feat: Add Azure OpenAI Service Support to FastAgent

[pablotoledo]

This pull request introduces Azure OpenAI Service integration into the FastAgent application, adding support for both API Key and DefaultAzureCredential authentication methods. It also includes updates to configuration, dependency management, and testing to ensure seamless integration. Below are the key changes:

Azure OpenAI Integration

• Added a new AzureOpenAIAugmentedLLM class to handle Azure OpenAI Service logic, supporting both API Key and DefaultAzureCredential authentication. It includes validation for configuration parameters like base_url, api_key, and azure_deployment (src/mcp_agent/llm/providers/augmented_llm_azure.py, src/mcp_agent/llm/providers/augmented_llm_azure.pyR1-R137).
• Introduced AzureSettings and updated the Settings class to include Azure-specific configuration options (src/mcp_agent/config.py, [1] [2].
• Updated ModelFactory and Provider to include Azure as a supported provider (src/mcp_agent/llm/model_factory.py, [1] [2]; src/mcp_agent/llm/provider_types.py, [3].

Configuration and Dependency Updates

• Added an example Azure OpenAI configuration to fastagent.config.yaml, detailing three supported authentication modes (examples/azure-openai/fastagent.config.yaml, examples/azure-openai/fastagent.config.yamlR1-R54).
• Updated pyproject.toml to include the azure-identity dependency and an optional azure extras group for DefaultAzureCredential support (pyproject.toml, [1] [2].

Enhancements to Configuration Validation

• Modified check_api_keys to validate Azure configuration, supporting both API Key and DefaultAzureCredential modes. The function now checks both secrets and main configuration files for retrocompatibility (src/mcp_agent/cli/commands/check_config.py, [1] [2].
• Fixed missing API Keys panel display in the show_check_summary function (src/mcp_agent/cli/commands/check_config.py, [1] [2].

Testing

• Added unit tests for check_api_keys to validate Azure configuration scenarios, including API Key-only, DefaultAzureCredential-only, and invalid configurations (tests/unit/mcp_agent/cli/commands/test_check_config.py, tests/unit/mcp_agent/cli/commands/test_check_config.pyR1-R69).

Minor Adjustments

• Updated the schema adjustment logic in augmented_llm_openai.py to include Azure as a supported provider (src/mcp_agent/llm/providers/augmented_llm_openai.py, src/mcp_agent/llm/providers/augmented_llm_openai.pyL359-R359).

[pablotoledo]

Hi @evalstate !

I've tested this using an Azure AI Foundry deployed model (OpenAI gpt-4.1) and it's working fine

I'm considering using fast-agent but I only have the option to use Azure LLM models, so, please let me know how can I help with this Pull Request

Thanks!

[pablotoledo]

Hi again,

I've included support for DefaultAzureCredentials, that enable us to use fast-agent with "az login" and avoid api tokens with Azure, following the recommendation in some business scenarios :)

[pablotoledo]

I've included also the docs at the corresponding repository evalstate/fast-agent-docs#5

[ericthomas1]

Hello,

I followed the Option 3 instructions here

• run az login
• then start fast-agent.

Here is the simple agent:

import asyncio
from mcp_agent.core.fastagent import FastAgent

# Create the application
fast = FastAgent("Azure OpenAI Example")

# Define the agent using Azure OpenAI deployment
@fast.agent(
    instruction="You are a helpful AI assistant powered by Azure OpenAI Service", 
    model="azure.gpt-4.1"
)
async def main():
    async with fast.run() as agent:
        # Start interactive prompt
        await agent()

if __name__ == "__main__":
    asyncio.run(main())

THIS DOES NOT WORK:

default_model: "azure.gpt-4.1"

azure:
  use_default_azure_credential: "true"
  base_url: "https://<my-aoai-instance>.openai.azure.com/"
  azure_deployment: "gpt-4.1"
  api_version: '2023-05-15' //have tried the latest preview and GA api_versions; same error

The agent CLI interface starts, but sending a test message results in:

$ python aoai_agent.py

Type /help for commands, @agent to switch agent. Ctrl+T toggles multiline mode.

default > test
╭─────────────────────────────────────────────────────────────────────────────────────────── (default) [USER] ─╮
│                                                                                                              │
│  test                                                                                                        │
│                                                                                                              │
╰─ gpt-4.1 turn 1 ─────────────────────────────────────────────────────────────────────────────────────────────╯


  Finished       | Azure OpenAI Example  / Elapsed Time 00:00:05

Provider Configuration Error:
Rejected OpenAI API key

Details:
The configured OpenAI API key was rejected.
Please check that your API key is valid and not expired.

Please check your 'fastagent.secrets.yaml' configuration file and ensure all required API keys are set.

If I substitute the line from Option 3: use_default_azure_credential: "true" with api_key: "<key-here>" (from Option 2), my Azure deployed model works.

THIS WORKS:

default_model: "azure.gpt-4.1"

azure:
  api_key: "<my-key>"
  base_url: "https://<my-aoai-instance>.openai.azure.com/"
  azure_deployment: "gpt-4.1"
  api_version: '2023-05-15' //have tried the latest preview and GA api_versions; same error

Any ideas?

Thank you

[pablotoledo]

Do NOT include a api-key if you use DefaultAzureCredentials, also you need to ensure that the service account involved in AZ Login is included in the corresponding Role Group

I have this script to enforce the permissions in the az account:

#!/bin/bash
# This script shows how to assign the Cognitive Services User role to your account 
# for Azure OpenAI, which is required for token-based authentication

# Variables - replace with your actual values
USER_ID=""  # Your Azure AD object ID (from az ad signed-in-user show)
SUBSCRIPTION_ID=""  # Your subscription ID
RESOURCE_GROUP=""  # Your resource group name  
RESOURCE_NAME=""  # Your Azure OpenAI resource name

echo "=== Azure OpenAI RBAC Role Assignment ==="
echo "This script will assign the 'Cognitive Services User' role to your account"
echo "User ID: $USER_ID"
echo "Subscription: $SUBSCRIPTION_ID"
echo "Resource Group: $RESOURCE_GROUP"
echo "Resource Name: $RESOURCE_NAME"
echo ""

echo "First, let's verify your current user:"
az ad signed-in-user show --query id

echo ""
echo "Now assigning the Cognitive Services User role..."

# The following command assigns the role using object ID:
az role assignment create \
  --assignee-object-id "$USER_ID" \
  --role "Cognitive Services User" \
  --scope "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.CognitiveServices/accounts/$RESOURCE_NAME"

echo ""
echo "Verifying role assignment..."
az role assignment list \
  --assignee-object-id "$USER_ID" \
  --scope "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.CognitiveServices/accounts/$RESOURCE_NAME" \
  --output table

echo ""
echo "Note: Role assignments may take up to 30 minutes to fully propagate."
echo "If authentication still fails after role assignment, you can use API key authentication."