Explanation:
credential = DefaultAzureCredential
response = openai_client.responses.create
The correct authentication class is DefaultAzureCredential because the requirement is Microsoft Entra-based authentication, and this credential supports managed identity in hosted Azure environments. The Microsoft Foundry quickstart for Python shows the project client being created with AIProjectClient (endpoint=PROJECT_ENDPOINT, credential=DefaultAzureCredential()), which enables the Foundry SDK to authenticate without using API keys or embedded secrets. The same guidance shows creating an OpenAI- compatible client from the project by calling project.get_openai_client().
The correct Responses API method is create because the application must send a new prompt to the deployed model and receive generated output. Microsoft's Foundry quickstart demonstrates the exact pattern: response
= openai.responses.create(model= " gpt-5-mini " , input= " ... " ), followed by reading response.output_text.
The retrieve operation is used to fetch an existing response, not submit a new inference request, and compact is not the correct method for generating a model response. AzureKeyCredential would violate the Microsoft Entra managed identity requirement, while ClientSecretCredential uses an application secret rather than managed identity. Reference topics: Microsoft Foundry SDK, AIProjectClient, Microsoft Entra authentication, DefaultAzureCredential, and Azure OpenAI Responses API.

Prompt Shields detects prompt injection attacks, including indirect injection where malicious instructions are embedded in content the model processes, such as text hidden inside an image.

The correct approach is to create and reuse a conversation by storing the conversation's ID and supplying that ID on subsequent requests . In Microsoft Foundry Agent Service, conversations are durable objects with unique identifiers that can be reused across sessions. The official runtime guidance states that conversations store items, including messages, tool calls, tool outputs, and other data, and are intended for multi-turn continuity, cross-session continuity, and inspection of what happened over time. This directly satisfies the requirement to resume the same support case days later with the full historical context.
Persisting only the final model response is insufficient because it loses the full interaction chain, especially tool calls and tool outputs that may be essential to case state. Memory summarization is also not the best fit because the requirement asks for the complete history, not a compressed representation that may omit details.
Reusing the conversation ID allows Foundry to maintain the conversation server-side so the next turn can reuse prior context without the client manually rebuilding prompts. Reference topics: Foundry Agent Service runtime components, conversations, conversation items, multi-turn continuity, cross-session continuity, and tool output history.

To minimize development effort when using the Azure AI Foundry SDK, you should configure the AIProjectClient object using the project connection string.
This approach is highly efficient because the connection string is a single string that encapsulates multiple required parameters--such as the subscription ID, resource group name, and project name--allowing the client to initialize and authenticate with minimal code.
How to Configure the AIProjectClient
1. Retrieve Connection String: In the Azure AI Foundry portal, go to the Overview page of your project. Under Project details, copy the Project connection string.
2. Initialize the Client: Use the from_connection_string method (or equivalent initialization depending on SDK version) to create the client.
Minimal Code Example (Python)
import os
from azure.ai.projects import AIProjectClient
from azure.identity import DefaultAzureCredential
# Load the connection string from an environment variable for security
conn_str = os.environ["PROJECT_CONNECTION_STRING"]
# Load the connection string from an environment variable for security
conn_str = os.environ["PROJECT_CONNECTION_STRING"]
Reference:
https://workshop.aifoundry.app/1-introduction/3-quick_start

Explanation:
Guardrails: Select User input, Output, Tool response, and Tool call and set Action to Block.
Storage access: A system-assigned managed identity that is assigned the Storage Blob Data Contributor role The guardrail must be applied to User input, Output, Tool response, and Tool call with the action set to Block . Microsoft Foundry guardrails support four intervention points: user input, tool call, tool response, and output. This scenario includes user-provided screenshots, a ticketing tool that uploads images and returns blob URLs, and final agent responses. Applying blocking controls at all four points ensures harmful image-related content is inspected throughout the agent run and prevented from continuing or being returned to the user.
Microsoft's guardrails guidance also states that tool call and tool response controls are specifically required when harmful content can pass through agent tools.
For storage, configure the Azure AI Content Safety resource with a system-assigned managed identity and grant it Storage Blob Data Contributor on the storage account or container. The Content Safety image moderation quickstart states that images can be supplied by blob storage URL and that the Content Safety resource must be given storage access by enabling its system-assigned managed identity and assigning Storage Blob Data Contributor or Owner; Contributor is the least-privileged valid option shown. Reference topics: Foundry guardrails, agent intervention points, image moderation, managed identity, and Azure Storage RBAC.