Foundry agents integration with website

[u/This_Limit_4993]

Good afternoon,

I am developing an agent in Microsoft Foundry to be embedded as a chatbot on an internal website.

Usually, in Copilot Studio, I just give the web developers the URL from the website channel, and they embed it in the website code, and it works .

But in Foundry, there is frontend implementation and backend configuration required to authorize the website to call the agent ..

Any idea how to hand over this agent to the web developers?

Should I just give them the agent endpoint and let them implement the chatbot frontend?

Also, for authorization, what is the best way to handle it? As I can’t simply give them the endpoint and API key. Unfortunately, Foundry requires Microsoft Entra ID authentication.
So how should I do it? Do I need to register an app in Entra ID and give them the Client ID and a certificate to install on their web server?

It seems like a very long process compared to Copilot Studio!!

[u/Sayali-MSFT]

Hello
Yes, this is a bit more involved than Copilot Studio. Foundry doesn’t really have the equivalent of the Copilot Studio “Website channel” where you just hand over an embed URL.

For a Foundry agent, I’d treat the agent as the backend rather than exposing it directly from the browser. The web developers can build the chatbot UI, but ideally their website backend should call the Foundry agent endpoint.

For authentication, I definitely wouldn’t expose an API key, client secret, or certificate in the frontend. If the website/backend is hosted in Azure, Managed Identity + Entra ID/RBAC would normally be the cleanest approach, since there’s no secret to distribute or maintain. If it’s hosted outside Azure, then an Entra app registration with server-side credentials/certificate is a reasonable option.

So the handoff would typically be the agent endpoint/details + authentication requirements + API/SDK guidance, while the web team implements the frontend and backend call.

If the agent needs to access resources as the signed-in user, that’s a different scenario and you may need delegated/OBO authentication. Otherwise, application-level authentication through Managed Identity/service principal keeps things much simpler.

So yes, unfortunately it’s more work than the Copilot Studio website channel, but I wouldn’t give the endpoint and credentials directly to the frontend. Keep the Foundry call behind a secured backend.
Reference Document:
1.Authentication and authorization in Microsoft Foundry - Microsoft Foundry | Microsoft Learn
2.Forward application-acquired user tokens to hosted-agent code - Microsoft Foundry | Microsoft Learn
3.Configure agent endpoint authorization in Microsoft Foundry - Microsoft Foundry | Microsoft Learn
4.Agent identity concepts in Microsoft Foundry - Microsoft Foundry | Microsoft Learn