Merge branch 'main' into release-2025-openai-march-latest

Author: v-alje

articles/ai-foundry/concepts/models-featured.md

@@ -321,13 +321,13 @@ There are four pricing meters that determine the price you pay. These meters are
 
 See the [Nixtla model collection in Azure AI Foundry portal](https://ai.azure.com/explore/models?&selectedCollection=nixtla).
 
-## NTT Data
+## NTT DATA
 
-**Tsuzumi** is an autoregressive language optimized transformer. The tuned versions use supervised fine-tuning (SFT). Tsuzumi is handles both Japanese and English language with high efficiency.
+**tsuzumi** is an autoregressive language optimized transformer. The tuned versions use supervised fine-tuning (SFT). tsuzumi handles both Japanese and English language with high efficiency.
 
 | Model  | Type | Capabilities |
 | ------ | ---- | ------------ |
-| [Tsuzumi-7b](https://ai.azure.com/explore/models/Tsuzumi-7b/version/1/registry/azureml-nttdata) | [chat-completion](../model-inference/how-to/use-chat-completions.md?context=/azure/ai-foundry/context/context) | - **Input:** text (8,192 tokens) <br /> - **Output:** text (8,192 tokens) <br />  - **Tool calling:** No <br /> - **Response formats:** Text |
+| [tsuzumi-7b](https://ai.azure.com/explore/models/Tsuzumi-7b/version/1/registry/azureml-nttdata) | [chat-completion](../model-inference/how-to/use-chat-completions.md?context=/azure/ai-foundry/context/context) | - **Input:** text (8,192 tokens) <br /> - **Output:** text (8,192 tokens) <br />  - **Tool calling:** No <br /> - **Response formats:** Text |
 
 ## Related content
 

articles/ai-foundry/includes/region-availability-maas.md

@@ -101,7 +101,7 @@ Mistral-Large (2411)  | [Microsoft Managed Countries](/partner-center/marketplac
 |---------|---------|---------|---------|
 TimeGEN-1  | [Microsoft Managed countries/regions](/partner-center/marketplace/tax-details-marketplace#microsoft-managed-countriesregions)  <br> Mexico <br> Israel  | East US <br> East US 2 <br> North Central US <br> South Central US <br> Sweden Central <br> West US <br> West US 3        |  Not available       |
 
-### NTTDATA models
+### NTT DATA models
 
 | Model | Offer Availability Region  | Hub/Project Region for Deployment  | Hub/Project Region for Fine tuning  |
 |---------|---------|---------|---------|

articles/ai-foundry/media/how-to/vs-code/launch-vs-code.png

@@ -12,7 +12,7 @@ ms.date: 1/21/2025
 
 # Plan to manage costs for model inference in Azure AI Services
 
-This article describes how you can plan for and manage costs for model inference in Azure AI Services. After you start using model inference in Azure AI Services resources, use **Cost Management features** to set budgets and monitor costs.
+This article describes how you can view, plan for, and manage costs for model inference in Azure AI Services.
 
 Although this article is about planning for and managing costs for model inference in Azure AI Services, you're billed for all Azure services and resources used in your Azure subscription.
 
@@ -24,11 +24,9 @@ Although this article is about planning for and managing costs for model inferen
 
 ## Understand model inference billing model
 
-Models deployed in Azure AI Services are charged per 1,000 tokens. Language models understand and process text by breaking it down into tokens. For reference, each token is roughly four characters for typical English text. Costs per token vary depending on which model series you choose. Models that can process images break down images in tokens too. The number of tokens per image depends on the model and the resolution of the input image.
+Language models understand and process inputs by breaking them down into tokens. For reference, each token is roughly four characters for typical English text. Models that can process images or audio break down them into tokens too for billing purposes. The number of tokens per image or audio content depends on the model and the resolution of the input.
 
-Token costs are for both input and output. For example, suppose you have a 1,000 token JavaScript code sample that you ask a model to convert to Python. You would be charged approximately 1,000 tokens for the initial input request sent, and 1,000 more tokens for the output that is received in response for a total of 2,000 tokens.
-
-In practice, for this type of completion call, the token input/output wouldn't be perfectly 1:1. A conversion from one programming language to another could result in a longer or shorter output depending on many factors. One such factor is the value assigned to the `max_tokens` parameter.
+Costs per token vary depending on which model series you choose but in all cases models deployed in Azure AI Services are charged per 1,000 tokens. Token costs are for both input and output. For example, suppose you have a 1,000 token JavaScript code sample that you ask a model to convert to Python. You would be charged approximately 1,000 tokens for the initial input request sent, and 1,000 more tokens for the output that is received in response for a total of 2,000 tokens.
 
 ### Cost breakdown
 
@@ -57,16 +55,19 @@ The following sections explain the entries in details.
 
 ### Azure OpenAI and Microsoft models
 
-Azure OpenAI and Microsoft's family of models (like Phi) are charged directly and they show up as billing meters under each Azure AI services resource. This billing happens directly through Microsoft. When you inspect your bill, you notice billing meters accounting for inputs and outputs for each consumed model.
+Azure OpenAI models and models offered as first-party consumption services from Microsoft (including DeepSeek family and Phi family of models) are charged directly and they show up as billing meters under each Azure AI services resource. This billing happens directly through Microsoft. When you inspect your bill, you notice billing meters accounting for inputs and outputs for each consumed model.
 
 :::image type="content" source="../media/manage-cost/cost-by-meter-1p.png" alt-text="Screenshot of cost analysis dashboard scoped to the resource group where the Azure AI Services resource is deployed, highlighting the meters for Azure OpenAI and Microsoft's models. Cost is group by meter." lightbox="../media/manage-cost/cost-by-meter-1p.png":::
 
 ### Provider models
 
-Models provided by another provider, like Mistral AI, Cohere, Meta AI, or AI21 Labs, are billed using Azure Marketplace. As opposite to Microsoft billing meters, those entries are associated with the resource group where your Azure AI services is deployed instead of to the Azure AI Services resource itself. You see entries under the **Service Name** *SaaS* accounting for inputs and outputs for each consumed model.
+Models provided by another provider, like Mistral AI, Cohere, Meta AI, or AI21 Labs, are billed using Azure Marketplace. As opposite to Microsoft billing meters, those entries are associated with the resource group where your Azure AI services is deployed instead of to the Azure AI Services resource itself. Given model providers charge you directly, you see entries under the category **Marketplace** and **Service Name** *SaaS* accounting for inputs and outputs for each consumed model.
 
 :::image type="content" source="../media/manage-cost/cost-by-meter-saas.png" alt-text="Screenshot of cost analysis dashboard scoped to the resource group where the Azure AI Services resource is deployed, highlighting the meters for models billed throughout Azure Marketplace. Cost is group by meter." lightbox="../media/manage-cost/cost-by-meter-saas.png":::
 
+> [!IMPORTANT]
+> This distinction between Azure OpenAI, Microsoft-offered models, and provider models only affects how the model is made available to you and how you are charged. In all cases, models are hosted within Azure cloud and there is no interaction with external services or providers.
+
 ### Using Azure Prepayment
 
 You can pay for Azure OpenAI and Microsoft's models charges with your Azure Prepayment credit. However, you can't use Azure Prepayment credit to pay for charges for other provider models given they're billed through Azure Marketplace.
@@ -78,10 +79,6 @@ For example, a 400 error due to a content filter or input limit, or a 408 error
 
 If the service doesn't perform processing, you aren't charged. For example, a 401 error due to authentication or a 429 error due to exceeding the Rate Limit.
 
-## Other costs
-
-Enabling capabilities such as sending data to Azure Monitor Logs and alerting incurs extra costs for those services. These costs are visible under those other services and at the subscription level, but aren't visible when scoped just to your Azure AI services resource.
-
 ## Monitor costs
 
 Azure resource usage unit costs vary by time intervals, such as seconds, minutes, hours, and days, or by unit usage, such as bytes and megabytes. As soon as Azure AI services use starts, costs can be incurred and you can see the costs in the [cost analysis](/azure/cost-management/quick-acm-cost-analysis?WT.mc_id=costmanagementcontent_docsacmhorizontal_-inproduct-learn).
@@ -127,6 +124,10 @@ You can create budgets with filters for specific resources or services in Azure
 
 You can also [export your cost data](/azure/cost-management-billing/costs/tutorial-export-acm-data?WT.mc_id=costmanagementcontent_docsacmhorizontal_-inproduct-learn) to a storage account, which is helpful when you need others to do extra data analysis for costs. For example, a finance team can analyze the data using Excel or Power BI. You can export your costs on a daily, weekly, or monthly schedule and set a custom date range. We recommend exporting cost data as the way to retrieve cost datasets.
 
+## Other costs
+
+Enabling capabilities such as sending data to Azure Monitor Logs and alerting incurs extra costs for those services. These costs are visible under those other services and at the subscription level, but aren't visible when scoped just to your Azure AI services resource.
+
 ## Next steps
 
 - Learn [how to optimize your cloud investment with cost management](/azure/cost-management-billing/costs/cost-mgt-best-practices?WT.mc_id=costmanagementcontent_docsacmhorizontal_-inproduct-learn).

articles/ai-foundry/model-inference/how-to/manage-costs.md

@@ -6,7 +6,7 @@ services: cognitive-services
 manager: nitinme
 ms.service: azure-ai-agent-service
 ms.topic: how-to
-ms.date: 12/16/2024
+ms.date: 03/12/2025
 author: aahill
 ms.author: aahi
 zone_pivot_groups: selection-function-calling
@@ -25,7 +25,7 @@ OpenAPI Specified tool improves your function calling experience by providing st
 automated, and scalable API integrations that enhance the capabilities and efficiency of your agent. 
 [OpenAPI specifications](https://spec.openapis.org/oas/latest.html) provide a formal standard for 
 describing HTTP APIs. This allows people to understand how an API works, how a sequence of APIs 
-work together, generate client code, create tests, apply design standards, and more. Currently, we support 3 authentication types with the OpenAPI 3.0 specified tools: `anonymous`, `API key`, `managed identity`.
+work together, generate client code, create tests, apply design standards, and more. Currently, we support three authentication types with the OpenAPI 3.0 specified tools: `anonymous`, `API key`, `managed identity`.
 
 ### Usage support
 
@@ -42,17 +42,30 @@ work together, generate client code, create tests, apply design standards, and m
 
 ## Authenticating with API Key
 
-1. Verify that the OpenAPI spec supports API keys: it has `securitySchemes` section and has one scheme of type `apiKey`. For example:
+With API key authentication, you can authenticate your OpenAPI spec using various methods such as an API key or Bearer token. Only one API key security schema is supported per OpenAPI spec. If you need multiple security schemas, create multiple OpenAPI spec tools.
+
+1. Update your OpenAPI spec security schemas. it has a `securitySchemes` section and one scheme of type `apiKey`. For example:
+
    ```json
-       "securitySchemes": {
-          "apiKeyHeader": {
-                    "type": "apiKey",
-                    "name": "x-api-key",
-                    "in": "header"
-                }
-        }
+    "securitySchemes": {
+        "apiKeyHeader": {
+                "type": "apiKey",
+                "name": "x-api-key",
+                "in": "header"
+            }
+    }
+   ```
+
+   You usually only need to update the `name` field, which corresponds to the name of `key` in the connection. If the security schemes include multiple schemes, we recommend keeping only one of them.
+
+1. Update your OpenAPI spec to include a `security` section:
+   ```json
+   "security": [
+        {  
+        "apiKeyHeader": []  
+        }  
+    ]
    ```
-   If the security schemes include multiple schemes, we recommend keeping only one of them.
 
 1. Remove any parameter in the OpenAPI spec that needs API key, because API key will be stored and passed through a connection, as described later in this article.
 
@@ -72,7 +85,7 @@ work together, generate client code, create tests, apply design standards, and m
         :::image type="content" source="../../media/tools/bing/api-key-connection.png" alt-text="A screenshot of the custom keys selection for the AI project." lightbox="../../media/tools/bing/api-key-connection.png":::
 
    1. Enter the following information
-      - key: `name` of your security scheme. In this example, it should be `x-api-key`
+      - key: `name` field of your security scheme. In this example, it should be `x-api-key`
         ```json
                "securitySchemes": {
                   "apiKeyHeader": {
@@ -85,9 +98,41 @@ work together, generate client code, create tests, apply design standards, and m
       - value: YOUR_API_KEY
       - Connection name: YOUR_CONNECTION_NAME (You will use this connection name in the sample code below.)
       - Access: you can choose either *this project only* or *shared to all projects*. Just make sure in the sample code below, the project you entered connection string for has access to this connection.
-     
+
+1. Once you have created a connection, you can use it through the SDK or REST API. Use the tabs at the top of this article to see code examples.
+
+## Authenticating with managed identity (Microsoft Entra ID)
+
+[Microsoft Entra ID](/entra/fundamentals/whatis) is a cloud-based identity and access management service that your employees can use to access external resources. Microsoft Entra ID allows you to authenticate your APIs with additional security without the need to pass in API keys. Once you have set up managed identity authentication, it will authenticate through the Azure AI Service your agent is using. 
+
+To set up authenticating with Managed Identity:
+
+1. Enable the Azure AI Service of your agent has `system assigned managed identity` enabled.
+
+    :::image type="content" source="../../media/tools/managed-identity-portal.png" alt-text="A screenshot showing the managed identity selector in the Azure portal." lightbox="../../media/tools/managed-identity-portal.png":::
+
+1. Create a resource of the service you want to connect to through OpenAPI spec.
+
+1. Assign proper access to the resource.
+    1. Click **Access Control** for your resource
+       
+    1. Click **Add** and then **add role assignment** at the top of the screen.
+
+        :::image type="content" source="../../media/tools/role-assignment-portal.png" alt-text="A screenshot showing the role assignment selector in the Azure portal." lightbox="../../media/tools/role-assignment-portal.png":::
+        
+    1. Select the proper role assignment needed, usually it will require at least *READER* role. Then click **Next**.
+
+    1. Select **Managed identity** and then click **select members**.
+
+    1. In the managed identity dropdown menu, search for **Azure AI services** and then select the AI Service of your agent.
+
+    1. Click **Finish**.
+
+1. Once the setup is done, you can continue by using the tool through the SDK or REST API. Use the tabs at the top of this article to see code samples.
+
 ::: zone-end
 
+
 ::: zone pivot="code-example"
 ## Step 1: Create a project client
 Create a client object, which will contain the connection string for connecting to your AI project and other resources.

articles/ai-services/agents/how-to/tools/openapi-spec.md

@@ -22,7 +22,7 @@ Use this article if you want to use the Azure Agent Service with resources you a
 
 ## Choose basic or standard agent setup
 
-To use your own resources, you can edit the parameters in the provided deployment templates. To start, determine if you want to edit the [basic agent setup template](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.azure-ai-agent-service/basic-agent-keys), or the [standard agent setup template](https://github.com/Azure/azure-quickstart-templates/blob/master/quickstarts/microsoft.azure-ai-agent-service/standard-agent/README.md).
+To use your own resources, you can edit the parameters in the provided deployment templates. To start, determine if you want to edit the [basic agent setup template](https://github.com/Azure-Samples/azureai-samples/tree/main/scenarios/Agents/setup/basic-agent-identity), or the [standard agent setup template](https://github.com/Azure-Samples/azureai-samples/tree/main/scenarios/Agents/setup/standard-agent).
 
 **Basic Setup**:  Agents use multitenant search and storage resources fully managed by Microsoft. You don't have visibility or control over these underlying Azure resources. You can only use your own AI services account with this option.
 

articles/ai-services/agents/how-to/use-your-own-resources.md

@@ -117,7 +117,7 @@ Azure AI Agent Service offers a standard agent configuration with private networ
 
 ### Option 2: manually deploy the bicep template
 
-1. To manually run the bicep templates, [download the template from GitHub](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.azure-ai-agent-service/network-secured-agent). Download the following from the `network-secured-agent` folder:
+1. To manually run the bicep templates, [download the template from GitHub](https://github.com/Azure-Samples/azureai-samples/tree/main/scenarios/Agents/setup/network-secured-agent). Download the following from the `network-secured-agent` folder:
     1. `main.bicep`
     1. `azuredeploy.parameters.json`
     1. `modules-network-secured folder`