Agents bind to data, and nobody keeps the list
Say a platform team builds a security policy assistant in Azure AI Foundry. They give it file search over a vector store, feed that store from three Blob containers connected to the project, and ship it. From then on, every prompt the agent answers can pull from those documents.
That is how a Foundry agent reaches data. The agent is a foundation model, a system prompt and a set of tools, and the tool that matters for data security is file search. It binds the agent to a vector store, and the vector store is fed from Azure Blob containers connected to the project.
None of this shows up where security teams already look. The Blob container has an owner and an access policy. The agent appears in neither. Ask which AI agents can reach this container, and the answer, until now, was to open every Foundry project in the portal and read each agent’s tool list by hand.
An agent as Foundry presents it: instructions, a file search tool over security-policy-docs, an Azure AI Search index over Blob storage, and a model. Nothing on this screen says what is inside the documents the agent can read.
Bedrock Data already inventories Azure Blob containers and classifies what is in them. We built Foundry agent scanning to add the agents, the vector stores and the links between them, so the question above has a one-query answer in the same place that already holds the data.
How the scan joins agents to containers
The Bedrock Data Outpost runs in your subscription as a user-assigned managed identity trusted through a federated credential. There is no password, key or secret to exchange in either direction. With that identity it reads two things: the Azure control plane, which lists AI accounts, their Foundry projects and the Blob connections each project has, and the Foundry agent service, which lists the agents and vector stores inside each project. Bedrock Data joins the two and attaches every agent to the containers it can reach.
The same identity reads both Azure surfaces. The control plane says what exists and what it is connected to, the agent service says what each agent is, and Bedrock Data joins them.
The scan covers the whole subscription. New Foundry accounts and projects are picked up on the next cycle without any change on your side, and both generations of Foundry project are included.
Every agent inherits the classification of its data
The link from an agent to a container points at the same datastore the Blob scan classifies, so nothing is scanned twice. An agent connected to a container that holds Social Security numbers and bank account numbers is, from that moment, an agent that exposes those Data Types to its model. The policy flow view draws exactly that chain.
The same security-policy-assistant as Bedrock Data draws it. Three containers feed the agent, and the policy flow lists what they expose to gpt-4.1-mini, from passports and credit cards to credentials and clear-text passwords, along with the Business Contexts behind them.
Alongside the flow, each agent gets an impact score, the findings raised against it, and the Data Classifications, Data Domains and Data Types reachable through its containers. All of it is filterable, so every Azure agent that can reach PCI data is a filter, not an investigation.
The permissions Foundry scanning adds
Turning on Foundry scanning adds two built-in Azure roles to the Bedrock Data managed identity at subscription scope. Both are read-only.
- Cognitive Services User grants the data action that authorizes reading agents and vector stores from a Foundry project.
- Azure AI Developer is added alongside it for workspace-level read access in Foundry projects.
What the agent scan never reads
Threads, messages, run outputs and the contents of indexed documents. The agent scan reads agent configuration and vector store metadata, and from the configuration it keeps the first 200 characters of each agent’s instructions. It never reads anything a user typed into a conversation. What those documents contain comes from the Blob scan Bedrock Data already runs on the containers.
Turning it on in Terraform
Agent scanning is opt-in and runs on the Bedrock Data Outpost in your Azure subscription. In the Terraform template downloaded from the Bedrock Data UI, add one line to the cspm block and apply. Everything else is pre-populated for your tenant.
The highlighted line, enable_ai_foundry_scanning = true, is the only change. Set it back to false to revoke the two roles.
- Apply the change. On an existing deployment,
terraform planshows two role assignments to add and no other changes. - Wait for the next full scan. Azure role grants take time to propagate, so agents appear after the next full scan.
- Filter the inventory. Choose Entity: AI Agents and Platform: Azure.
After one scan cycle: the inventory filtered to Azure AI agents. Each agent carries an impact score and the Data Classifications and Data Domains it inherits from the containers it can reach, such as GLBA, PCI and HR Data.
One agent's overview. The security-policy-assistant can reach 62.7 GB across 7 Data Classifications, with 3 high and 4 medium findings open against it.
Foundry agent scanning is available to every Bedrock Data customer with an Outpost in Azure. It joins the agent coverage Bedrock Data already has for Amazon Bedrock Agents, Amazon Bedrock AgentCore, GCP Dialogflow and Vertex AI Search, Snowflake Cortex Agents and Databricks Knowledge Assistant agents, so one inventory answers the question across those platforms. That inventory is what DBOM Analysis in ArgusAI, Bedrock Data’s data authorization layer for AI, is built on.
If you already run Bedrock Data in Azure, add the flag and check the inventory after the next scan. If you don’t, we can walk you through it in a demo.
Questions about Foundry agent scanning
Which Foundry agents does Bedrock Data scan?
Bedrock Data scans Azure AI Foundry prompt agents in every Foundry project in the subscription, along with their vector stores and the Blob containers those stores are fed from.
Does Bedrock Data read agent conversations?
No. The Bedrock Data agent scan reads agent configuration and vector store metadata. It never reads threads, messages or run outputs.
What does it take to turn on?
A Bedrock Data Outpost in Azure and one line in the Terraform cspm block, enable_ai_foundry_scanning = true. Applying it adds two read-only Azure roles to the Bedrock Data managed identity.
Which other agent platforms does Bedrock Data inventory?
Amazon Bedrock Agents, Amazon Bedrock AgentCore, GCP Dialogflow and Vertex AI Search, Snowflake Cortex Agents and Databricks Knowledge Assistant agents, in the same inventory as Azure AI Foundry agents.