You have a Microsoft Foundry resource named Al1 that hosts three deployments of the GPT...

Use Microsoft Entra ID authentication and pass an OAuth 2.0 bearer token in the REST request’s Authorization header. Assign the required inference role, such as Cognitive Services User , only to each application’s managed identity or service principal. This authenticates the applications as distinct security principals and supports resource-scoped RBAC, auditing, token expiration, and immediate access revocation. Microsoft recommends Entra ID for production workloads because API keys are static, resource-wide secrets that cannot identify individual callers or provide granular authorization.

Each application must specify its appropriate deployment name when making an inference request. Foundry deployments assign a unique name and configuration to each deployed model. In the deployment-level REST API, that name appears in the request route:

/openai/deployments/{deployment-name}/chat/completions

The resource endpoint and authentication mechanism can remain common across all three applications, while the deployment name directs each request to the GPT-3.5 deployment optimized for that application’s workload. A deployment type describes capacity or provisioning characteristics and does not select a particular deployed model.

Study Guide alignment: configure authentication, managed identities, RBAC, model deployments, and REST-based model consumption.