Merge branch 'main' of https://github.com/MicrosoftDocs/azure-ai-docs-pr into mrb_07_08_2025_fine_tuning_cost_management

Author: mrbullwinkle

.openpublishing.publish.config.json

@@ -188,6 +188,12 @@
       "branch": "main",
       "branch_mapping": {}
     },
+    {
+      "path_to_root": "azure-search-dotnet-samples",
+      "url": "https://github.com/Azure-Samples/azure-search-dotnet-samples",
+      "branch": "main",
+      "branch_mapping": {}
+    },
     {
       "path_to_root": "azureai-model-inference-bicep",
       "url": "https://github.com/Azure-Samples/azureai-model-inference-bicep",

articles/ai-foundry/agents/how-to/tools/deep-research.md

@@ -37,6 +37,7 @@ The deep research tool is tightly integrated with Grounding with Bing Search and
 
 ## Region support
 The Deep Research tool is supported in the following regions where the deep research model is available for deployment.
+
 |West US  | Norway East |
 |---------|---------|
 | ✔️ | ✔️ | 

articles/ai-foundry/agents/how-to/tools/model-context-protocol-samples.md

@@ -17,7 +17,7 @@ ms.custom: azure-ai-agents-code
 
 Use this article to find step-by-step instructions and code samples for connecting Foundry Agent service with MCP.
 
-Follow the [REST API Quickstart](../../quickstart.md?pivots=rest-api#api-call-information) to set the right values for the environment variables `AGENT_TOKEN`, `AZURE_AI_FOUNDRY_PROJECT_ENDPOINT` and `API_VERSION`.
+Follow the [REST API Quickstart](../../quickstart.md?pivots=rest-api#api-call-information) to set the right values for the environment variables `AGENT_TOKEN`, `AZURE_AI_FOUNDRY_PROJECT_ENDPOINT`, and `API_VERSION`.
 
 
 ## Create an Agent with the MCP tool enabled
@@ -35,7 +35,7 @@ curl --request POST \
               "type": "mcp",
               "server_label": "<unique name for your MCP server>",
               "server_url": "<your MCP server url>",
-              "require_approval": "never",
+              "allowed_tools": ["<tool_name>"], # optional
           }
       ],
   "name": "my-assistant",
@@ -68,7 +68,13 @@ curl --request POST \
 
 ## Create a run and check the output
 
-Create a run to pass headers for the tool and observe that the model uses the Grounding with Bing Search tool to provide a response to the user's question.
+Create a run to pass headers for the tool and observe that the model uses the Grounding with Bing Search tool to provide a response to the user's question. 
+`require_approval` parameter is optional. If not provided, `always` is the default value, meaning each time developer needs to approve before calling. Supported values:
+
+- `always` by default
+- `never` meaning no approval is required
+- `{"never":[<tool_name_1>, <tool_name_2>]}` you can also provide a list of tools without required approval
+- `{"always":[<tool_name_1>, <tool_name_2>]}` you can provide a list of tools with required approval
 
 ```bash
 curl --request POST \
@@ -81,9 +87,11 @@ curl --request POST \
           "mcp": [
             {
                 "server_label": "<the same unique name you provided during agent creation>",
+		"require_approval": "always" #always by default
                 "headers": {
                     "Authorization": "Bearer <token>",
                 }
+
             }
           ]
       },
@@ -97,6 +105,62 @@ curl --request GET \
   -H "Authorization: Bearer $AGENT_TOKEN"
 ```
 
+If the model is trying to invoke a tool in your MCP server with approval required, you get a run with `require_action` status.
+```bash
+{
+  "id": "run_123",
+  "object": "thread.run",
+  ...
+  "status": "requires_action",
+  ...
+  "required_action": {
+    "type": "submit_tool_approval",
+    "submit_tool_approval": {
+      "tool_calls": [
+        {
+          "id": "call_123",
+          "type": "mcp",
+          "arguments": "{...}",
+          "name": "<tool_name>",
+          "server_label": "<server_label_you_provided>"
+        }
+      ]
+    }
+  },
+  ...
+  "tools": [
+    {
+      "type": "mcp",
+      "server_label": "<server_label_you_provided>",
+      "server_url": "<server_url_you_provided>",
+      "allowed_tools": null
+    }
+  ],
+ ...
+}
+```
+Make sure you carefully reviewed the tool and argument(s) to be passed and make an informed decision for approval.
+
+## Submit your approval
+If you decide to approve, you need to set the `approve` parameter to be `true` with the `id` for the preceding tool calls.
+```bash
+curl --request POST \
+  --url $AZURE_AI_FOUNDRY_PROJECT_ENDPOINT/threads/thread_abc123/runs/run_abc123/submit_tool_outputs?api-version=$API_VERSION \
+  -H "Authorization: Bearer $AGENT_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+	"tool_approvals": [
+        {
+            "tool_call_id": "call_abc123",
+            "approve": true,
+            "headers": {
+            }
+        }
+    ]
+}
+```
+
+
 ## Retrieve the agent response
 
 ```bash

articles/ai-foundry/agents/how-to/tools/model-context-protocol.md

@@ -27,7 +27,7 @@ You can bring multiple remote MCP servers to Foundry Agent service by adding the
 
 > [!Note]
 > * You need to bring a remote MCP server (an existing MCP server endpoint)
-> * With current MCP tool in Foundry Agent, explicit approval is not supported (only `never` is accepted for `require_approval` parameter). Please review carefully what MCP server(s) you added to Foundry Agent service. We recommend reviewing all data being shared with remote MCP servers and optionally logging it for auditing purposes.
+> * With current MCP tool in Foundry Agent, approval is required by default. Please review carefully what MCP server(s) you added to Foundry Agent service. We recommend reviewing all data being shared with remote MCP servers and optionally logging it for auditing purposes.
 > * Supported regions: `westus`, `westus2`, `uaenorth`, `southindia` and `switzerlandnorth`
 > * The MCP tool supports custom headers for a specific run, allowing you to pass headers as needed by MCP server, such as authentication schema. Headers you pass in will only be available for the current run and will not be persisted.
 
@@ -43,11 +43,20 @@ You can bring multiple remote MCP servers to Foundry Agent service by adding the
 1. Find the remote MCP server you want to connect to, such as GitHub MCP Server. Create or update a Foundry Agent with a `mcp` tool with the following information:
    1. `server_url`: the url of the MCP server, for example, `https://api.githubcopilot.com/mcp/`
    2. `server_label`: a unique identifier of this MCP server to the agent, for example, `github`
-   3. `require_approval`: only `never` is supported right now
+   3. `allowed_tools`: optional, a list of tools you want to allow without approval
 
 1. Create a run and pass additional information about the `mcp` tool in `tool_resources` with headers
    1. `tool_label`: use the identifier you provided during create/update agent
    2. `headers`: pass a set of headers required by the MCP server
+   3. `require_approval`: optional, if not provided, `always` is the default value, meaning each time developer needs to approve before calling. Supported values:
+      1. `always` by default
+      2. `never` meaning no approval is required
+      3. `{"never":[<tool_name_1>, <tool_name_2>]}` you can also provide a list of tools without required approval
+      4. `{"always":[<tool_name_1>, <tool_name_2>]}` you can provide a list of tools with required approval
+
+1. If the model is trying to invoke a tool in your MCP server with approval required, you will get Run status as `require_action`. Within `require_action` field, you can get more details on which tool in MCP server to be called, argument(s) to be passed and `call_id`. Make sur eyou review the tool, argument(s) and make an informed decision for approval. 
+
+1. Submit your approval to the agent with `call_id` by setting `approve` to `true.
 
 ## Next steps
 

articles/ai-foundry/how-to/create-azure-ai-resource.md

@@ -9,7 +9,7 @@ ms.custom:
   - build-2024
   - ignite-2024
 ms.topic: how-to
-ms.date: 05/08/2025
+ms.date: 07/08/2025
 ms.reviewer: deeikele
 ms.author: sgilley
 author: sdgilley
@@ -33,7 +33,7 @@ In this article, you learn how to create and manage a hub in Azure AI Foundry po
 
 If your organization is using [Azure Policy](/azure/governance/policy/overview), set up a hub that meets your organization's requirements instead of using Azure AI Foundry for resource creation. 
 
-1. From the Azure portal, search for `Azure AI Foundry`. From the left menu, select **AI Hubs**, and then select **+ Create** and **Hub**.
+1. From the [Azure portal](https://portal.azure.com), search for `Azure AI Foundry`. From the left menu, select **AI Hubs**, and then select **+ Create** and **Hub**.
 
     :::image type="content" source="../media/how-to/hubs/create-hub.png" alt-text="Screenshot of the Azure AI Foundry portal." lightbox="../media/how-to/hubs/create-hub.png":::
 
@@ -61,18 +61,19 @@ If your organization is using [Azure Policy](/azure/governance/policy/overview),
 
 1. Select **Review + create** > **Create**. 
 
-## Manage your hub from the Azure portal
 
-### Manage access control
+## Manage access control
 
-You can add and remove users from the Azure AI Foundry portal management center. Both the hub and projects within the hub have a **Users** entry in the left-menu that allows you to add and remove users. When adding users, you can assign them built-in roles.
+You can add and remove users from the [Azure AI Foundry portal](https://ai.azure.com?cid=LearnDocs) management center. Both the hub and projects within the hub have a **Users** entry in the left-menu that allows you to add and remove users. When adding users, you can assign them built-in roles.
 
 :::image type="content" source="../media/how-to/hubs/studio-user-management.png" alt-text="Screenshot of the users area of the management center for a hub." lightbox="../media/how-to/hubs/studio-user-management.png":::
 
 For custom role assignments, use **Access control (IAM)** within the Azure portal.
 
 To add grant users permissions from the Azure portal, see the [Azure role assignments](/azure/role-based-access-control/role-assignments-portal) article.
 
+## Manage your hub from the Azure AI Foundry portal
+
 ### Networking
 
 Hub networking settings can be set during resource creation or changed in the **Networking** tab in the Azure portal view. Creating a new hub invokes a Managed Virtual Network. This streamlines and automates your network isolation configuration with a built-in Managed Virtual Network. The Managed Virtual Network settings are applied to all projects created within a hub. 
@@ -147,12 +148,12 @@ After your hub is created, it isn't possible to switch between Your Azure Key Va
 
 ## Delete an Azure AI Foundry hub
 
-To delete a hub from Azure AI Foundry, select the hub and then select **Delete hub** from the **Hub properties** section of the page.
+To delete a hub from [Azure AI Foundry](https://ai.azure.com?cid=LearnDocs), select the hub and then select **Delete hub** from the **Hub properties** section of the page.
 
 :::image type="content" source="../media/how-to/hubs/studio-delete-hub.png" alt-text="Screenshot of the delete hub link in hub properties." lightbox="../media/how-to/hubs/studio-delete-hub.png":::
 
 > [!NOTE]
-> You can also delete the hub from the Azure portal.
+> You can also delete the hub from the [Azure portal](https://portal.azure.com).
 
 Deleting a hub deletes all associated projects. When a project is deleted, all nested endpoints for the project are also deleted. You can optionally delete connected resources; however, make sure that no other applications are using this connection. For example, another Azure AI Foundry deployment might be using it.
 

articles/ai-foundry/how-to/create-secure-ai-hub.md

@@ -7,7 +7,7 @@ ms.service: azure-ai-foundry
 ms.custom:
   - build-2024
 ms.topic: how-to
-ms.date: 05/09/2025
+ms.date: 07/08/2025
 ms.reviewer: meerakurup 
 ms.author: sgilley
 author: sdgilley
@@ -31,7 +31,7 @@ You can secure your [Azure AI Foundry](https://ai.azure.com/?cid=learnDocs) hub,
 
 ## Create a hub
 
-1. From the Azure portal, search for `Azure AI Foundry`. From the left menu, select **AI Hubs**, and then select **+ Create** and **Hub**.
+1. From the [Azure portal](https://portal.azure.com), search for `Azure AI Foundry`. From the left menu, select **AI Hubs**, and then select **+ Create** and **Hub**.
 
     :::image type="content" source="../media/how-to/hubs/create-hub.png" alt-text="Screenshot of the Azure AI Foundry portal." lightbox="../media/how-to/hubs/create-hub.png":::