whether the connection applies to Development, Production, or all application environments. Existing connections can set the region by editing their configuration. Custom resource names do not reliably identify their Azure region.

MAI Transcribe 2, MAI Transcribe 1.5, Azure Speech Fast Transcription, and Azure AI Speech live transcription are built-in service models. They do not need an OpenAI deployment and do not depend on a successful token probe to appear in the catalog. Scrydon uses Microsoft's Speech region table to narrow the choices for each connection. North Europe supports MAI transcription; Sweden Central and West Europe support standard live Speech and fast transcription. Connections without a confirmed region do not offer their built-in Speech models in Models & defaults. Set Azure Region to the resource's actual region, then reopen the dropdown to refresh discovery. Connection names such as Default or Sweden Central are labels, not evidence of regional support. Discovered deployments remain separate choices. Regional support does not verify credentials, quota, or successful execution on your resource.

MAI Transcribe 2 enables native speaker diarization by default; API callers can explicitly disable it with diarization: false. Live recording preserves the speaker turns returned for each utterance. These batch speaker labels are scoped to one request: the same label in a later utterance does not prove it is the same person. Automatic identity continuity across the meeting still requires the on-device speaker timeline or a provider with session-wide diarization.

Open a capability dropdown in Models & defaults to refresh its choices across eligible connections. All environments offers connections configured for all environments. A specific environment offers its own connections plus connections configured for all environments, subject to your organization's access policy. Each choice identifies the model and the exact connection; the same model can appear under several regional connections. Deployments are still discovered separately for each connection and combined with its built-in catalog.

Transcription cost example

Checked on 8 September 2026: Microsoft's MAI Transcribe 2 launch announcement lists a promotional rate of USD 0.10 per audio hour through the end of 2026. Confirm the actual rate and billing rules for your Azure agreement and resource; this is an estimate, not a quote or a Scrydon subscription price.

For a two-hour Process Flow recording using MAI Transcribe 2 for both live and final transcription, assuming two hours of live audio, usable timestamps, and no retries:

If live speech detection sends less audio, the live charge decreases. If live transcription is not run, the final pass alone is about USD 0.21 under these assumptions. Retries, timestamp fallback requests, different models, or a changed promotional rate alter the estimate. Storage, network, hosting, taxes, and LLM summarization are excluded. Browser speaker tracking adds no separate cloud inference charge.