This article describes how to create a Microsoft Foundry project so you can work with generative AI in the cloud.
Use this article to create a Foundry project and confirm that your environment is ready before you start building agents, evaluations, and files.This article describes how to create a Foundry project in Microsoft Foundry. Projects let you organize your work—such as agents, evaluations, and files—as you build stateful apps and explore new ideas.If your organization requires customized Azure configurations like alternative names, security controls, or cost tags, you might need to use the Azure portal or template options to comply with your organization’s Azure Policy requirements.
Access to a role that allows you to create a Foundry resource, such as Foundry Account Owner or Foundry Owner on the subscription or resource group. For more information about permissions, see Role-based access control for Microsoft Foundry.
The Foundry RBAC roles were recently renamed. Foundry User, Foundry Owner, Foundry Account Owner, and Foundry Project Manager were previously named Azure AI User, Azure AI Owner, Azure AI Account Owner, and Azure AI Project Manager. You might still see the previous names in some places while the rename rolls out. The role IDs and core permissions are unchanged by the rename.
Run az login or az login --use-device-code in your environment before running code.
Install packages: pip install azure-identity azure-mgmt-cognitiveservices~=13.7.0. If you’re in a notebook cell, use %pip install instead.
Use pip show azure-mgmt-cognitiveservices to check that your version is 13.7 or greater.
Quick validation: Before creating a project, verify your SDK and authentication by testing the client:
from azure.identity import DefaultAzureCredentialfrom azure.mgmt.cognitiveservices import CognitiveServicesManagementClient# Test authentication by instantiating the clientcredential = DefaultAzureCredential()subscription_id = "<your-subscription-id>" # Replace with your subscription IDclient = CognitiveServicesManagementClient(credential, subscription_id)print("✓ Authentication successful! Ready to create a project.")
Start your script with the following code to create the client connection and variables used throughout this article. This example creates the project in East US:
# source: https://github.com/Azure/agent-first-sdk/blob/main/tests/management_sdk/manage_ai_foundry.ipynb# <create_client>from azure.identity import DefaultAzureCredentialfrom azure.mgmt.cognitiveservices import CognitiveServicesManagementClientsubscription_id = 'your-subscription-id'resource_group_name = 'your-resource-group-name'foundry_resource_name = 'your-foundry-resource-name'foundry_project_name = 'your-foundry-project-name'location = 'eastus'client = CognitiveServicesManagementClient( credential=DefaultAzureCredential(), subscription_id=subscription_id, api_version="2025-04-01-preview")# </create_client># TODO: add code to create create a new resource group# <create_resource_project># Create resourceresource = client.accounts.begin_create( resource_group_name=resource_group_name, account_name=foundry_resource_name, account={ "location": location, "kind": "AIServices", "sku": {"name": "S0",}, "identity": {"type": "SystemAssigned"}, "properties": { "allowProjectManagement": True, "customSubDomainName": foundry_resource_name } })# Wait for the resource creation to completeresource_result = resource.result()# Create default projectproject = client.projects.begin_create( resource_group_name=resource_group_name, account_name=foundry_resource_name, project_name=foundry_project_name, project={ "location": location, "identity": { "type": "SystemAssigned" }, "properties": {} })# </create_resource_project># TODO: code to do role assignment to give user project manager role on the account# <create_additional># Create additional projectnew_project_name = 'your-new-project-name'project = client.projects.begin_create( resource_group_name=resource_group_name, account_name=foundry_resource_name, project_name=new_project_name, project={ "location": location, "identity": { "type": "SystemAssigned" }, "properties": {} })# </create_additional># <show_project># Get projectproject = client.projects.get( resource_group_name=resource_group_name, account_name=foundry_resource_name, project_name=foundry_project_name)print(project)# </show_project>
(Optional) If you have multiple accounts, add the tenant ID of the Microsoft Entra ID you want to use into DefaultAzureCredential:
You create a Foundry project on a Foundry resource. The portal automatically creates this resource when you create the project. Select an existing Resource group to use, or leave the default to create a new resource group.
Especially for getting started, create a new resource group for your project. The resource group makes it easy to manage the project and all its resources together.
Select a Location or use the default. The location is the region where the project resources are hosted.
Select Create. You see the progress of resource creation. The project is created when the process is complete.
To create a Foundry project:
Add the following code to create a Foundry project by using the variables and client connection from the prerequisites section.
# source: https://github.com/Azure/agent-first-sdk/blob/main/tests/management_sdk/manage_ai_foundry.ipynb# <create_client>from azure.identity import DefaultAzureCredentialfrom azure.mgmt.cognitiveservices import CognitiveServicesManagementClientsubscription_id = 'your-subscription-id'resource_group_name = 'your-resource-group-name'foundry_resource_name = 'your-foundry-resource-name'foundry_project_name = 'your-foundry-project-name'location = 'eastus'client = CognitiveServicesManagementClient( credential=DefaultAzureCredential(), subscription_id=subscription_id, api_version="2025-04-01-preview")# </create_client># TODO: add code to create create a new resource group# <create_resource_project># Create resourceresource = client.accounts.begin_create( resource_group_name=resource_group_name, account_name=foundry_resource_name, account={ "location": location, "kind": "AIServices", "sku": {"name": "S0",}, "identity": {"type": "SystemAssigned"}, "properties": { "allowProjectManagement": True, "customSubDomainName": foundry_resource_name } })# Wait for the resource creation to completeresource_result = resource.result()# Create default projectproject = client.projects.begin_create( resource_group_name=resource_group_name, account_name=foundry_resource_name, project_name=foundry_project_name, project={ "location": location, "identity": { "type": "SystemAssigned" }, "properties": {} })# </create_resource_project># TODO: code to do role assignment to give user project manager role on the account# <create_additional># Create additional projectnew_project_name = 'your-new-project-name'project = client.projects.begin_create( resource_group_name=resource_group_name, account_name=foundry_resource_name, project_name=new_project_name, project={ "location": location, "identity": { "type": "SystemAssigned" }, "properties": {} })# </create_additional># <show_project># Get projectproject = client.projects.get( resource_group_name=resource_group_name, account_name=foundry_resource_name, project_name=foundry_project_name)print(project)# </show_project>
Create multiple Foundry projects on an existing Foundry resource to enable team collaboration and shared resource access including security, deployments, and connected tools. This setup is ideal in restricted Azure subscriptions where developers need self-serve exploration ability within the setup of a preconfigured environment.
Foundry projects as Azure child resources may get assigned their own access controls, but share common settings such as network security, deployments, and Azure tool integration from their parent resource.While not all Foundry capabilities support organizing work in projects yet, your resource’s first “default” project is more powerful. You can identify it by the tag “default” in UX experiences and the resource property “is_default” when using code options.
On the Home project page, you see the project endpoint and API key for the project. You don’t need the API key if you use Microsoft Entra ID authentication.
# source: https://github.com/Azure/agent-first-sdk/blob/main/tests/management_sdk/manage_ai_foundry.ipynb# <create_client>from azure.identity import DefaultAzureCredentialfrom azure.mgmt.cognitiveservices import CognitiveServicesManagementClientsubscription_id = 'your-subscription-id'resource_group_name = 'your-resource-group-name'foundry_resource_name = 'your-foundry-resource-name'foundry_project_name = 'your-foundry-project-name'location = 'eastus'client = CognitiveServicesManagementClient( credential=DefaultAzureCredential(), subscription_id=subscription_id, api_version="2025-04-01-preview")# </create_client># TODO: add code to create create a new resource group# <create_resource_project># Create resourceresource = client.accounts.begin_create( resource_group_name=resource_group_name, account_name=foundry_resource_name, account={ "location": location, "kind": "AIServices", "sku": {"name": "S0",}, "identity": {"type": "SystemAssigned"}, "properties": { "allowProjectManagement": True, "customSubDomainName": foundry_resource_name } })# Wait for the resource creation to completeresource_result = resource.result()# Create default projectproject = client.projects.begin_create( resource_group_name=resource_group_name, account_name=foundry_resource_name, project_name=foundry_project_name, project={ "location": location, "identity": { "type": "SystemAssigned" }, "properties": {} })# </create_resource_project># TODO: code to do role assignment to give user project manager role on the account# <create_additional># Create additional projectnew_project_name = 'your-new-project-name'project = client.projects.begin_create( resource_group_name=resource_group_name, account_name=foundry_resource_name, project_name=new_project_name, project={ "location": location, "identity": { "type": "SystemAssigned" }, "properties": {} })# </create_additional># <show_project># Get projectproject = client.projects.get( resource_group_name=resource_group_name, account_name=foundry_resource_name, project_name=foundry_project_name)print(project)# </show_project>
If you created the project for a team, assign the Foundry User role to team members so they can use the project and its resources. This role provides the minimum permissions needed to build and test AI applications. For other roles you might need to assign, see Role-based access control for Microsoft Foundry.
The Foundry RBAC roles were recently renamed. Foundry User, Foundry Owner, Foundry Account Owner, and Foundry Project Manager were previously named Azure AI User, Azure AI Owner, Azure AI Account Owner, and Azure AI Project Manager. You might still see the previous names in some places while the rename rolls out. The role IDs and core permissions are unchanged by the rename.
In the Foundry portal, select Operate in the upper-right navigation.
Select Admin in the left pane.
Select your project name in the table.
Select Add user in the upper right.
Enter the email address of the team member.
Select Add.
Repeat these steps for each team member or security group.
To add multiple users at once, use a Microsoft Entra security group instead of individual email addresses.
Use the Azure CLI or Foundry portal to manage role assignments. The Python SDK doesn’t support role assignment operations.
Get the project’s resource ID:
PROJECT_ID=$(az cognitiveservices account project show \ --name my-foundry-resource \ --resource-group my-foundry-rg \ --project-name my-foundry-project \ --query id -o tsv)
Assign the Foundry User role to a team member:
The Foundry RBAC roles were recently renamed. Foundry User, Foundry Owner, Foundry Account Owner, and Foundry Project Manager were previously named Azure AI User, Azure AI Owner, Azure AI Account Owner, and Azure AI Project Manager. You might still see the previous names in some places while the rename rolls out. The role IDs and core permissions are unchanged by the rename.
az role assignment create \ --role "53ca6127-db72-4b80-b1b0-d745d6d5456d" \ --assignee "user@contoso.com" \ --scope $PROJECT_ID
Because the Foundry RBAC roles were recently renamed, use the role definition ID (GUID) instead of the role name in your code to avoid issues during the rename rollout:
Ask a team member to verify their access by signing in to Microsoft Foundry and selecting the project from the project list.If the team member can’t access the project, verify that the role assignment completed successfully. Check that you used the correct email address or security group ID. Make sure the team member’s Azure account is in the same Microsoft Entra tenant.