Provider authentication

​

Configure Azure Foundry

​

Use an Entra ID service principal

1. Deploy a model on a Foundry resource, or use an existing deployment. Record the resource name and the deployment name. Use the deployment name as the model value in requests.
2. Register an application in Microsoft Entra ID, or use an existing app registration. Record its directory (tenant) ID and application (client) ID.
3. Add a client secret to the app registration. Record the secret’s value, not its ID.
4. On the Foundry resource, not a project inside it, assign the app’s service principal the Foundry User role (formerly Azure AI User). The generic Owner, Contributor, and Reader roles do not grant permission to call models.
5. In LangSmith, select the workspace that routes Azure requests. Go to Settings > Integrations > Provider Secrets and add each of the following as a custom secret:

   Secret name	Value
   AZURE_FOUNDRY_RESOURCE_NAME	Azure resource name.
   AZURE_TENANT_ID	Directory (tenant) ID.
   AZURE_CLIENT_ID	Application (client) ID.
   AZURE_CLIENT_SECRET	Client secret value.

   Select Custom in the provider selector to enter each secret’s name and value. The Azure Foundry provider form only exposes API key authentication.
6. Remove AZURE_FOUNDRY_API_KEY from the workspace if it is set. An API key takes precedence over service principal credentials, even when the resource disables API key authentication.

​

Verify the setup

curl https://gateway.smith.langchain.com/azure/v1/chat/completions \
  --header "Authorization: Bearer $LANGSMITH_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "model": "<deployment-name>",
    "messages": [{"role": "user", "content": "Say hello"}]
  }'

​

See also

• Admin setup: add provider secrets and grant gateway access.
• Direct model access: call provider APIs through provider-specific gateway paths.
• Self-hosted LLM Gateway: enable the gateway on self-hosted LangSmith.