diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/README.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/README.md
index 7d85e0d55..6d9e8e709 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/README.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/README.md
@@ -10,7 +10,7 @@ Fraud moves faster than manual review. Analysts piecing together transactions, c
An **agentic fraud intelligence system** continuously investigates operations and turns raw activity into evidence-backed decisions. It retrieves historical transaction evidence from **Azure Cosmos DB through an MCP server**, reasons over global, internal, and country-specific AML policies with **Foundry IQ agentic retrieval**, evaluates the rules that apply to both the origin and destination bank account countries, and produces audit-ready investigation reports and operational alerts.
-Unlike earlier rule-based systems limited to rudimentary patterns, agentic systems reason through the *why* behind a flag. The complete workflow runs as a **hosted agent in Microsoft Foundry**, uses the **Microsoft Agent Framework** for orchestration, routes models and MCP servers through the new **AI Gateway tier (preview)**, and emits end-to-end telemetry to **Application Insights and Azure Managed Grafana**.
+Unlike earlier rule-based systems limited to rudimentary patterns, agentic systems reason through the *why* behind a flag. The complete workflow runs as a **hosted agent in Microsoft Foundry**, uses the **Microsoft Agent Framework** for orchestration, routes MCP servers through the new **AI Gateway tier (preview)**, and emits end-to-end telemetry to **Application Insights and Azure Managed Grafana**.
While Fraud Intelligence is highly relevant for FSI — where fraud, money laundering, and insider trading draw constant regulatory scrutiny — the hack extends cleanly to any regulated industry. With a diverse audience, the goal is to broaden attendees' thinking: they leave with a **modern, reusable, Python-based component set** they can apply to their own domains.
@@ -22,7 +22,7 @@ A transaction enters the system. The fraud intelligence workflow must:
2. **Regulatory Assessment Agent** — use **Foundry IQ agentic retrieval** to apply global AML guidance, internal policies, and the regional regulations relevant to the origin and destination bank account countries.
3. **AML Report Agent** — transform the enriched evidence and regulatory assessment into a professional, audit-ready AML investigation report.
4. **Alert Manager Agent** — run in parallel with the AML Report Agent and use the Fraud Alert Manager MCP to create an operational alert when the regulatory status requires one.
-5. **Fraud Intelligence Orchestration** — coordinate the agents with the **Microsoft Agent Framework**, deploy the workflow as a hosted agent in Microsoft Foundry, govern model and MCP traffic through **AI Gateway (preview)**, and emit traces and business metrics through OTLP.
+5. **Fraud Intelligence Orchestration** — coordinate the agents with the **Microsoft Agent Framework**, deploy the workflow as a hosted agent in Microsoft Foundry, govern MCP traffic through **AI Gateway (preview)**, and emit traces and business metrics through OTLP.
The image below illustrates the conceptual scenario and agent roles:
@@ -47,7 +47,7 @@ flowchart LR
## Architecture
-The hackathon builds a **Python-based, multi-agent Fraud Intelligence system**. Individual Microsoft Foundry agents are composed into a hosted workflow with the Microsoft Agent Framework. Foundry IQ supplies agentic retrieval over AML knowledge, while MCP servers provide access to financial evidence and alert-management actions. The AI Gateway tier (preview) provides a common control plane for model and MCP traffic.
+The hackathon builds a **Python-based, multi-agent Fraud Intelligence system**. Individual Microsoft Foundry agents are composed into a hosted workflow with the Microsoft Agent Framework. Foundry IQ supplies agentic retrieval over AML knowledge, while MCP servers provide access to financial evidence and alert-management actions. The AI Gateway tier (preview) provides a common control plane for MCP traffic.
```mermaid
flowchart TB
@@ -65,7 +65,6 @@ flowchart TB
end
subgraph Gateway["AI Gateway tier (preview)"]
- MODELS["Model gateway
Routing + policies"]
MCPPROXY["Proxied MCP
Financial Evidence MCP"]
MCPAPI["MCP generated from API
Fraud Alert Manager"]
end
@@ -74,7 +73,6 @@ flowchart TB
FINMCP --> MCPPROXY
ALERTAPI["Fraud Alert Manager API"] --> MCPAPI
IQ --> AGENTS
- ORCH --> MODELS
AGENTS --> MCPPROXY
AGENTS --> MCPAPI
@@ -100,7 +98,7 @@ By participating in this hackathon, you will learn how to:
- Build and integrate an **MCP server backed by Azure Cosmos DB** with a Microsoft Foundry agent
- Configure **Foundry IQ** with global, internal, and regional AML sources and use agentic retrieval for country-aware regulatory assessment
- Compose remote agents with the **Microsoft Agent Framework** and deploy the orchestration as a **hosted agent in Microsoft Foundry**
-- Configure the **AI Gateway tier (preview)** for model and MCP traffic, including proxying an existing MCP and creating an MCP from an existing API
+- Configure the **AI Gateway tier (preview)** for MCP traffic, including proxying an existing MCP and creating an MCP from an existing API
- Add end-to-end **OTLP tracing** and business metrics with **Application Insights**, then visualize operational and business outcomes in **Azure Managed Grafana**
---
@@ -166,7 +164,7 @@ Each challenge follows a consistent structure:
| **2** | [Build the Evidence Enrichment Agent](./challenges/challenge-02.md) | Build a **Financial Evidence MCP** over Azure Cosmos DB, integrate it with the **Evidence Enrichment Agent**, and validate evidence-backed transaction enrichment | 30 min |
| **3** | [Build the Regulatory Assessment Agent](./challenges/challenge-03.md) | Configure **Foundry IQ** with global, internal, and regional AML sources, then use agentic retrieval to assess rules for both bank account countries | 45 min |
| **4** | [Build and Orchestrate the Investigation](./challenges/challenge-04.md) | Build the **AML Report Agent**, compose the first three agents with the **Microsoft Agent Framework**, and deploy the orchestration as a Foundry hosted agent | 45 min |
-| **5** | [Govern Models and MCP Servers](./challenges/challenge-05.md) | Introduce the **AI Gateway tier (preview)**, configure model access, proxy the Financial Evidence MCP, create a new MCP from the Fraud Alert Manager API, and add the parallel **Alert Manager Agent** | 45 min |
+| **5** | [Govern MCP Servers](./challenges/challenge-05.md) | Introduce the **AI Gateway tier (preview)**, proxy the Financial Evidence MCP, create a new MCP from the Fraud Alert Manager API, and add the parallel **Alert Manager Agent** | 45 min |
| **6** | [Observe Fraud Intelligence](./challenges/challenge-06.md) | Add end-to-end **OTLP tracing**, publish technical and business metrics to **Application Insights**, and build a **Grafana** dashboard for business decision makers | 30 min |
> **Tip:** While it is possible to rush through the challenges, we encourage you to pause and reflect. Consider how each pattern relates to your own context: what business processes in your environment could benefit from coordinated AI agents? How might agents help orchestrate decisions across teams and systems?
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-01.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-01.md
index 1e3f6133b..b75150af1 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-01.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-01.md
@@ -20,15 +20,15 @@ Open the [Azure portal](https://portal.azure.com) and sign in with the credentia
When prompted to choose an account, select **Use another account** and enter the credentials provided. Do not use your personal or work account.
-
+
In the Azure portal, select **Resource groups** from the navigation menu.
-
+
Open the resource group assigned to you and confirm that its resources have been deployed successfully.
-
+
Verify that you can access the resources used in the later challenges, including the Microsoft Foundry project, model deployments, Azure Cosmos DB account, and Application Insights resource.
@@ -38,41 +38,41 @@ Open [GitHub](https://github.com) and sign in with the credentials provided in y
When prompted to choose an account, select **Use another account**. Do not use your personal or work account.
-
+
Select **Sign in with your identity provider**, then use the assigned lab account to authenticate.
Open the GitHub organization assigned to your lab account.
-
+
Select the assigned organization, then open the `microhack` repository. You need to fork the repository before you can create a Codespace. To fork the repository, click the **Fork** button in the top-right corner of the repository page and follow the prompts:
-
+
Use a unique name for the repository name to avoid conflicts with other forks. For example, you can append your lab username to the repository name (e.g., `microhack-labuser-0001`):
-
+
Finally, you should see your forked repository with the unique name you provided and all files and folders from the original repository:
-
+
### 3. Create the development environment
From the repository page, select **Code**, then open the **Codespaces** tab. Select the `...` menu and choose **New with options**.
-
+
For **Dev container configuration**, select **Azure / AI / Fraud Intelligence**, then select **Create codespace**:
-
+
GitHub opens the Codespace in a new browser tab. Wait for the container setup to finish, then confirm that the repository files are visible in the Explorer and that the integrated terminal opens without errors.
> Important: When the Codespace finishes setting up, you are asked to open the full repository, select **Never**.
-
+
You should have a terminal ready to use, otherwise open a terminal in the Codespace (Terminal > New Terminal). Then run the following command to verify that Azure CLI is installed:
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-02.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-02.md
index a8a22952a..b387abacf 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-02.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-02.md
@@ -103,7 +103,7 @@ echo "financialEvidenceMcpEndpoint=https://$functionAppName.azurewebsites.net/ru
In the Azure portal, open the Function App and select **Functions** > **App keys** > **System keys**.
-
+
Copy the value of the `mcp_extension` key and add it to `hackenv`:
@@ -123,7 +123,7 @@ The agent will use the Financial Evidence MCP to retrieve evidence from Cosmos D
In the Azure portal, open your **Microsoft Foundry** resource and select **Go to Foundry Portal**. Sign in using your Hackbox credentials.
-
+
#### Explore the Foundry project
@@ -133,7 +133,7 @@ Next, connect the Application Insights resource deployed in your environment to
Open **Manage** and select **Project details** from the left menu. Select **Connected resources**, then **Add connection**.
-
+
Select **Application Insights**, then select **Continue**. Choose the Application Insights resource deployed for your lab, leave **API key** as the authentication method, and select **Connect**.
@@ -141,13 +141,13 @@ Select **Application Insights**, then select **Continue**. Choose the Applicatio
Under **Build**, open **Agents**, select **New agent**, then select **Build an agent**.
-
+
Name the agent `EvidenceEnrichmentAgent`.
The new agent opens with a blank configuration:
-
+
The chat model is selected automatically because it is the only deployed model that can power this agent. The embedding deployment is not a chat model.
@@ -161,7 +161,7 @@ Select **Add** > **Add tools**, open the **Custom** tab, select **Model Context
The MCP configuration form opens:
-
+
Configure these values:
@@ -175,11 +175,11 @@ Select **Connect**. Foundry returns to the agent page and displays the new MCP t
Open the MCP tool's `...` menu and select **Configure**:
-
+
Then enable **Always auto-approve all tools**.
-
+
This setting allows the agent to use the MCP tools without requesting approval for every call.
@@ -189,7 +189,7 @@ Select **Save**. Foundry creates a new version of the agent.
Open the **Playground** to test the agent.
-
+
Submit this transaction:
@@ -211,7 +211,7 @@ The response should be a JSON object that contains the original transaction enri
For this example, the agent should find three pieces of evidence. To inspect the trace, scroll to the bottom and select **Traces**. It shows the agent calling the MCP tools according to its instructions and using the returned evidence to enrich the transaction.
-
+
Select any **Execute tool** span to inspect the data returned by the MCP.
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-03.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-03.md
index 5a003fdef..7a05bf089 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-03.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-03.md
@@ -36,7 +36,7 @@ Build the Foundry IQ knowledge base that will support the Regulatory Assessment
In **Foundry**, open the **Build** section. Then select **Knowledge** in the left navigation pane to open the main interface for managing your knowledge base:
-
+
To learn more about how Foundry IQ works, watch the video available on this page.
@@ -44,7 +44,7 @@ At the bottom of the page, select **Create new resource** to start building your
Use the defaults, accept the acknowledgment, and proceed to create the new knowledge base resource:
-
+
Under the hood, a new **Azure AI Search** resource is being created to support the knowledge base. This resource will handle the indexing and retrieval of policy documents, ensuring that the Regulatory Assessment Agent can access the necessary information efficiently.
@@ -57,11 +57,11 @@ After the resource is created, select **Create a knowledge base** and set the fo
- **Output mode**: Extractive data
- **Retrieval instructions**: You have to always retrieve first the global policies and rules.
-
+
Then select **Add sources** and review the available source types for your knowledge base.
-
+
Stop here for now. The next section creates the storage account and containers for the policy documents.
@@ -111,13 +111,13 @@ az storage blob upload-batch --account-name "$foundryAccountName" --destination
To verify that the policy documents were uploaded successfully, open the **Storage Account** in the Azure portal and check the contents of each container:
-
+
Return to the **Foundry IQ** interface to continue adding and managing your policy sources. You can now add the policy sources from the Azure Blob storage containers you created.
Select **Add Sources**, then choose **Azure Blob Storage** as the source type.
-
+
For each container, fill in the required details and click **Create** to link it as a policy source.
@@ -131,7 +131,7 @@ The following example shows how to link the `global` container as a policy sourc
- **Embedding model**: text-embedding-3-large
- **Chat completion model**: Not needed
-
+
The **Status** of the policy source displays **Creating** while it is being linked. During this process, **AI Search** begins indexing the policy documents in the container. To monitor indexing, open the **Search Service** resource and review the following areas:
- **Search management**: go into **Indexes** and **Indexers** to monitor the indexing process.
@@ -156,11 +156,11 @@ Relevant steps you should not miss include:
Next, add **Knowledge** by selecting **Add**, then **Connect to Foundry IQ**:
-
+
Select the **Knowledge Base** you created (`kb-aml`), then select **Connect**:
-
+
Finally, select **Save** to create the new agent and make it ready for use.
@@ -356,7 +356,7 @@ This is an example JSON output from the `EvidenceEnrichmentAgent`:
The output contains the enrichment details from the previous agent and additional context provided by the `global` policy source. Expand all evaluated files by selecting **+NN** at the bottom of the response:
-
+
Confirm that all files come from the `global` policy source by checking for `global` in each path.
@@ -402,11 +402,11 @@ You do not need to modify the agent. The **Knowledge Base** provides a centraliz
Finally, test the agent again and verify that its response and sources reflect the addition of the internal and regional policy sources. For example, if you use the JSON provided earlier, you should now see files for the transaction's origin and destination countries:
-
+
You can also select **Traces** to review the agent's queries and how it retrieved the sources:
-
+
## 🚀 Go Further
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-04.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-04.md
index 3c6305c95..be2dd8160 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-04.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-04.md
@@ -807,7 +807,7 @@ Ensure that the agents are defined correctly in the `main.py` file and that thei
Those names and versions should be set correctly in the `main.py` file:
-
+
### 4. Configure and Run the Orchestration Locally
@@ -833,16 +833,16 @@ The script will set up a virtual environment, install the required dependencies,
In the logs, you should see the initialization of each agent:
-
+
The final trace shows the port on which the agent is listening:
-
+
To test the orchestration locally, select the **Foundry Toolkit** icon in Visual Studio Code and use the **Agent inspector** tool to interact with the running agents:
-
+
Then use the initial JSON request from Challenge 2 to interact with the agents:
```json
@@ -868,17 +868,17 @@ The result should be a Markdown report containing the transaction details and th
Before deploying, ensure that you are signed in to your Azure account. Use the Azure extension in Visual Studio Code for this process. Select the **Azure** icon in the left sidebar to open the extension panel:
-
+
Select **Sign in with new account** and enter the credentials for the Azure account provided for the lab.
Before proceeding, confirm that the correct Azure subscription is selected. Open **View** > **Command Palette**, then search for `Azure: Select Subscriptions` and choose the appropriate subscription:
-
+
Then:
-
+
Return to the **Foundry Toolkit** extension and set your **Foundry project** as the default. Under **My resources**, select **Set Foundry project**, then choose the project used for this lab.
@@ -902,27 +902,27 @@ Follow these steps to deploy your orchestration. Ensure you use:
- **Package mode**: Remote
- **Deploy to**: New agent, as it is the first deployment of this orchestration
-
+
Finally, review the deployment options before confirming the deployment:
-
+
Track the deployment progress in the **Output** panel in Visual Studio Code by selecting **Foundry Toolkit** as the output source:
-
+
Once the deployment is complete, you can run a test using the **Hosted Agent Playground**:
-
+
The new hosted agent also appears under **Agents** in the **Microsoft Foundry** portal, where you can interact with it and test its functionality:
-
+
Test it from the playground as well:
-
+
### 6. Review Traces
@@ -930,11 +930,11 @@ Challenge 6 explores this topic in depth. For now, take a preliminary look at th
In the agent playground, select **Traces**:
-
+
Open the last trace to inspect the detailed execution flow of your orchestration:
-
+
We will explore tracing and metrics in more depth in Challenge 6. For now, this preliminary view is enough to confirm that the three agents ran in the expected sequence.
@@ -952,4 +952,4 @@ Add idempotent case identifiers and checkpointing so a transient failure can res
## 🧠 Conclusion
-You have composed evidence enrichment, regulatory assessment, and reporting into a deployable investigation workflow. Continue to [Challenge 5](challenge-05.md) to govern model and MCP traffic and add operational alerting.
\ No newline at end of file
+You have composed evidence enrichment, regulatory assessment, and reporting into a deployable investigation workflow. Continue to [Challenge 5](challenge-05.md) to govern MCP traffic and add operational alerting.
\ No newline at end of file
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-05.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-05.md
index f14f45d90..8666cee97 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-05.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-05.md
@@ -1,14 +1,14 @@
-# Challenge 5 - Govern Models and MCP Servers
+# Challenge 5 - Govern MCP Servers
[Previous challenge](challenge-04.md) | **[Home](../README.md)** | [Next challenge](challenge-06.md)
## 🎯 Objective
-Introduce the **AI Gateway tier (preview)** for governed model and MCP access, generate an MCP interface from the Fraud Alert Manager API, build an **Alert Manager Agent**, and run alert creation in parallel with report generation.
+Introduce the **AI Gateway tier (preview)** for MCP access, generate an MCP interface from the Fraud Alert Manager API, build an **Alert Manager Agent**, and run alert creation in parallel with report generation.
## 🧭 Context and Background
-The investigation workflow now produces a decision, but a decision that requires action must also reach the operational alert system. AI Gateway provides a shared policy and observability boundary for model and tool traffic.
+The investigation workflow now produces a decision, but a decision that requires action must also reach the operational alert system. AI Gateway provides a shared policy and observability boundary for MCP traffic.
```mermaid
flowchart LR
@@ -19,7 +19,6 @@ flowchart LR
AMCP --> API[Fraud Alert Manager API]
ORCH[Hosted orchestration] --> GATEWAY[AI Gateway tier]
- GATEWAY --> MODEL[Model deployment]
GATEWAY --> FMCP[Financial Evidence MCP]
GATEWAY --> AMCP
```
@@ -36,9 +35,9 @@ source hackenv
### 1. Deploy the AI Gateway
-An **AI Gateway** is a centralized control point for securing and managing interactions among AI agents, models, and external services. It routes requests and responses through a governance layer that can enforce authentication, authorization, rate limiting, and other policies. This helps protect sensitive information, support compliance, and provide observability into AI-driven workflows.
+An **AI Gateway** is a centralized control point for securing and managing MCP traffic between AI agents and external services. It routes requests and responses through a governance layer that can enforce authentication, authorization, rate limiting, and other policies. This helps protect sensitive information, support compliance, and provide observability into AI-driven workflows.
-In Azure, API Management provides the AI Gateway. In this lab, you will deploy a dedicated API Management instance using the preview `AIGateway` SKU, then route model requests and MCP calls through this centralized governance layer.
+In Azure, API Management provides the AI Gateway. In this lab, you will deploy a dedicated API Management instance using the preview `AIGateway` SKU, then route MCP calls through this centralized governance layer.
#### Create the Gateway
@@ -52,143 +51,19 @@ Open the [AI Gateway portal](https://ai.gateway.azure.com/) and sign in with the
- **Resource group**: the existing lab resource group
- **Enable managed identity**
-
+
-### 2. Configure Governed Model Access
-
-#### Import Models
-
-In the AI Gateway left navigation pane, select **Models**, then select **Add Models**.
-
-Models can be imported from several sources and providers. For this lab, select models deployed in **Microsoft Foundry**:
-
-
-
-Choose the lab subscription and Foundry resource, then select **Next**:
-
-
-
-Keep the default settings, or adjust the names if needed, then select **Create** to import the models into the AI Gateway:
-
-
-
-After a successful import, the newly added models appear under **Models**:
-
-
-
-#### Configure Agents to Access Models Through the AI Gateway
-
-After importing the models, configure the agents to access them through the AI Gateway. In **Microsoft Foundry**, open **Manage**, select **Resource details**, and then select **Admin-connected models**:
-
-
-
-Select **Add** to open the connection dialog.
-
-Because the **AI Gateway** SKU is still in preview, select **Other source** instead of **Azure API Management**. Enter the following details:
-
-- **Connection name**: unique identifier, for instance, `aigateway`
-- **Base URL**
- 1) Get the Gateway models endpoint from the **AI Gateway** portal:
-
- 
-
- 2) Get the access key. Create new ones:
-
- 
-
- Copy the access key and keep it for next steps. Click **Next**.
-
-- **Authentication**: Select **API Key** and enter the access key you obtained in the previous step. As header name, use `api-key`. Then, **Next**
-
-Finally, select **Add Model** and configure the following values:
-
-- **Name**: gpt-5.6-luna
-- **Display name**: gpt-5.6-luna
-- **Version**: leave it empty
-- **Format**: OpenAI
-
-Select **Save** to finish adding the model, then select **Add** to complete the connection.
-
-The newly added models should now appear under **Admin-connected models** in Microsoft Foundry:
-
-
-
-Next, add the new admin-connected model to your agents so they can use it through the AI Gateway.
-
-Open the **Agents** section in Microsoft Foundry, select the agent you want to configure, such as `EvidenceEnrichmentAgent`, and change its **Model** to the newly added admin-connected model:
-
-
-
-Select **Save** to apply the configuration changes. This creates a new agent version.
-
-Then test the agent. If you configured `EvidenceEnrichmentAgent`, use this JSON payload:
-
-```json
-{
- "transaction_id": "TX-TEST-0001",
- "originator_name": "James Carter",
- "origin_account": "83D4B1F30",
- "bank_origin": "0121",
- "beneficiary_name": "Emily Foster",
- "destination_account": "818CCA030",
- "bank_destination": "29196",
- "amount": 15000,
- "currency": "EUR"
-}
-```
-
-The agent should use the newly added admin-connected model to return a response based on the transaction details.
-
-Return to the **AI Gateway** portal to monitor requests and responses for the newly added admin-connected model. Open **Monitoring** and select **Configure telemetry**.
-
-
-
-Use the existing **Application Insights** instance to monitor telemetry. Select the appropriate instance, then select **Next**:
-
-
-
-Keep **System-assigned managed identity** as the authentication method, review the configuration, and select **Apply**.
-
-Allow a minute for the configuration to take effect before looking for telemetry.
-
-Test the agent again, then review the **Monitoring** section in the AI Gateway portal. Telemetry may take a few moments to appear. You should see a metrics view similar to the following:
-
-
-
-If time permits, apply the same model changes to all prompt agents.
-
-#### Apply a Rate-Limiting Policy
-
-When multiple agents call the same admin-connected model simultaneously, unrestricted usage can degrade the service. Apply a rate-limiting policy to control usage for each caller identity.
-
-Open **Models**, select `gpt-5.6-luna`, switch to the **Policies** tab, and select **Add policy**:
-
-
-
-Select the **Token rate limit** policy:
-
-
-
-Set the desired rate-limit parameters. Keep **Caller identity** as the target; in this case, the identity is the key used to connect Microsoft Foundry to the AI Gateway model:
-
-
-
-Select **Create** to apply the rate-limiting policy.
-
-Requests that exceed the configured limit will now be throttled, helping to maintain fair usage and service availability.
-
-
-### 3. Proxy the Financial Evidence MCP
+### 2. Proxy the Financial Evidence MCP
The **AI Gateway** can proxy existing Model Context Protocol (MCP) servers. This applies access, authentication, and rate-limiting policies at the gateway without requiring changes to the MCP implementation.
Next, onboard the existing `financial evidence` MCP to the AI Gateway. In the **AI Gateway** portal, open the **MCP servers** section and select **Add MCP server**:
-
+
The portal supports three backend types:
-
+
Select **MCP server**, then provide the details required to connect to the existing Financial Evidence MCP:
@@ -202,19 +77,19 @@ Select **Next**, validate the configuration, and select **Create** to add the MC
You can now test the MCP from the **AI Gateway**. Select **Use**:
-
+
Select the **Try it** tab, then select **List tools**. You should see all tools exposed by the Financial Evidence MCP:
-
+
Select the **Get Bank Information** operation, enter `0121` as the bank ID, and select **Run tool**:
-
+
The result should display information for bank ID `0121`. Expand the `data` element to view the details:
-
+
You can now interact with the Financial Evidence MCP through the **AI Gateway**. Next, configure `EvidenceEnrichmentAgent` to use it.
@@ -222,7 +97,7 @@ You can now interact with the Financial Evidence MCP through the **AI Gateway**.
Return to the **Microsoft Foundry** portal. Under **Build**, select **Agents**, then select `EvidenceEnrichmentAgent`. Remove the existing tool to ensure that the agent uses the latest MCP configuration:
-
+
Select **Save**, then open the **Tools** menu on the left side of the page.
@@ -235,13 +110,13 @@ Then select **Update**.
On the same MCP configuration page, select **Use in an agent**:
-
+
Select `EvidenceEnrichmentAgent` as the agent that will use this MCP.
Under the `EvidenceEnrichmentAgent` **Tools** section, verify that the `financial-evidence-mcp` endpoint shows the new **AI Gateway** configuration. Enable **Always auto-approve all tools**:
-
+
**Save** the agent again to apply the new configuration.
@@ -250,7 +125,7 @@ Test the agent and inspect its traces to verify that it uses `financial-evidence
To explore additional gateway policies, open the **Policies** section for `financial-evidence-mcp`. Because the **AI Gateway** is in preview, some MCP features, including the **Monitoring** tab, may still be unavailable.
-### 4. Generate an MCP from the Fraud Alert Manager API
+### 3. Generate an MCP from the Fraud Alert Manager API
The **AI Gateway** can also expose an existing API as an MCP, bringing agent integration and policy management to APIs that were not originally designed as MCP servers.
@@ -273,25 +148,25 @@ Select **Add MCP server**, choose **OpenAPI Specification**, and complete the fo
- **Spec URL**: Paste the URL you obtained from the previous step.
- **Authentication**: Select **None** because the lab API does not require authentication.
-
+
Select **Next**, validate the configuration, and select **Create** to add the MCP server.
Explore the new MCP server in the **AI Gateway** playground. For example, list the existing alerts:
-
+
Next, create `AlertManagerAgent` to interact with `alert-manager-mcp` through the **AI Gateway**, then add the agent to the full orchestration.
-### 5. Create the AlertManagerAgent
+### 4. Create the AlertManagerAgent
This is the fourth agent in the workflow. `AlertManagerAgent` uses `alert-manager-mcp` to manage financial alerts through the **AI Gateway**.
Use the following configuration:
- Use the agent instructions in `walkthrough/challenge-05/alert-manager-agent/instructions.md`.
-- Select the model routed through the **AI Gateway**.
+- Select the model: `gpt-5.6-luna`
- Onboard the MCP in **Microsoft Foundry** following the usual steps for MCP integration. Remember to add authentication with **API Key**, using header name `api-key` and value a valid API key provided by the **AI Gateway**.
- Configure the MCP for the agent and enable auto-approval for all tools.
- Save the agent configuration.
@@ -311,7 +186,7 @@ echo "https://$endpoint"
Open the URL. Before testing, the dashboard contains five alerts:
-
+
Test `AlertManagerAgent` by sending it the following JSON payload:
@@ -881,12 +756,12 @@ Test `AlertManagerAgent` by sending it the following JSON payload:
Confirm that the new alert appears on the Alert Management dashboard:
-
+
You can view the alert details or remove the alert to avoid duplicates in later tests.
-### 6. Add the Alert Manager Agent to the Orchestration
+### 5. Add the Alert Manager Agent to the Orchestration
The final task is to add `AlertManagerAgent` to the orchestration so it can process transactions that require operational alerting.
@@ -982,7 +857,7 @@ Use these additional JSON payloads to test the orchestration:
}
```
-Finally, inspect the AI Gateway telemetry and agent traces to verify that model calls and both MCP integrations traverse the gateway. Confirm that logs do not expose credentials or unnecessary financial payloads. Where possible, send an unauthorized request and verify that the gateway rejects it.
+Finally, inspect the AI Gateway telemetry and agent traces to verify that both MCP integrations traverse the gateway. Confirm that logs do not expose credentials or unnecessary financial payloads. Where possible, send an unauthorized request and verify that the gateway rejects it.
## 🚀 Go Further
@@ -999,4 +874,4 @@ Add per-agent quotas and compare their effects under a short concurrent workload
## 🧠 Conclusion
-You have placed model and MCP traffic behind a governance boundary and added operational alerting in parallel with report generation. Continue to [Challenge 6](challenge-06.md) to add operational and business observability to the complete workflow.
+You have placed MCP traffic behind a governance boundary and added operational alerting in parallel with report generation. Continue to [Challenge 6](challenge-06.md) to add operational and business observability to the complete workflow.
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-06.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-06.md
index b9c284cb8..e454ef74c 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-06.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/challenge-06.md
@@ -34,11 +34,11 @@ In Challenge 2, you connected **App Insights** to **Microsoft Foundry**, but you
Open the **Monitor** tab for any agent to review its captured metrics. To access the underlying traces, logs, and custom telemetry, select **Open in Azure Monitor**:
-
+
You should see a dashboard similar to the one below, showing the default telemetry captured by Application Insights:
-
+
Explore the sections and panels to understand the default telemetry and how it reflects agent behavior.
@@ -46,17 +46,17 @@ Next, inspect a complete orchestration trace to see how the components interact
Select **View Traces with Agent Runs**, then choose a **Dependency**:
-
+
The detailed trace shows the selected dependency within its orchestration run, including its interactions with other components and the telemetry correlation across the workflow.
To explore and filter all traces, open **Search** in the **Investigate** section of the left sidebar:
-
+
Select a trace to review its execution details, including spans, attributes, and related telemetry:
-
+
These insights are provided by Application Insights through the agents' default auto-instrumentation.
@@ -69,7 +69,7 @@ The updated orchestration adds executors after specific agent executions. These
The new code is under `/walkthrough/challenge-06/orchestration`.
Review the main orchestration code to see where the custom telemetry executors run after specific agent executions. The following image highlights the main changes:
-
+
The metric definitions and configuration are in `walkthrough/challenge-06/orchestration/src/business_metrics.py`.
@@ -112,15 +112,15 @@ The script sends the number of requests specified by the `--count` argument.
In **Application Insights**, verify that the custom telemetry is being captured. Open **Logs** under **Monitoring**, select the `customMetrics` table, and run a query to view the recorded metrics.
-
+
You should see metrics similar to those shown below:
-
+
You can also query specific custom metrics directly from **Logs**. Open the selector on the right, choose **KQL mode**, enter a query in the editor, and select **Run**:
-
+
The following example queries provide several views of the custom metrics:
@@ -177,7 +177,7 @@ customMetrics
The following image shows the result of the last query:
-
+
Explore additional queries and visualizations as needed.
@@ -189,11 +189,11 @@ Use Grafana to create interactive dashboards for the custom metrics queried in A
Return to the **Agents (Preview)** section introduced at the beginning of the lab, then select **Explore in Grafana** to open the Grafana integration:
-
+
Grafana provides prebuilt dashboards and panels for visualizing the default telemetry:
-
+
Explore these dashboards to become familiar with the interface.
@@ -212,7 +212,7 @@ Then, use the following settings:
Select the correct **Application Insights** resource, whose name starts with `appi-fraud`. The imported dashboard should display panels similar to those below:
-
+
You have now imported the dashboard and visualized the custom metrics in Grafana.
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/images/remove-existing-tool-from-evidenceenrichmentagent.png b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/images/remove-existing-tool-from-evidenceenrichmentagent.png
index e597de991..0ea8b8ed3 100644
Binary files a/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/images/remove-existing-tool-from-evidenceenrichmentagent.png and b/03-Azure/01-04-AI/07_Fraud_Intelligence/challenges/images/remove-existing-tool-from-evidenceenrichmentagent.png differ
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-01/solution-01.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-01/solution-01.md
index 3d9655b49..c72e88b16 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-01/solution-01.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-01/solution-01.md
@@ -20,15 +20,15 @@ Open the [Azure portal](https://portal.azure.com) and sign in with the credentia
When prompted to choose an account, select **Use another account** and enter the credentials provided. Do not use your personal or work account.
-
+
In the Azure portal, select **Resource groups** from the navigation menu.
-
+
Open the resource group assigned to you and confirm that its resources have been deployed successfully.
-
+
Verify that you can access the resources used in the later challenges, including the Microsoft Foundry project, model deployments, Azure Cosmos DB account, and Application Insights resource.
@@ -38,41 +38,41 @@ Open [GitHub](https://github.com) and sign in with the credentials provided in y
When prompted to choose an account, select **Use another account**. Do not use your personal or work account.
-
+
Select **Sign in with your identity provider**, then use the assigned lab account to authenticate.
Open the GitHub organization assigned to your lab account.
-
+
Select the assigned organization, then open the `microhack` repository. You need to fork the repository before you can create a Codespace. To fork the repository, click the **Fork** button in the top-right corner of the repository page and follow the prompts:
-
+
Use a unique name for the repository name to avoid conflicts with other forks. For example, you can append your lab username to the repository name (e.g., `microhack-labuser-0001`):
-
+
Finally, you should see your forked repository with the unique name you provided and all files and folders from the original repository:
-
+
### 3. Create the development environment
From the repository page, select **Code**, then open the **Codespaces** tab. Select the `...` menu and choose **New with options**.
-
+
For **Dev container configuration**, select **Azure / AI / Fraud Intelligence**, then select **Create codespace**:
-
+
GitHub opens the Codespace in a new browser tab. Wait for the container setup to finish, then confirm that the repository files are visible in the Explorer and that the integrated terminal opens without errors.
> Important: When the Codespace finishes setting up, you are asked to open the full repository, select **Never**.
-
+
You should have a terminal ready to use, otherwise open a terminal in the Codespace (Terminal > New Terminal). Then run the following command to verify that Azure CLI is installed:
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-02/solution-02.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-02/solution-02.md
index fae7e4c5c..e2a9ba099 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-02/solution-02.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-02/solution-02.md
@@ -103,7 +103,7 @@ echo "financialEvidenceMcpEndpoint=https://$functionAppName.azurewebsites.net/ru
In the Azure portal, open the Function App and select **Functions** > **App keys** > **System keys**.
-
+
Copy the value of the `mcp_extension` key and add it to `hackenv`:
@@ -123,7 +123,7 @@ The agent will use the Financial Evidence MCP to retrieve evidence from Cosmos D
In the Azure portal, open your **Microsoft Foundry** resource and select **Go to Foundry Portal**. Sign in using your Hackbox credentials.
-
+
#### Explore the Foundry project
@@ -133,7 +133,7 @@ Next, connect the Application Insights resource deployed in your environment to
Open **Manage** and select **Project details** from the left menu. Select **Connected resources**, then **Add connection**.
-
+
Select **Application Insights**, then select **Continue**. Choose the Application Insights resource deployed for your lab, leave **API key** as the authentication method, and select **Connect**.
@@ -141,13 +141,13 @@ Select **Application Insights**, then select **Continue**. Choose the Applicatio
Under **Build**, open **Agents**, select **New agent**, then select **Build an agent**.
-
+
Name the agent `EvidenceEnrichmentAgent`.
The new agent opens with a blank configuration:
-
+
The chat model is selected automatically because it is the only deployed model that can power this agent. The embedding deployment is not a chat model.
@@ -161,7 +161,7 @@ Select **Add** > **Add tools**, open the **Custom** tab, select **Model Context
The MCP configuration form opens:
-
+
Configure these values:
@@ -175,11 +175,11 @@ Select **Connect**. Foundry returns to the agent page and displays the new MCP t
Open the MCP tool's `...` menu and select **Configure**:
-
+
Then enable **Always auto-approve all tools**.
-
+
This setting allows the agent to use the MCP tools without requesting approval for every call.
@@ -189,7 +189,7 @@ Select **Save**. Foundry creates a new version of the agent.
Open the **Playground** to test the agent.
-
+
Submit this transaction:
@@ -211,7 +211,7 @@ The response should be a JSON object that contains the original transaction enri
For this example, the agent should find three pieces of evidence. To inspect the trace, scroll to the bottom and select **Traces**. It shows the agent calling the MCP tools according to its instructions and using the returned evidence to enrich the transaction.
-
+
Select any **Execute tool** span to inspect the data returned by the MCP.
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-03/solution-03.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-03/solution-03.md
index bfaa60577..7a4819e29 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-03/solution-03.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-03/solution-03.md
@@ -36,7 +36,7 @@ Build the Foundry IQ knowledge base that will support the Regulatory Assessment
In **Foundry**, open the **Build** section. Then select **Knowledge** in the left navigation pane to open the main interface for managing your knowledge base:
-
+
To learn more about how Foundry IQ works, watch the video available on this page.
@@ -44,7 +44,7 @@ At the bottom of the page, select **Create new resource** to start building your
Use the defaults, accept the acknowledgment, and proceed to create the new knowledge base resource:
-
+
Under the hood, a new **Azure AI Search** resource is being created to support the knowledge base. This resource will handle the indexing and retrieval of policy documents, ensuring that the Regulatory Assessment Agent can access the necessary information efficiently.
@@ -57,11 +57,11 @@ After the resource is created, select **Create a knowledge base** and set the fo
- **Output mode**: Extractive data
- **Retrieval instructions**: You have to always retrieve first the global policies and rules.
-
+
Then select **Add sources** and review the available source types for your knowledge base.
-
+
Stop here for now. The next section creates the storage account and containers for the policy documents.
@@ -111,13 +111,13 @@ az storage blob upload-batch --account-name "$foundryAccountName" --destination
To verify that the policy documents were uploaded successfully, open the **Storage Account** in the Azure portal and check the contents of each container:
-
+
Return to the **Foundry IQ** interface to continue adding and managing your policy sources. You can now add the policy sources from the Azure Blob storage containers you created.
Select **Add Sources**, then choose **Azure Blob Storage** as the source type.
-
+
For each container, fill in the required details and click **Create** to link it as a policy source.
@@ -131,7 +131,7 @@ The following example shows how to link the `global` container as a policy sourc
- **Embedding model**: text-embedding-3-large
- **Chat completion model**: Not needed
-
+
The **Status** of the policy source displays **Creating** while it is being linked. During this process, **AI Search** begins indexing the policy documents in the container. To monitor indexing, open the **Search Service** resource and review the following areas:
- **Search management**: go into **Indexes** and **Indexers** to monitor the indexing process.
@@ -156,11 +156,11 @@ Relevant steps you should not miss include:
Next, add **Knowledge** by selecting **Add**, then **Connect to Foundry IQ**:
-
+
Select the **Knowledge Base** you created (`kb-aml`), then select **Connect**:
-
+
Finally, select **Save** to create the new agent and make it ready for use.
@@ -356,7 +356,7 @@ This is an example JSON output from the `EvidenceEnrichmentAgent`:
The output contains the enrichment details from the previous agent and additional context provided by the `global` policy source. Expand all evaluated files by selecting **+NN** at the bottom of the response:
-
+
Confirm that all files come from the `global` policy source by checking for `global` in each path.
@@ -402,11 +402,11 @@ You do not need to modify the agent. The **Knowledge Base** provides a centraliz
Finally, test the agent again and verify that its response and sources reflect the addition of the internal and regional policy sources. For example, if you use the JSON provided earlier, you should now see files for the transaction's origin and destination countries:
-
+
You can also select **Traces** to review the agent's queries and how it retrieved the sources:
-
+
## 🚀 Go Further
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-04/solution-04.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-04/solution-04.md
index dbc3c05eb..9c835bc28 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-04/solution-04.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-04/solution-04.md
@@ -807,7 +807,7 @@ Ensure that the agents are defined correctly in the `main.py` file and that thei
Those names and versions should be set correctly in the `main.py` file:
-
+
### 4. Configure and Run the Orchestration Locally
@@ -833,16 +833,16 @@ The script will set up a virtual environment, install the required dependencies,
In the logs, you should see the initialization of each agent:
-
+
The final trace shows the port on which the agent is listening:
-
+
To test the orchestration locally, select the **Foundry Toolkit** icon in Visual Studio Code and use the **Agent inspector** tool to interact with the running agents:
-
+
Then use the initial JSON request from Challenge 2 to interact with the agents:
```json
@@ -868,17 +868,17 @@ The result should be a Markdown report containing the transaction details and th
Before deploying, ensure that you are signed in to your Azure account. Use the Azure extension in Visual Studio Code for this process. Select the **Azure** icon in the left sidebar to open the extension panel:
-
+
Select **Sign in with new account** and enter the credentials for the Azure account provided for the lab.
Before proceeding, confirm that the correct Azure subscription is selected. Open **View** > **Command Palette**, then search for `Azure: Select Subscriptions` and choose the appropriate subscription:
-
+
Then:
-
+
Return to the **Foundry Toolkit** extension and set your **Foundry project** as the default. Under **My resources**, select **Set Foundry project**, then choose the project used for this lab.
@@ -902,27 +902,27 @@ Follow these steps to deploy your orchestration. Ensure you use:
- **Package mode**: Remote
- **Deploy to**: New agent, as it is the first deployment of this orchestration
-
+
Finally, review the deployment options before confirming the deployment:
-
+
Track the deployment progress in the **Output** panel in Visual Studio Code by selecting **Foundry Toolkit** as the output source:
-
+
Once the deployment is complete, you can run a test using the **Hosted Agent Playground**:
-
+
The new hosted agent also appears under **Agents** in the **Microsoft Foundry** portal, where you can interact with it and test its functionality:
-
+
Test it from the playground as well:
-
+
### 6. Review Traces
@@ -930,11 +930,11 @@ Challenge 6 explores this topic in depth. For now, take a preliminary look at th
In the agent playground, select **Traces**:
-
+
Open the last trace to inspect the detailed execution flow of your orchestration:
-
+
We will explore tracing and metrics in more depth in Challenge 6. For now, this preliminary view is enough to confirm that the three agents ran in the expected sequence.
@@ -952,4 +952,4 @@ Add idempotent case identifiers and checkpointing so a transient failure can res
## 🧠 Conclusion
-You have composed evidence enrichment, regulatory assessment, and reporting into a deployable investigation workflow. Continue to [Challenge 5](solution-05.md) to govern model and MCP traffic and add operational alerting.
\ No newline at end of file
+You have composed evidence enrichment, regulatory assessment, and reporting into a deployable investigation workflow. Continue to [Challenge 5](solution-05.md) to govern MCP traffic and add operational alerting.
\ No newline at end of file
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-05/solution-05.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-05/solution-05.md
index b236e7816..b7ea2c7b0 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-05/solution-05.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-05/solution-05.md
@@ -1,14 +1,14 @@
-# Challenge 5 - Govern Models and MCP Servers
+# Challenge 5 - Govern MCP Servers
[Previous challenge](solution-04.md) | **[Home](../README.md)** | [Next challenge](solution-06.md)
## 🎯 Objective
-Introduce the **AI Gateway tier (preview)** for governed model and MCP access, generate an MCP interface from the Fraud Alert Manager API, build an **Alert Manager Agent**, and run alert creation in parallel with report generation.
+Introduce the **AI Gateway tier (preview)** for MCP access, generate an MCP interface from the Fraud Alert Manager API, build an **Alert Manager Agent**, and run alert creation in parallel with report generation.
## 🧭 Context and Background
-The investigation workflow now produces a decision, but a decision that requires action must also reach the operational alert system. AI Gateway provides a shared policy and observability boundary for model and tool traffic.
+The investigation workflow now produces a decision, but a decision that requires action must also reach the operational alert system. AI Gateway provides a shared policy and observability boundary for MCP traffic.
```mermaid
flowchart LR
@@ -19,7 +19,6 @@ flowchart LR
AMCP --> API[Fraud Alert Manager API]
ORCH[Hosted orchestration] --> GATEWAY[AI Gateway tier]
- GATEWAY --> MODEL[Model deployment]
GATEWAY --> FMCP[Financial Evidence MCP]
GATEWAY --> AMCP
```
@@ -36,9 +35,9 @@ source hackenv
### 1. Deploy the AI Gateway
-An **AI Gateway** is a centralized control point for securing and managing interactions among AI agents, models, and external services. It routes requests and responses through a governance layer that can enforce authentication, authorization, rate limiting, and other policies. This helps protect sensitive information, support compliance, and provide observability into AI-driven workflows.
+An **AI Gateway** is a centralized control point for securing and managing MCP traffic between AI agents and external services. It routes requests and responses through a governance layer that can enforce authentication, authorization, rate limiting, and other policies. This helps protect sensitive information, support compliance, and provide observability into AI-driven workflows.
-In Azure, API Management provides the AI Gateway. In this lab, you will deploy a dedicated API Management instance using the preview `AIGateway` SKU, then route model requests and MCP calls through this centralized governance layer.
+In Azure, API Management provides the AI Gateway. In this lab, you will deploy a dedicated API Management instance using the preview `AIGateway` SKU, then route MCP calls through this centralized governance layer.
#### Create the Gateway
@@ -52,143 +51,19 @@ Open the [AI Gateway portal](https://ai.gateway.azure.com/) and sign in with the
- **Resource group**: the existing lab resource group
- **Enable managed identity**
-
+
-### 2. Configure Governed Model Access
-
-#### Import Models
-
-In the AI Gateway left navigation pane, select **Models**, then select **Add Models**.
-
-Models can be imported from several sources and providers. For this lab, select models deployed in **Microsoft Foundry**:
-
-
-
-Choose the lab subscription and Foundry resource, then select **Next**:
-
-
-
-Keep the default settings, or adjust the names if needed, then select **Create** to import the models into the AI Gateway:
-
-
-
-After a successful import, the newly added models appear under **Models**:
-
-
-
-#### Configure Agents to Access Models Through the AI Gateway
-
-After importing the models, configure the agents to access them through the AI Gateway. In **Microsoft Foundry**, open **Manage**, select **Resource details**, and then select **Admin-connected models**:
-
-
-
-Select **Add** to open the connection dialog.
-
-Because the **AI Gateway** SKU is still in preview, select **Other source** instead of **Azure API Management**. Enter the following details:
-
-- **Connection name**: unique identifier, for instance, `aigateway`
-- **Base URL**
- 1) Get the Gateway models endpoint from the **AI Gateway** portal:
-
- 
-
- 2) Get the access key. Create new ones:
-
- 
-
- Copy the access key and keep it for next steps. Click **Next**.
-
-- **Authentication**: Select **API Key** and enter the access key you obtained in the previous step. As header name, use `api-key`. Then, **Next**
-
-Finally, select **Add Model** and configure the following values:
-
-- **Name**: gpt-5.6-luna
-- **Display name**: gpt-5.6-luna
-- **Version**: leave it empty
-- **Format**: OpenAI
-
-Select **Save** to finish adding the model, then select **Add** to complete the connection.
-
-The newly added models should now appear under **Admin-connected models** in Microsoft Foundry:
-
-
-
-Next, add the new admin-connected model to your agents so they can use it through the AI Gateway.
-
-Open the **Agents** section in Microsoft Foundry, select the agent you want to configure, such as `EvidenceEnrichmentAgent`, and change its **Model** to the newly added admin-connected model:
-
-
-
-Select **Save** to apply the configuration changes. This creates a new agent version.
-
-Then test the agent. If you configured `EvidenceEnrichmentAgent`, use this JSON payload:
-
-```json
-{
- "transaction_id": "TX-TEST-0001",
- "originator_name": "James Carter",
- "origin_account": "83D4B1F30",
- "bank_origin": "0121",
- "beneficiary_name": "Emily Foster",
- "destination_account": "818CCA030",
- "bank_destination": "29196",
- "amount": 15000,
- "currency": "EUR"
-}
-```
-
-The agent should use the newly added admin-connected model to return a response based on the transaction details.
-
-Return to the **AI Gateway** portal to monitor requests and responses for the newly added admin-connected model. Open **Monitoring** and select **Configure telemetry**.
-
-
-
-Use the existing **Application Insights** instance to monitor telemetry. Select the appropriate instance, then select **Next**:
-
-
-
-Keep **System-assigned managed identity** as the authentication method, review the configuration, and select **Apply**.
-
-Allow a minute for the configuration to take effect before looking for telemetry.
-
-Test the agent again, then review the **Monitoring** section in the AI Gateway portal. Telemetry may take a few moments to appear. You should see a metrics view similar to the following:
-
-
-
-If time permits, apply the same model changes to all prompt agents.
-
-#### Apply a Rate-Limiting Policy
-
-When multiple agents call the same admin-connected model simultaneously, unrestricted usage can degrade the service. Apply a rate-limiting policy to control usage for each caller identity.
-
-Open **Models**, select `gpt-5.6-luna`, switch to the **Policies** tab, and select **Add policy**:
-
-
-
-Select the **Token rate limit** policy:
-
-
-
-Set the desired rate-limit parameters. Keep **Caller identity** as the target; in this case, the identity is the key used to connect Microsoft Foundry to the AI Gateway model:
-
-
-
-Select **Create** to apply the rate-limiting policy.
-
-Requests that exceed the configured limit will now be throttled, helping to maintain fair usage and service availability.
-
-
-### 3. Proxy the Financial Evidence MCP
+### 2. Proxy the Financial Evidence MCP
The **AI Gateway** can proxy existing Model Context Protocol (MCP) servers. This applies access, authentication, and rate-limiting policies at the gateway without requiring changes to the MCP implementation.
Next, onboard the existing `financial evidence` MCP to the AI Gateway. In the **AI Gateway** portal, open the **MCP servers** section and select **Add MCP server**:
-
+
The portal supports three backend types:
-
+
Select **MCP server**, then provide the details required to connect to the existing Financial Evidence MCP:
@@ -202,19 +77,19 @@ Select **Next**, validate the configuration, and select **Create** to add the MC
You can now test the MCP from the **AI Gateway**. Select **Use**:
-
+
Select the **Try it** tab, then select **List tools**. You should see all tools exposed by the Financial Evidence MCP:
-
+
Select the **Get Bank Information** operation, enter `0121` as the bank ID, and select **Run tool**:
-
+
The result should display information for bank ID `0121`. Expand the `data` element to view the details:
-
+
You can now interact with the Financial Evidence MCP through the **AI Gateway**. Next, configure `EvidenceEnrichmentAgent` to use it.
@@ -222,7 +97,7 @@ You can now interact with the Financial Evidence MCP through the **AI Gateway**.
Return to the **Microsoft Foundry** portal. Under **Build**, select **Agents**, then select `EvidenceEnrichmentAgent`. Remove the existing tool to ensure that the agent uses the latest MCP configuration:
-
+
Select **Save**, then open the **Tools** menu on the left side of the page.
@@ -235,13 +110,13 @@ Then select **Update**.
On the same MCP configuration page, select **Use in an agent**:
-
+
Select `EvidenceEnrichmentAgent` as the agent that will use this MCP.
Under the `EvidenceEnrichmentAgent` **Tools** section, verify that the `financial-evidence-mcp` endpoint shows the new **AI Gateway** configuration. Enable **Always auto-approve all tools**:
-
+
**Save** the agent again to apply the new configuration.
@@ -250,7 +125,7 @@ Test the agent and inspect its traces to verify that it uses `financial-evidence
To explore additional gateway policies, open the **Policies** section for `financial-evidence-mcp`. Because the **AI Gateway** is in preview, some MCP features, including the **Monitoring** tab, may still be unavailable.
-### 4. Generate an MCP from the Fraud Alert Manager API
+### 3. Generate an MCP from the Fraud Alert Manager API
The **AI Gateway** can also expose an existing API as an MCP, bringing agent integration and policy management to APIs that were not originally designed as MCP servers.
@@ -273,25 +148,25 @@ Select **Add MCP server**, choose **OpenAPI Specification**, and complete the fo
- **Spec URL**: Paste the URL you obtained from the previous step.
- **Authentication**: Select **None** because the lab API does not require authentication.
-
+
Select **Next**, validate the configuration, and select **Create** to add the MCP server.
Explore the new MCP server in the **AI Gateway** playground. For example, list the existing alerts:
-
+
Next, create `AlertManagerAgent` to interact with `alert-manager-mcp` through the **AI Gateway**, then add the agent to the full orchestration.
-### 5. Create the AlertManagerAgent
+### 4. Create the AlertManagerAgent
This is the fourth agent in the workflow. `AlertManagerAgent` uses `alert-manager-mcp` to manage financial alerts through the **AI Gateway**.
Use the following configuration:
- Use the agent instructions in `walkthrough/challenge-05/alert-manager-agent/instructions.md`.
-- Select the model routed through the **AI Gateway**.
+- Select the model: `gpt-5.6-luna`
- Onboard the MCP in **Microsoft Foundry** following the usual steps for MCP integration. Remember to add authentication with **API Key**, using header name `api-key` and value a valid API key provided by the **AI Gateway**.
- Configure the MCP for the agent and enable auto-approval for all tools.
- Save the agent configuration.
@@ -311,7 +186,7 @@ echo "https://$endpoint"
Open the URL. Before testing, the dashboard contains five alerts:
-
+
Test `AlertManagerAgent` by sending it the following JSON payload:
@@ -881,12 +756,12 @@ Test `AlertManagerAgent` by sending it the following JSON payload:
Confirm that the new alert appears on the Alert Management dashboard:
-
+
You can view the alert details or remove the alert to avoid duplicates in later tests.
-### 6. Add the Alert Manager Agent to the Orchestration
+### 5. Add the Alert Manager Agent to the Orchestration
The final task is to add `AlertManagerAgent` to the orchestration so it can process transactions that require operational alerting.
@@ -982,7 +857,7 @@ Use these additional JSON payloads to test the orchestration:
}
```
-Finally, inspect the AI Gateway telemetry and agent traces to verify that model calls and both MCP integrations traverse the gateway. Confirm that logs do not expose credentials or unnecessary financial payloads. Where possible, send an unauthorized request and verify that the gateway rejects it.
+Finally, inspect the AI Gateway telemetry and agent traces to verify that both MCP integrations traverse the gateway. Confirm that logs do not expose credentials or unnecessary financial payloads. Where possible, send an unauthorized request and verify that the gateway rejects it.
## 🚀 Go Further
@@ -999,4 +874,4 @@ Add per-agent quotas and compare their effects under a short concurrent workload
## 🧠 Conclusion
-You have placed model and MCP traffic behind a governance boundary and added operational alerting in parallel with report generation. Continue to [Challenge 6](solution-06.md) to add operational and business observability to the complete workflow.
+You have placed MCP traffic behind a governance boundary and added operational alerting in parallel with report generation. Continue to [Challenge 6](solution-06.md) to add operational and business observability to the complete workflow.
diff --git a/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-06/solution-06.md b/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-06/solution-06.md
index 6d9e7135a..35a425edb 100644
--- a/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-06/solution-06.md
+++ b/03-Azure/01-04-AI/07_Fraud_Intelligence/walkthrough/challenge-06/solution-06.md
@@ -34,11 +34,11 @@ In Challenge 2, you connected **App Insights** to **Microsoft Foundry**, but you
Open the **Monitor** tab for any agent to review its captured metrics. To access the underlying traces, logs, and custom telemetry, select **Open in Azure Monitor**:
-
+
You should see a dashboard similar to the one below, showing the default telemetry captured by Application Insights:
-
+
Explore the sections and panels to understand the default telemetry and how it reflects agent behavior.
@@ -46,17 +46,17 @@ Next, inspect a complete orchestration trace to see how the components interact
Select **View Traces with Agent Runs**, then choose a **Dependency**:
-
+
The detailed trace shows the selected dependency within its orchestration run, including its interactions with other components and the telemetry correlation across the workflow.
To explore and filter all traces, open **Search** in the **Investigate** section of the left sidebar:
-
+
Select a trace to review its execution details, including spans, attributes, and related telemetry:
-
+
These insights are provided by Application Insights through the agents' default auto-instrumentation.
@@ -69,7 +69,7 @@ The updated orchestration adds executors after specific agent executions. These
The new code is under `/walkthrough/challenge-06/orchestration`.
Review the main orchestration code to see where the custom telemetry executors run after specific agent executions. The following image highlights the main changes:
-
+
The metric definitions and configuration are in `walkthrough/challenge-06/orchestration/src/business_metrics.py`.
@@ -112,15 +112,15 @@ The script sends the number of requests specified by the `--count` argument.
In **Application Insights**, verify that the custom telemetry is being captured. Open **Logs** under **Monitoring**, select the `customMetrics` table, and run a query to view the recorded metrics.
-
+
You should see metrics similar to those shown below:
-
+
You can also query specific custom metrics directly from **Logs**. Open the selector on the right, choose **KQL mode**, enter a query in the editor, and select **Run**:
-
+
The following example queries provide several views of the custom metrics:
@@ -177,7 +177,7 @@ customMetrics
The following image shows the result of the last query:
-
+
Explore additional queries and visualizations as needed.
@@ -189,11 +189,11 @@ Use Grafana to create interactive dashboards for the custom metrics queried in A
Return to the **Agents (Preview)** section introduced at the beginning of the lab, then select **Explore in Grafana** to open the Grafana integration:
-
+
Grafana provides prebuilt dashboards and panels for visualizing the default telemetry:
-
+
Explore these dashboards to become familiar with the interface.
@@ -211,7 +211,7 @@ Then, use the following settings:
Select the correct **Application Insights** resource, whose name starts with `appi-fraud`. The imported dashboard should display panels similar to those below:
-
+
You have now imported the dashboard and visualized the custom metrics in Grafana.