A Python app on Azure Container Apps builds an AIProjectClient by passing the Foundry resource's API key wrapped in AzureKeyCredential, and the client fails to authenticate. The container app's system-assigned managed identity already holds the Foundry User role on the project. What should the developer change so the app connects with the fewest code changes?
Choose one.
The Foundry project client (azure-ai-projects) authenticates with Microsoft Entra ID tokens through a TokenCredential.
The azure-ai-projects README states that Entra ID is the only authentication method the client currently supports. The fix is to pass a TokenCredential: DefaultAzureCredential resolves to the managed identity in Azure and to the developer's az login locally. Storing the key in Key Vault or an environment variable still hands the client a key, and adding a role does nothing while the request carries a key instead of a token.
- Note the symptom: key-based credential rejected by AIProjectClient.
- Recall that AIProjectClient accepts Entra ID tokens only.
- Use the identity that already has Foundry User: DefaultAzureCredential finds it.
- Reject options that keep a key credential in place.
Exam tip: AIProjectClient takes a token credential such as DefaultAzureCredential, never an API key.
AI-103: Build Generative Apps with Foundry — Models, RAG, Tools and Evaluation — the lesson that teaches this.