Foundry User is the least-privilege built-in role for Microsoft Foundry projects and grants the data- plane actions needed to call a project endpoint, run inference, and use agents. Microsoft recommends assigning the project's managed identity the Foundry User role on the Foundry resource.

The most appropriate solution is Azure Content Understanding in Foundry Tools.
The Azure Content Understanding service natively combines advanced Optical Character Recognition (OCR), deep layout analysis, and pre-built generative capabilities. It handles varied document structures, multi-page tables, and template-generalizing field extraction without requiring custom machine learning model training. It operates as a low-administration, out-of-the- box solution perfectly aligned with document intelligence needs.
Incorrect:
[Not A]
Azure Language in Foundry Tools: Azure AI Language focuses primarily on unstructured text analytics, sentiment analysis, text summarization, and conversational capabilities. It lacks the built-in document layout analysis, table parsing, and visual OCR capabilities necessary to process complex scanned PDF invoice structures.
[Not C]
Azure Machine Learning model: Building, training, deploying, and managing a custom model in Azure Machine Learning requires significant data science expertise. This approach introduces high administrative overhead, complex infrastructure management, and manual pipeline maintenance, which violates the requirement for low administration.
Reference:
https://learn.microsoft.com/en-us/answers/questions/5706482/azure-document-intelligence-and-content-understand

Explanation:
scope = " {{userId}} "
tools = [memory_tool]
The correct scope value is {{userId}} because the requirement is per-authenticated-user memory isolation without the client application manually generating user identifiers. In Microsoft Foundry Agent Service memory, the scope parameter partitions memory items inside the memory store. The official guidance states that when the memory search tool is attached to an agent, setting scope to the user identity template enables per-user memory isolation; the service resolves the end-user identity from the request header when provided, or falls back to the Microsoft Entra tenant ID and object ID of the caller. This matches the requirement to isolate stored preferences by authenticated user automatically.
The tools property must be [memory_tool] because the MemorySearchTool instance is created earlier and must be attached to the PromptAgentDefinition. Foundry guidance shows the memory search tool being passed in the agent definition as tools=[tool] , allowing the agent to read from and write to the configured memory store during conversations.
" session " and {{conversationId}} would limit continuity to a session or conversation instead of enabling long-term recall across separate conversations. [mem_store_name] is a list containing the store name, not a tool definition. Reference topics: Foundry Agent Service memory, memory stores, memory search tools, scope, and per-user isolation.

To classify user input into separate categories that are dynamic and defined at the time of inference, Azure OpenAI text classification is the best option. OpenAI models such as GPT can dynamically classify text into categories based on context and user-defined instructions. Since the categories need to be flexible and determined at inference time, OpenAI's natural language understanding capabilities are well-suited for this task.