Documentation

Azure AI Foundry

Which Foundry is this? This provider targets the legacy AI Foundry / Azure Machine Learning Hub workspace — an Microsoft.MachineLearningServices/workspaces resource. If your Foundry resource in the Azure portal is listed under Microsoft.CognitiveServices/accounts (kind AIServices), use the Azure AI Foundry Project provider instead.

Azure AI Foundry (this provider) Azure AI Foundry Project
Azure resource provider Microsoft.MachineLearningServices/workspaces Microsoft.CognitiveServices/accounts (kind AIServices)
Concept AML Hub / Workspace Foundry Account + Project
Job types AI Foundry Pipeline Job, Command Job, Sweep Job Foundry Agent Run, Evaluation Run, Model Deployment Inference
Required role AzureML Data Scientist on the workspace Foundry User + Cognitive Services OpenAI User + Reader on the account
Control-plane API 2026-07-01 (MachineLearningServices) 2024-10-01 (CognitiveServices)
Icon Purple brain/circuit tile Blue hexagonal flask

Required attributes

  • Subscription Id — the Azure subscription containing the AI Foundry workspace.
  • Resource Group Name — the resource group containing the workspace.
  • AI Foundry Workspace Name — the name of the Azure AI Foundry workspace.

Authentication methods

  • Polysync Service Principal ⭐ (recommended) — no extra attributes; grant the Polysync Enterprise Application the AzureML Data Scientist role on the workspace. This is the standard method for all Polysync tenants.
  • Service Principal — Tenant Id, Client Id, Client Secret. Use when you need a dedicated SPN per workspace. Rotate the secret regularly.
  • Certificate — Tenant Id, Client Id, Certificate (upload a PFX or PEM), optional Certificate Password.

Granting Polysync access

Polysync Service Principal stores no credentials — it authenticates as the multi-tenant Polysync enterprise application. The Setup editor shows that application's (client) ID beside the auth-method hint: grant that application the role below on the resource.

  • If it is not listed under Enterprise applications in your Entra tenant, an administrator must consent to the Polysync application once. This happens automatically for a subscription bought through Azure Marketplace.
  • On a subscription that has never used this resource type, register its provider first — az provider register --namespace <provider-namespace> --wait.

Permissions checklist

  • The identity needs AzureML Data Scientist on the workspace — nothing at resource-group or subscription scope. It covers everything Polysync calls: listing, reading, submitting and cancelling jobs, reading the workspace (for its MLflow endpoint), and reading run metrics, tags and run history for output read-back. Contributor is not required (live-validated 2026-10-02).
  • Networking. Polysync calls the workspace's data plane (*.api.azureml.ms). For a firewalled workspace, allow-list Polysync's outbound address (shown in the Setup editor). A workspace restricted to a private endpoint cannot be reached — see Networking and firewalls on the Platform page.

How Polysync runs Azure ML jobs

Azure ML has no catalogue of job definitions — every job is a run. Polysync therefore imports an existing, preferably successful Command, Pipeline or Sweep job as a template. Each execution submits a clone of it: same code, environment, resources, search space or pipeline graph and experiment. Only the task's input values and the optional job settings (compute, environment, command, objective) are replaced.

  • Get Jobs lists the workspace's jobs across every page. Runs Polysync submitted are tagged polysync_template and are never offered for import. AutoML and Spark jobs are not listed because Polysync cannot run them yet.
  • Outputs. Azure ML jobs have no literal outputs. Polysync reads back the run's MLflow metrics and tags (a pipeline's step runs, or a sweep's best trial) and the URI of any data output with an explicit path. These are declared as Output parameters at import, from what the template's own run produced. Azure ML indexes metrics shortly after a run completes, so Polysync re-reads for up to 30 seconds while a declared Output parameter is still missing.

Supported jobs

Azure AI Foundry exposes three Polysync job types. See each dedicated page for parameter handling, output binding, execution flow, monitor URL, and troubleshooting: