--- title: Locking Down the AI Office: Identity, Private Networks,... description: Securing a Microsoft Foundry AI deployment for enterprise approval requires three layers of protection: Entra Agent ID, private VNet isolation, and runtime... canonical: https://daily.dev/posts/locking-down-the-ai-office-identity-private-networks-and-guardrails-in-foundry-zpljljtxg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Locking Down the AI Office: Identity, Private Networks, and Guardrails in Foundry | daily.dev og:description: Securing a Microsoft Foundry AI deployment for enterprise approval requires three layers of protection: Entra Agent ID, private VNet isolation, and runtime... og:url: https://daily.dev/posts/locking-down-the-ai-office-identity-private-networks-and-guardrails-in-foundry-zpljljtxg og:image: https://api.daily.dev/og/posts/zpLJljTXG.png og:image:alt: Locking Down the AI Office: Identity, Private Networks, and Guardrails in Foundry og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Locking Down the AI Office: Identity, Private Networks, and Guardrails in Foundry **[C\# Corner](https://daily.dev/sources/csharpcorner)** · 2 min read · 1 upvotes · 0 comments ## Summary Securing a Microsoft Foundry AI deployment for enterprise approval requires three layers of protection: Entra Agent ID, private VNet isolation, and runtime guardrails. API keys should be disabled in production using disableLocalAuth: true, replaced by Microsoft Entra ID authentication. Human roles split into Foundry Owner, Foundry Project Manager, and Foundry User, while every deployed agent gets its own Managed Identity separate from its creator, scoped to specific permissions like Storage Blob Data Reader. A Standard Setup routes traffic through Private Endpoints and VNet Injection so chats, PDFs, and search queries never cross the public internet. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I disable API key authentication in Microsoft Foundry and use Entra ID instead? Set disableLocalAuth: true in Microsoft Foundry to disable API keys in production. Authentication then runs through Microsoft Entra ID at two levels: human and developer roles (Foundry Owner, Foundry Project Manager, Foundry User) via unified Foundry RBAC, and a separate Entra Agent ID managed identity assigned to each deployed agent itself. _daily.dev surfaces practical guidance like this for teams locking down AI agent authentication._ ### What roles are available in Microsoft Foundry's unified RBAC system? Microsoft Foundry's unified RBAC defines three human and developer roles: Foundry Owner or Foundry Account Owner, with full control over resources, networks, and billing; Foundry Project Manager, who can create projects, deploy Hosted Agents, and assign permissions to agent identities; and Foundry User, a least-privilege data-plane role for creating prompt agents, managing toolboxes, and running inference calls. _Developers mapping least-privilege access for AI platforms can track role changes like these on daily.dev._ ### How do you keep AI agent traffic off the public internet in a production Azure AI setup? A Standard Setup in Microsoft Foundry uses Private Endpoints and VNet Injection so customer chats, uploaded PDFs, and search queries never cross the public internet. The agent container subnet connects through private endpoints to Cosmos DB, AI Search, and Blob Storage, while an outbound firewall allows only mcr.microsoft.com and Entra Login. _Teams hardening AI deployments against public exposure can follow network isolation patterns like this via daily.dev._ ## Similar posts on daily.dev - [Microsoft Proposes Better Identity, Guardrails for AI Agents](https://daily.dev/posts/microsoft-proposes-better-identity-guardrails-for-ai-agents-u5glsz7ig) · Dark Reading · 0 upvotes · 0 comments - [Building User-Delegated AI Tools with Microsoft Foundry Toolboxes](https://daily.dev/posts/building-user-delegated-ai-tools-with-microsoft-foundry-toolboxes-wymmguzvt) · C\# Corner · 0 upvotes · 0 comments - [Foundry hosted agent isolation with Microsoft Agent Framework](https://daily.dev/posts/foundry-hosted-agent-isolation-with-microsoft-agent-framework-ot6je35xm) · DevBlogs · 1 upvotes · 0 comments - [Microsoft Foundry Now Builds, Deploys, and Governs AI Agents End to End.](https://daily.dev/posts/microsoft-foundry-now-builds-deploys-and-governs-ai-agents-end-to-end--it7nmfneb) · ITNEXT · 1 upvotes · 0 comments - [How to secure AI agent identities in the cloud with Tenable](https://daily.dev/posts/how-to-secure-ai-agent-identities-in-the-cloud-with-tenable-vamwuqoha) · Tenable Blog · 2 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#authentication](https://daily.dev/tags/authentication), [#azure](https://daily.dev/tags/azure), [#microsoft-foundry](https://daily.dev/tags/microsoft-foundry) [View this post on daily.dev](https://daily.dev/posts/locking-down-the-ai-office-identity-private-networks-and-guardrails-in-foundry-zpljljtxg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Locking Down the AI Office: Identity, Private Networks, and Guardrails in Foundry","url":"https://daily.dev/posts/locking-down-the-ai-office-identity-private-networks-and-guardrails-in-foundry-zpljljtxg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/locking-down-the-ai-office-identity-private-networks-and-guardrails-in-foundry-zpljljtxg"},"datePublished":"2026-10-26T03:46:57.740Z","dateModified":"2026-10-29T02:14:10.863Z","description":"Securing a Microsoft Foundry AI deployment for enterprise approval requires three layers of protection: Entra Agent ID, private VNet isolation, and runtime...","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"C# Corner","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"C# Corner","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ada2d584df6241748fc4e71878dc70a3","url":"https://daily.dev/sources/csharpcorner"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/locking-down-the-ai-office-identity-private-networks-and-guardrails-in-foundry-zpljljtxg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,authentication,azure,microsoft-foundry","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"C# Corner","item":"https://daily.dev/sources/csharpcorner"},{"@type":"ListItem","position":3,"name":"Locking Down the AI Office: Identity, Private Networks, and Guardrails in Foundry"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/locking-down-the-ai-office-identity-private-networks-and-guardrails-in-foundry-zpljljtxg#faq","mainEntity":[{"@type":"Question","name":"How do I disable API key authentication in Microsoft Foundry and use Entra ID instead?","acceptedAnswer":{"@type":"Answer","text":"Set disableLocalAuth: true in Microsoft Foundry to disable API keys in production. Authentication then runs through Microsoft Entra ID at two levels: human and developer roles (Foundry Owner, Foundry Project Manager, Foundry User) via unified Foundry RBAC, and a separate Entra Agent ID managed identity assigned to each deployed agent itself. daily.dev surfaces practical guidance like this for teams locking down AI agent authentication."}},{"@type":"Question","name":"What roles are available in Microsoft Foundry's unified RBAC system?","acceptedAnswer":{"@type":"Answer","text":"Microsoft Foundry's unified RBAC defines three human and developer roles: Foundry Owner or Foundry Account Owner, with full control over resources, networks, and billing; Foundry Project Manager, who can create projects, deploy Hosted Agents, and assign permissions to agent identities; and Foundry User, a least-privilege data-plane role for creating prompt agents, managing toolboxes, and running inference calls. Developers mapping least-privilege access for AI platforms can track role changes like these on daily.dev."}},{"@type":"Question","name":"How do you keep AI agent traffic off the public internet in a production Azure AI setup?","acceptedAnswer":{"@type":"Answer","text":"A Standard Setup in Microsoft Foundry uses Private Endpoints and VNet Injection so customer chats, uploaded PDFs, and search queries never cross the public internet. The agent container subnet connects through private endpoints to Cosmos DB, AI Search, and Blob Storage, while an outbound firewall allows only mcr.microsoft.com and Entra Login. Teams hardening AI deployments against public exposure can follow network isolation patterns like this via daily.dev."}}]} ```