Azure AI Foundry

​

Deploy the model

​

Configure the integration

1. Go to Settings > AI providers.
2. Add a new organization or project provider and choose Azure.
3. Choose your authentication method:
   • API Key: Paste your Azure API key.
   • Entra API (Azure AD): Provide your Entra ID credentials to authenticate via Azure Active Directory.
   • Microsoft Entra Workload Identity: Exchange a Braintrust-signed OIDC token for a Microsoft Entra access token, instead of storing a long-lived Azure credential in Braintrust.
   API keys are stored as one-way cryptographic hashes, never in plaintext.
   Microsoft Entra Workload Identity is available only for organization-level providers on Braintrust-hosted organizations with the Braintrust gateway enabled. Project-level providers and self-hosted deployments must use API Key or Entra API (Azure AD) authentication.
4. If you chose Microsoft Entra Workload Identity, configure Microsoft Entra ID and Braintrust with the matching setup values:
   1. Create or choose an app registration in Microsoft Entra ID.
      • Copy the Application (client) ID and paste it into the Client ID field in Braintrust.
      • Copy the Directory (tenant) ID and paste it into the Tenant ID field in Braintrust.
   2. Add a flexible federated credential to the app registration. Go to Manage > Certificates & secrets > Federated credentials, add an Other issuer credential:
      • Set Issuer to the issuer shown in Braintrust.
      • Set Type to Explicit subject identifier.
      • Set Value to the subject shown in Braintrust.
      • Set Audience to the audience shown in Braintrust.
   3. Grant Azure OpenAI access to the app registration service principal. On the Azure OpenAI or Azure AI services resource behind this provider’s API base URL, add the Cognitive Services OpenAI User role assignment. You can assign the role on the resource or on the resource group that contains it.
   4. Back in Braintrust, enter additional values that identify your Microsoft Entra setup:
      • Scope: The OAuth scope requested from Microsoft Entra. For Azure OpenAI, use https://cognitiveservices.azure.com/.default.
      • Subject suffix: A stable suffix for this Azure connection. It must match the final part of the federated credential subject.
5. Set API base URL to the base URL of your project endpoint in Azure. For example, for the project endpoint https://john-3396-resource.services.ai.azure.com/api/projects/john-3396, you’d use https://john-3396-resource.services.ai.azure.com.
6. Depending on the model you deployed, configure model details:
   • OpenAI models: Braintrust’s built-in Azure registry includes OpenAI models (such as the GPT series). To access these models through Braintrust, enable Include the default registry of Azure models.
   • Other models: If you deployed any non-OpenAI model from the Azure model catalog, such as Grok, Claude, or DeepSeek, configure the model details:
     • Set Models to the exact deployment name in Azure.
     • Click and select the Format based on the API the model supports:

       API type	Braintrust format
       Chat completion	OpenAI
       Responses	OpenAI
       Messages	Anthropic

     For full configuration options, see Custom providers.
     Non-OpenAI models appear in the Braintrust model selector but cannot be used directly from the UI. Use them via the Braintrust API or SDK instead.
7. Click Save.

​

Additional resources

• Azure AI Foundry
• Azure model catalog
• Deploy models in Azure AI Foundry
• Azure OpenAI vs. Microsoft Foundry models