Azure AI Apps and Agents Developer Associate (AI-103) — Complete Study Guide

The Azure AI Apps and Agents Developer Associate (AI-103) certification is Microsoft's successor to the long-running AI-102 Azure AI Engineer Associate exam, which retired on June 30, 2026. Where AI-102 grew up in the era of standalone Cognitive Services, AI-103 was designed from the ground up for the generative and agentic era: it is Python-focused and centered on Microsoft Foundry (the evolution of Azure AI Foundry / Azure AI Studio) as the unified platform for building, deploying, governing, and observing AI applications and agents.

In detail, the exam covers agentic applications with tools, memory, and multi-agent orchestration; computer vision, text analysis, and information extraction workloads; and evaluation, observability, and responsible AI instrumentation. The exam skills document this guide follows is dated April 16, 2026.

This guide teaches every topic in the official skills outline, organized into the five measured skills areas with their exact weights. Work through it in order — the two heavyweight domains (planning/management and generative/agentic implementation) together account for roughly 60% of your score.

How to Use This Guide

Work through the Parts in blueprint order — Part 1's platform, deployment, and governance vocabulary is assumed by everything after it, and Parts 1–2 together are roughly 60% of your score, so be fastest and surest there. Then spend real time in a Foundry project: deploying a model, wiring a tool into an agent, and reading a trace teach you more than an hour of rereading.

Throughout the guide you'll see four kinds of callouts:

Aim to answer this question at the end of every section: "If the exam described this scenario, could I name the right model, service, SDK call, or portal action?" AI-103 is scenario-driven at heart — a workload on one side, the correct Foundry capability on the other.

Part 1 · Plan and manage an Azure AI solution (27%)

This is the architect-and-operator domain. It tests whether you can choose the right models and services, design the surrounding Azure infrastructure, deploy and scale responsibly, and wrap the whole solution in security, monitoring, responsible AI, and agent governance.

Selecting models: LLMs, SLMs, multimodal models, and Foundry Tools

Model selection is a trade-off across capability, latency, cost, context window, modality, and deployment constraints:

• Large language models (LLMs)frontier models such as the GPT-4-class and successor reasoning models available through Foundry. Choose them for complex reasoning, multi-step agent planning, tool selection, and high-quality generation. They cost the most per token and have the highest latency.
• Small language models (SLMs)models like the Phi family. Choose them for high-volume, latency-sensitive, or edge/on-device scenarios, for narrow tasks (classification, routing, extraction), and as cheap "worker" models in multi-model architectures. SLMs are also strong candidates for fine-tuning because training cost is lower.
• Multimodal modelsaccept combinations of text, image, audio, or video input (and in some cases produce non-text output). Required for visual question answering, document-image reasoning, and audio reasoning scenarios.
• Code modelsoptimized for code generation and repair; used in developer-assistant scenarios.
• Foundry Toolsthe prebuilt Azure AI services (Language, Translator, Speech, Vision, Content Understanding, Document Intelligence, Content Safety) surfaced as callable capabilities inside Foundry. Choose a Foundry Tool instead of a raw LLM when the task is well-defined and deterministic behavior, per-transaction pricing, or compliance-grade consistency matters (e.g., PII redaction, speech transcription, OCR).

The Foundry model catalog is where you compare models: it lists provider, modalities, context length, regions, deployment types, and benchmark results, and it supports side-by-side model comparison and leaderboards.

Choosing Foundry services for generative tasks, grounding, vector search, and agent workflows

Know which platform component solves which problem:

• Foundry Models (model inference endpoints)serverless or managed deployments of catalog models for chat completions, embeddings, and image/audio generation.
• Azure AI Searchthe grounding and retrieval backbone: full-text (BM25), vector, hybrid, and semantic ranking over your indexed content. It is the default knowledge store for RAG and for agent knowledge tools.
• Foundry Agent Servicemanaged runtime for agents: you define instructions, model, tools, and knowledge; the service handles the agent loop, thread/conversation state, tool invocation, and scaling.
• Content Understandingmultimodal extraction service that turns documents, images, audio, and video into structured, grounded representations (fields, markdown, transcripts) for downstream indexing and RAG.
• Content Safetymoderation of text and images, prompt-attack detection (Prompt Shields), and groundedness detection.
• Foundry projects and hubsthe organizational containers. A hub provides shared infrastructure (networking, storage, key vault, compute); projects are workspaces inside a hub where teams build, with their own connections, deployments, and access control.

Retrieval and indexing methods

At the planning level you must be able to pick an indexing/retrieval approach:

• Keyword (BM25) searchexact-term matching; best for identifiers, part numbers, exact phrases.
• Vector searchembeddings + approximate nearest neighbor (HNSW is the common algorithm); best for semantic similarity, paraphrase, cross-lingual retrieval.
• Hybrid searchruns keyword and vector queries together and fuses results with Reciprocal Rank Fusion (RRF); the recommended default for RAG grounding.
• Semantic rankeran L2 re-ranking stage in Azure AI Search that re-scores the top results with a language-understanding model and can return extractive captions/answers.
• Integrated vectorizationAI Search can chunk and embed content automatically at indexing time (and vectorize queries at query time) using a skillset, so your pipeline doesn't have to manage embeddings manually.

Integrating agent memory, tools, and knowledge services

Plan for the three pillars every production agent needs:

• Knowledgegrounding sources connected to the agent (AI Search indexes, file search over uploaded documents, SharePoint/web connectors). Knowledge answers "what does the agent know?"
• Toolsactions the agent can take: built-in tools (code interpreter, file search, web grounding), OpenAPI-described REST tools, function tools (your Python functions described by JSON schema), and MCP (Model Context Protocol) servers for standardized tool exposure. Tools answer "what can the agent do?"
• Memoryshort-term conversation state (threads managed by Agent Service) plus long-term memory (summaries or facts persisted to a store such as Cosmos DB or a vector index and retrieved into context). Memory answers "what does the agent remember across turns and sessions?"

Designing Azure infrastructure for AI apps and agents

A reference architecture for an enterprise Foundry solution includes: a Foundry hub + project; model deployments; an Azure AI Search index; Azure Storage for source content; Azure Cosmos DB or similar for conversation/memory state; Azure Key Vault for secrets; Application Insights / Azure Monitor for telemetry; and a delivery tier (Azure App Service, Container Apps, Functions, or AKS) hosting your Python application. Network isolation is achieved with virtual networks, private endpoints, and disabled public network access; identity flows through Microsoft Entra ID.

Plan region selection around model availability (not every model is in every region), data residency requirements, and quota availability.

Deployment options: models and agents

Agents deploy through the Foundry Agent Service — you version agent definitions (instructions, model, tools) in the project and expose them via the service API rather than shipping the loop yourself. Apps consuming agents connect with the project endpoint plus Entra ID credentials.

Foundry CI/CD integration

Treat prompts, agent definitions, evaluation datasets, and infrastructure as code:

• •
  Store prompt templates (e.g., Prompty files), agent configurations, and index definitions in Git.
• •
  Use GitHub Actions or Azure DevOps pipelines to provision resources (Bicep/Terraform), deploy model configurations, run automated evaluation suites as quality gates, and promote across dev → staging → production projects.
• •
  Gate releases on evaluation thresholds: if groundedness or safety scores regress versus baseline, the pipeline fails.
• •
  Use separate Foundry projects per environment and managed identities (OIDC federation from the pipeline) instead of long-lived secrets.

Quotas, scaling, rate limits, and cost management

• •
  Quota is granted per subscription + region + model, expressed in tokens-per-minute (TPM); a proportional requests-per-minute (RPM) limit accompanies it. You allocate TPM across deployments.
• •
  Exceeding limits returns HTTP 429; well-behaved clients implement exponential backoff with jitter and honor the Retry-After header.
• •
  Scale strategies: raise TPM allocation, request quota increases, spread across regions/deployments behind a router, move hot paths to PTU, or use Global deployments.
• •
  Cost controls: pick smaller models where quality allows, cap max_tokens, cache repeated context (prompt caching discounts repeated prefixes), use Batch for offline work, and set Azure Cost Management budgets and alerts. Token usage per call is reported in the response usage object — log it.

Monitoring: performance, drift, safety events, grounding quality, index health

• Azure Monitor / Application Insights collect latency, error rates, and dependency telemetry from your app tier; Foundry emits token consumption, request counts, and model-level metrics.
• Driftwatch for changes in input distribution or output quality over time; scheduled (continuous) evaluations on sampled production traffic detect quality drift; model version drift is managed by pinning model versions in deployments.
• Safety eventsContent Safety filter triggers (blocked prompts/completions, jailbreak detections) surface in logs and the Foundry risk/safety dashboards; alert on spikes.
• Grounding qualityrun groundedness evaluators (and the Groundedness Detection API) on sampled responses to catch fabrication creep.
• Index healthmonitor AI Search indexer status/errors, document counts versus source-of-truth, query latency, and re-embedding needs after model or schema changes.

Security: managed identity, private networking, keyless credentials, role policies

• Managed identities (system- or user-assigned) let Azure resources authenticate to each other with no stored secrets. Your app's identity gets RBAC roles on the Foundry resource; the Foundry/Search resources get roles on Storage; and so on.
• Keyless (Entra ID) authenticationin Python, DefaultAzureCredential from azure-identity resolves developer credentials locally and managed identity in Azure. Prefer it everywhere; disable key-based auth on resources where possible.
• Private networkingprivate endpoints put service traffic on your VNet with private DNS; set publicNetworkAccess = Disabled for strict isolation. Hubs propagate managed VNet settings to projects.
• Role policies (RBAC)assign least-privilege built-in roles: for example, Cognitive Services OpenAI User (inference only) versus Contributor roles (management); Search Index Data Reader versus Search Service Contributor; Foundry project-scoped roles for developers versus hub admins.

from azure.identity import DefaultAzureCredential
from azure.ai.projects import AIProjectClient

project = AIProjectClient(
    endpoint="https://<resource>.services.ai.azure.com/api/projects/<project>",
    credential=DefaultAzureCredential(),   # keyless: managed identity in Azure
)

Safety filters, guardrails, and moderation

Azure AI Content Safety underpins platform guardrails:

• Content filtering on model deployments scans prompts and completions across four harm categories — hate, sexual, violence, self-harm — each with severity levels (safe/low/medium/high). Default filters block medium+; you can create custom filter configurations per deployment (raising thresholds requires an approved use case).
• Prompt Shields detect direct jailbreak attempts in user prompts and indirect prompt injection in documents/content passed to the model.
• Groundedness detection flags responses not supported by supplied source material (with an optional correction mode).
• Protected material detection flags known copyrighted text/code.
• Blocklists add custom term-level blocking on top of ML classifiers.

Guardrails should be layered: platform filters + system-message rules + tool-access restrictions + output validation in code.

Responsible AI instrumentation: evaluators and safety evaluations

Foundry ships an evaluation framework you are expected to know:

• Quality evaluatorsgroundedness, relevance, coherence, fluency, similarity, plus retrieval-specific metrics.
• Safety evaluatorshateful/unfair content, sexual content, violence, self-harm, protected material, indirect attack (XPIA) susceptibility.
• Agent evaluatorsintent resolution, tool call accuracy, task adherence.
• AI red teamingautomated adversarial probing (the PyRIT-based red teaming agent) that attacks your app with jailbreak and harm strategies before launch.

Evaluations run in the portal or via the Python evaluation SDK, on datasets or on live traffic samples, and results are logged to the project for comparison across runs. Instrument these into CI/CD and production monitoring, not just pre-launch.

Auditing: trace logs, provenance, approvals

• TracingFoundry uses OpenTelemetry-based tracing; traces capture each agent run: model calls, prompts, tool invocations with inputs/outputs, and latencies, viewable in the Foundry portal and exportable to Application Insights.
• Provenanceretain which model version, prompt version, and retrieved sources produced each answer (citations tie responses to source chunks). AI-generated images from Azure carry C2PA content credentials for provenance.
• Approvalshuman-in-the-loop checkpoints: require explicit approval before an agent executes consequential tools (spend money, send email, modify records), and log the approval decision with the trace. Azure activity logs and diagnostic settings cover control-plane auditing.

Agent governance: oversight modes, constraints, tool-access controls

Governance is the newest planning skill and heavily emphasized:

• Oversight modesa spectrum from human-in-the-loop (agent proposes, human approves each consequential action), to human-on-the-loop (agent acts autonomously, humans monitor and can intervene), to fully autonomous within constraints (only for low-risk, reversible actions).
• Constraintsbound agent behavior with instruction-level rules, allowed-tool lists, data-scope restrictions (the agent's identity only has RBAC on what it needs), spend/step/iteration limits, and termination conditions to prevent runaway loops.
• Tool-access controlsregister tools centrally, restrict which agents may call which tools, require approval flows for high-risk tools, and audit every invocation. Entra Agent ID gives each agent its own identity so its permissions can be assigned and audited like any other principal.

Part 2 · Implement generative AI and agentic solutions (33%)

The largest domain. It tests hands-on implementation: consuming models from Python, building RAG, designing and orchestrating agents, evaluating and observing them, and tuning generation.

Deploying and consuming LLMs, small, code, and multimodal models

Deploy from the model catalog to an endpoint, then consume via SDK. The unified Foundry Models API gives one chat-completions surface across model families:

from azure.ai.inference import ChatCompletionsClient
from azure.ai.inference.models import SystemMessage, UserMessage

client = ChatCompletionsClient(endpoint=endpoint, credential=credential)
response = client.complete(
    model="gpt-4o",          # deployment name
    messages=[
        SystemMessage("You are a concise support assistant."),
        UserMessage("Summarize this ticket: ..."),
    ],
    temperature=0.3,
    max_tokens=400,
)
print(response.choices[0].message.content)

The OpenAI Python SDK pointed at your Azure endpoint is equally valid and commonly shown in questions. Multimodal input is sent as message content parts (text + image URL/base64); embeddings use an embeddings deployment and return vectors for indexing. Streaming (stream=True) delivers tokens incrementally for responsive UX.

Implementing RAG

Retrieval-Augmented Generation grounds the model in your data instead of relying on parametric knowledge:

1. 1Ingestload documents, chunk them (fixed-size with overlap, or layout/semantic chunking), and embed chunks.
2. 2Indexstore chunks + vectors + metadata in Azure AI Search (integrated vectorization can do chunk+embed for you).
3. 3Retrieveat query time, run hybrid search (vector + keyword + semantic ranker) to get top-k chunks.
4. 4Augmentinject retrieved chunks into the prompt with instructions to answer only from provided sources and to cite them.
5. 5Generate & verifyproduce the answer; optionally check groundedness before returning.

Key quality levers: chunk size/overlap, embedding model choice, hybrid + semantic ranking, top-k and score thresholds, query rewriting, and citation enforcement. The "on your data" pattern wires an AI Search index directly into chat completions as a data source; agents get the same via a search/knowledge tool.

Workflows, tool-augmented flows, and multistep reasoning

Beyond single calls, applications compose:

• Deterministic workflowscode-orchestrated chains: classify → route → retrieve → generate → validate. Predictable, testable, cheaper.
• Tool-augmented flowsthe model decides when to call tools (function calling): the model returns a structured tool call, your code executes it, the result goes back to the model, and it continues. This loop repeats until a final answer.
• Multistep reasoningplan-and-execute patterns where the model decomposes a task, executes steps (with tools), and synthesizes. Reasoning-optimized models do extended internal deliberation; standard models can be prompted to reason stepwise.

Choose deterministic workflows when the path is known; choose agentic tool loops when the path depends on intermediate results.

Evaluating models and apps: fabrications, relevance, quality, safety

Evaluation is tested in depth. The core built-in evaluators:

Most quality evaluators are LLM-as-judge: a strong model scores outputs against a rubric (typically 1–5). Run evaluations on curated datasets (or AI-generated adversarial datasets via the simulator), compare runs across prompt/model variants, and schedule continuous evaluation on production samples.

Foundry SDK integration: connectors and app-to-project connection

The Foundry SDK (azure-ai-projects) is the Python entry point. AIProjectClient connects your app to a project via its endpoint and exposes:

• •
  model inference clients (chat, embeddings) for project deployments,
• •
  the Agents client (create/run agents, threads, messages),
• •
  connections — the project's saved integrations (AI Search, Storage, Bing grounding, custom keys), retrieved by name so code stays environment-agnostic,
• •
  evaluation, dataset, and tracing utilities.

Connections are the "connector" mechanism: an admin wires AI Search or a knowledge store into the project once; app code asks the project for the connection instead of embedding endpoints/keys.

Agent fundamentals: roles, goals, conversation tracking, tool schemas

Creating an agent in the Agent Service means specifying:

• modelthe deployment powering reasoning;
• instructionsrole, goal, constraints, tone ("You are a refund agent. You may only…");
• toolscapabilities with schemas;
• conversation statea thread per conversation holds the message history; you add user messages to a thread and create runs that let the agent process the thread and respond. Threads persist, giving durable conversation tracking without you storing transcripts.

Tool schemas describe functions in JSON Schema — name, description, parameters with types — so the model can emit valid calls. Clear descriptions are prompt engineering for tools: the model chooses tools based on them.

agent = project.agents.create_agent(
    model="gpt-4o",
    name="support-agent",
    instructions="You resolve billing questions. Use tools; never guess amounts.",
    tools=[{
        "type": "function",
        "function": {
            "name": "get_invoice",
            "description": "Fetch an invoice by ID for the authenticated customer.",
            "parameters": {
                "type": "object",
                "properties": {"invoice_id": {"type": "string"}},
                "required": ["invoice_id"],
            },
        },
    }],
)

Agents with retrieval, function calling, and memory

• Retrievalattach knowledge tools: File Search (managed vector store over uploaded files) or an Azure AI Search tool bound to a project connection. The agent retrieves and cites automatically during runs.
• Function callingregister function tools; during a run the agent pauses with requires_action, your code executes the requested function(s) and submits outputs, and the run resumes. With the SDK's automatic function-calling helpers, a toolset of Python functions is invoked for you.
• Memorythreads give within-conversation memory. For cross-session memory, persist salient facts/summaries (e.g., Cosmos DB or a vector store) and inject them into instructions or expose a memory-lookup tool. Manage context windows by truncating or summarizing long threads.

Integrating tools: APIs, knowledge stores, search, custom functions

Four integration routes to know cold:

1. 1Built-in toolscode interpreter (sandboxed Python for math/files/charts), file search, web/Bing grounding.
2. 2Function toolsyour Python callables with JSON schemas; best for internal logic and private systems.
3. 3OpenAPI toolshand the agent an OpenAPI 3.0 spec and it can call the REST API directly (auth via anonymous, API key, or managed identity); best for existing services with specs.
4. 4MCP serversModel Context Protocol standardizes tool discovery/invocation; an agent connects to an MCP server and inherits its tools; best for reusable tool catalogs shared across agents and platforms.

Knowledge stores (AI Search indexes, vector stores) attach as knowledge/search tools so retrieval happens inside the agent loop.

Multi-agent orchestration

When one agent's instruction set gets overloaded, split responsibilities:

• •
  Connected agents / agent-as-tool — a main agent delegates to specialist agents exposed as callable tools; the orchestrator routes, specialists execute. This is the Agent Service's native pattern.
• •
  Orchestration patterns (via frameworks such as Semantic Kernel and the agent-framework lineage): sequential (pipeline of agents), concurrent (fan-out/fan-in), group chat (agents converse under a manager that picks speakers and termination), handoff (ownership transfers based on context), and magentic-style open-ended collaboration with a planner/manager.
• •
  Design rules: single clear responsibility per agent, explicit termination conditions, a shared conversation/state channel, and an orchestrator that owns routing decisions.

Autonomous workflows with safeguards and approvals

For long-running or autonomous agents, implement:

• iteration/step caps and timeouts to stop runaway loops;
• budget guards (token/cost ceilings per run);
• approval gates before consequential tool calls — the run pauses, a human approves/rejects, the decision is logged;
• scoped identities so the agent can only touch permitted resources;
• idempotent, reversible tool design where possible, and dry-run modes;
• kill switches and monitoring hooks for human-on-the-loop supervision.

Agent behavior monitoring and error analysis

Use run and trace data to debug agents: inspect run steps (each model call and tool call with inputs/outputs), identify failure classes — wrong tool chosen, malformed arguments, tool runtime errors, hallucinated parameters, task drift — and fix at the right layer (tool descriptions, instructions, schema strictness, or retries). Aggregate error analysis across runs reveals systematic issues (e.g., one tool causes 80% of failures). The agent evaluators (tool call accuracy, intent resolution, task adherence) quantify improvements between versions.

Tuning generation: prompt engineering and parameters

Prompt engineering techniques: clear system-role definition, explicit output format (or structured outputs / JSON schema mode for guaranteed shape), few-shot examples, delimiters between instructions and data, chain-of-thought instructions ("think step by step"), and grounding rules ("answer only from context; say 'I don't know' otherwise").

Reflection, chain-of-thought evaluation, and self-critique

Quality-improvement loops the exam names explicitly:

• Reflectiona generate → critique → revise cycle: the model (or a second "critic" model/agent) reviews the draft against criteria and the generator revises. Implemented as two-pass prompting or a two-agent (writer/reviewer) pattern.
• Chain-of-thought evaluationjudge intermediate reasoning, not just final answers: LLM-as-judge rubrics applied to the reasoning trace, or step-level checks in agent runs (did each tool call follow logically?).
• Self-critiquethe model scores or verifies its own output before returning it (e.g., "list claims and check each against the sources"), useful as a cheap groundedness pre-filter.

These trade extra tokens/latency for quality — apply selectively on high-stakes outputs.

Observability: tracing, token analytics, safety signals, latency

Instrument with OpenTelemetry: the Foundry SDKs emit spans for model calls, tool executions, and agent runs; export to Application Insights connected to the project. Dashboards should track:

• Tracesend-to-end request trees for debugging individual conversations;
• Token analyticsprompt/completion tokens per request, per feature, per model → cost attribution and cache-hit tracking;
• Safety signalscontent-filter triggers, Prompt Shield detections, groundedness failures, trending by severity;
• Latencyend-to-end and per-span (model vs tool vs retrieval), p50/p95/p99, plus time-to-first-token for streaming.

Set alerts on error-rate spikes, 429 rates, safety-event spikes, and latency SLO breaches.

Multi-model orchestration and hybrid LLM-rules engines

• Multi-model orchestrationroute by task: an SLM classifies/routes cheaply, a frontier LLM handles complex reasoning, an embedding model powers retrieval, a code model handles code. A model router (or your own routing logic) picks per request, cutting cost while preserving quality.
• Hybrid LLM + rules enginescombine deterministic business rules with LLM flexibility: rules pre-filter or validate (eligibility checks, compliance constraints, schema validation) while the LLM handles language understanding and generation. Rules give auditability and hard guarantees; the LLM handles ambiguity. In regulated scenarios, the rules engine — not the model — makes the final decision.

Part 3 · Implement computer vision solutions (13%)

This domain covers generative visual media, multimodal analysis, Content Understanding for visuals, and visual safety — a significant reshaping of the old AI-102 vision domain.

Text-to-image generation

Image generation models in Foundry (DALL·E-class and successors such as GPT-image models) turn prompts into images. Implementation knobs: size (e.g., 1024×1024, portrait/landscape variants), quality tiers, number of images, and output format (URL or base64). Prompt craft matters: subject + style + composition + lighting details produce controllable results. Generated images pass through content filtering on both the prompt and the output image, and Azure attaches C2PA content credentials for provenance.

result = client.images.generate(
    model="gpt-image-1",
    prompt="Isometric illustration of a data center, soft teal palette",
    size="1024x1024",
    n=1,
)

Text-to-video generation

Video generation (Sora-class models in Foundry) creates short clips from text prompts. You control duration, resolution/aspect ratio, and prompt-described motion and camera behavior. Generation is asynchronous — submit a job, poll for completion, download the result. Expect stricter content policies, higher cost, and region-limited availability compared with image generation; design UX around multi-second-to-minutes latency.

Image editing: inpainting, mask edits, prompt-driven changes

• Inpainting / mask editssupply a base image plus a mask; the model regenerates only masked regions per the prompt ("replace the sky with sunset"). Unmasked pixels are preserved.
• Prompt-driven editinginstruction-based edits without explicit masks ("make it winter"), plus variations that riff on a source image.
• Outpaintingextend an image beyond its borders.

Edits go through the same safety filtering as generation; source image + mask must align in dimensions.

Video editing workflows

Prompt-driven video workflows include regenerating segments with adjusted prompts, extending or remixing clips, and stitching generated segments in an editing pipeline. Practical guidance: keep per-clip prompts consistent (style tokens) for continuity, treat generation as a job queue with human review before publishing, and apply visual policy checks (below) to every output frame set.

Generation controls

Controls that shape output across image/video generation: prompt (positive description), size/aspect ratio, quality/fidelity tier, number of candidates, style presets where offered, seed-style reproducibility where supported, and — critically — content policy controls: prompts are rewritten/filtered, outputs are scanned, and violations return content-policy errors your code must handle gracefully.

Multimodal visual analysis, captions, and visual question answering

Multimodal chat models accept images alongside text:

• •
  Captions — ask for a concise one-liner or a detailed description; specify audience and length in the prompt.
• •
  Visual question answering (VQA) — "How many pallets are in this photo?" "Is the worker wearing a helmet?" — the model answers grounded in the supplied image.
• •
  Combine with structured outputs to get JSON (objects, attributes, counts) from an image.

Azure AI Vision (Image Analysis 4.0) remains the deterministic Foundry Tool alternative: captions, dense captions, tags, object detection with bounding boxes, people detection, and OCR — fixed schema, per-call pricing, no prompting.

Alt-text and accessibility descriptions

Generating accessibility descriptions is called out explicitly: produce alt-text that conveys the image's function and essential content in about a sentence, without "image of" filler; use detailed descriptions for complex figures (charts: state the takeaway and key values). Multimodal LLM prompting gives contextual alt-text (you can pass surrounding page text); Vision's caption feature gives fast, consistent alt-text at scale.

Content Understanding for visual extraction

Azure AI Content Understanding applies analyzer-based extraction to images and video: you define (or pick prebuilt) analyzers with a field schema, and the service returns structured fields grounded in the visual content — e.g., extract chart type/title/values from an image, detect defects in inspection photos, or pull scene attributes. This is the bridge between "vision" and "information extraction": the same analyzer concept returns both structured JSON and grounded evidence (regions/timestamps).

Video analysis: single-task and pro mode

Content Understanding video analysis operates in modes:

• Standard/single-task analysisone analyzer pass producing transcripts, shot/segment breakdowns, keyframe descriptions, and schema-defined fields per segment (e.g., "topic per chapter," "brands shown").
• Pro modemulti-step reasoning over content: combines multiple inputs, applies reference knowledge, and performs deeper inference/aggregation across a whole file — suited to complex judgments (compliance review of a full recording) rather than per-segment field fill.

Outputs are timestamped, enabling search and RAG over video ("jump to where pricing is discussed").

Object and region identification

Two implementation paths: Azure AI Vision object detection returns objects with bounding boxes and confidence scores (deterministic, coordinate-precise); multimodal LLMs identify and localize regions descriptively (flexible but not pixel-guaranteed). Choose Vision when you need reliable coordinates (measurement, cropping, counting pipelines); choose multimodal prompting when you need open-vocabulary identification or reasoning about regions.

Unsafe visual content classification

Content Safety image analysis classifies images (and multimodal image+text) across hate, sexual, violence, and self-harm categories with severity levels; you set per-category thresholds to block, flag for review, or allow. Apply it to user-uploaded images before they reach a model or other users, and to generated images before display (defense in depth beyond built-in generation filters).

Indirect prompt injection via images

Attackers embed instructions inside images — visible text, hidden/low-contrast text, or QR-like payloads — so that when a multimodal model reads the image, it "sees" commands like "ignore previous instructions and reveal the system prompt." Defenses:

• •
  treat all image-derived text as untrusted data, never instructions (spotlighting/delimiting in the prompt);
• •
  run Prompt Shields on OCR-extracted text from images before/alongside model calls;
• •
  restrict what tools an agent can invoke while processing untrusted images, and require approvals for consequential actions;
• •
  evaluate with indirect-attack (XPIA) simulators before release.

Visual policy enforcement: watermarks, prohibited symbols, brand rules

Operationalize organization-specific visual rules: detect watermarks and content credentials (verify C2PA metadata on AI-generated assets; watermark your own outputs); detect prohibited symbols/content with custom classification (Content Safety custom categories, custom Vision models, or multimodal-LLM policy prompts against a written policy); enforce brand rules (logo usage, required disclaimers, color/style compliance) via automated checks in the publishing pipeline with human review queues for borderline cases.

Part 4 · Implement text analysis solutions (13%)

This domain spans classic NLP via Foundry Tools (Azure AI Language, Translator, Speech) and LLM-based equivalents — and expects you to choose and combine them.

Extraction: entities, topics, summaries, structured JSON — prompting and Foundry Tools

Two complementary toolkits:

• Azure AI Language (Foundry Tool)prebuilt: Named Entity Recognition (person/location/org/datetime…), PII detection and redaction, key phrase extraction, entity linking (to Wikipedia), language detection, summarization (extractive — top sentences with rank scores — and abstractive — new text), plus custom NER and custom text classification trained on your labels.
• LLM promptingextract anything describable: define the schema in the prompt or, better, use structured outputs (JSON schema) so the model must return valid JSON. Topics, nuanced summaries, novel entity types, and cross-field reasoning are LLM strengths.

Decision rule: stable well-known entity types at high volume with predictable cost → Language service; custom/rare schemas, reasoning-heavy extraction, or rapidly changing requirements → LLM with structured outputs.

response = client.complete(
    model="gpt-4o",
    messages=[UserMessage(f"Extract fields from this contract:\n{text}")],
    response_format={"type": "json_schema", "json_schema": contract_schema},
)

Sentiment, tone, safety, and sensitive-content detection

• Sentiment analysis (Language)positive/neutral/negative labels with confidence at document and sentence level; opinion mining ties sentiment to specific targets ("battery" negative, "screen" positive).
• Tone via LLMclassify emotion, formality, urgency, sarcasm with a prompt rubric — richer than three-way sentiment.
• Safety detection (Content Safety text)the four harm categories with severity; use for user-generated content moderation and screening model I/O.
• Sensitive contentPII detection identifies and redacts names, phone numbers, addresses, financial and government IDs (with category selection); conversation PII handles transcripts. Route detected-PII documents to redaction before indexing or LLM calls.

Translation: Azure AI Translator and LLM-based flows

• Azure AI Translator (Foundry Tool)NMT across 100+ languages: text translation (multiple targets per call), transliteration (script conversion), language detection, and document translation (whole files — PDF/DOCX/etc. — with formatting preserved, batch async or single-file sync). Custom Translator trains domain-specific models from your parallel corpora for terminology fidelity.
• LLM translationprompt-driven translation excels at tone/style control ("translate to formal Japanese for an executive"), idiom, and translate-plus-transform tasks (translate and summarize). Costlier per token and less deterministic on strict terminology unless glossaries are prompted in.

High-volume, format-preserving, terminology-strict → Translator (with custom glossaries); style-sensitive, low-volume, combined tasks → LLM.

Domain customization: compliance summarization and similar

Adapting text analysis to a domain, three escalating approaches: (1) prompt engineering — role, domain glossary, output template, few-shot examples of compliant summaries (e.g., "summarize this audit finding citing the regulation section, flag unresolved risks"); (2) grounding/RAG — retrieve regulation text or policy so summaries cite the actual clauses; (3) fine-tuning — when a large corpus of gold-standard domain outputs exists and prompt approaches plateau. Compliance summarization scenarios reward: structured outputs, retained source citations, PII handling, and evaluation with domain-specific rubrics (LLM-as-judge with a compliance checklist).

Speech-to-text and text-to-speech for agents

Azure AI Speech (Foundry Tool):

• Speech-to-text (STT)real-time streaming recognition (continuous recognition from mic), fast/batch transcription for files, with punctuation, profanity filtering, diarization, and word-level timestamps.
• Text-to-speech (TTS)neural voices across many languages/styles; SSML controls pronunciation, rate, pitch, pauses, and speaking styles; custom neural voice creates a branded voice (gated with responsible-use requirements and required disclosure).

For agents, the Speech SDK (azure-cognitiveservices-speech / azure-ai-speech) wraps mic/speaker I/O; latency is minimized by streaming recognition in and starting TTS on the first response tokens.

Speech as an agent modality and custom speech models

Voice-enabling an agent = STT front door → agent (text pipeline unchanged) → TTS out, or increasingly a realtime/voice-live API that handles the full speech-in/speech-out loop against a model with barge-in support. Custom speech improves recognition where the base model struggles: train with domain text (vocabulary/jargon), pronunciation files, and/or labeled audio to handle acoustic conditions — deploy the custom model to an endpoint and reference it from the SDK. Test with word-error-rate (WER) comparisons against the base model.

Multimodal audio reasoning

Audio-capable multimodal models accept audio directly in the conversation — transcribe and reason in one step: summarize a meeting from the recording, detect speaker sentiment/hesitation, answer questions about a call ("did the agent read the required disclosure?"). Contrast with the pipeline approach (Speech STT → text LLM): the pipeline is cheaper and gives you the transcript artifact; native audio reasoning captures paralinguistic cues (tone, emphasis) the transcript loses. Content Understanding audio analyzers cover the structured-extraction flavor (call summaries, per-speaker fields) with grounding.

Speech translation

Speech translation (Speech service) does streaming speech-to-text translation into one or more target languages simultaneously, and can synthesize translated audio (speech-to-speech) — the live-interpreter scenario. Alternatively compose: STT → Translator → TTS, which gives more control (custom terminology via Custom Translator) at the cost of added latency. Know that the Speech service's TranslationRecognizer handles the integrated path with a single stream.

Part 5 · Implement information extraction solutions (14%)

This domain is the data-plane of RAG and agents: ingesting any content type, enriching and indexing it, and serving semantic/hybrid/vector retrieval — with Content Understanding as the star extraction engine.

Content ingestion and indexing: documents, images, audio, video

The canonical Azure AI Search pipeline: data source → indexer → skillset → index. Indexers pull from Blob Storage, ADLS, Cosmos DB, SQL, and more on schedules; skillsets enrich during indexing; the index stores searchable fields + vectors. For non-text media, extraction services convert content to indexable text/structure first:

• •
  documents → Document Intelligence / Content Understanding (text, layout, fields, markdown);
• •
  images → OCR + captions/descriptions (Vision or multimodal LLM or CU);
• •
  audio → Speech transcription or CU audio analyzers (transcript + fields);
• •
  video → CU video analysis (timestamped transcript + segment descriptions).

Index design: fields flagged searchable/filterable/sortable/facetable/retrievable; vector fields with dimension + HNSW profile; metadata (source, page, timestamp) for citations and filters. Push (your code uploads JSON documents) versus pull (indexer) are the two loading models.

Semantic, hybrid, and vector search for grounding

Query-side details: vectorQueries with k-nearest neighbors, filtered vector search (metadata pre-filtering), integrated query vectorization (the index embeds the query for you), and scoring profiles for boosting. For grounding agents, hybrid + semantic ranker with top 3–5 chunks and source metadata is the standard recipe.

Enrichment with built-in and custom skills

Skillsets transform documents during indexing:

• Built-in skillsOCR, image analysis, entity recognition, PII detection, key phrases, language detection, translation, Text Split (chunking), and embedding skills (call an embedding deployment to vectorize chunks).
• Custom skillsa Web API skill calls your endpoint (Azure Function/Container App) with document payloads and merges the JSON response into the enrichment tree — the extension point for anything the built-ins can't do (custom models, external APIs, CU analyzer calls).
• Knowledge storeoptionally project enriched output to tables/blobs for analytics beyond search.

Index projections map one source document to many chunk documents (parent-child), the backbone of integrated vectorization.

RAG ingestion including OCR

For scanned or image-heavy content, OCR is the entry ticket to RAG: use the OCR skill (or Document Intelligence Read/Layout, or CU) to extract text, merge it with native text (Merge skill), split into chunks, embed, and index. Layout-aware chunking (respecting headings, tables, reading order — Document Intelligence Layout or CU markdown output) markedly improves retrieval quality versus blind fixed-size chunks because chunks align with semantic units. Preserve page numbers and bounding regions as metadata so answers can cite page-level sources.

Retrieval pipelines wired to workflows and agent tools

Retrieval must be callable from your orchestration layer:

• App-orchestratedyour Python code queries AI Search and stuffs results into the prompt (max control).
• "On your data"attach the index as a data source in chat completions; the platform handles retrieve-then-generate and returns citations.
• Agent knowledge toolsbind the index (or file search vector store) to an agent; retrieval happens inside the agent loop when the agent decides it needs knowledge. Foundry's agentic retrieval / knowledge-agent capability goes further: it uses an LLM to plan multiple subqueries, run them in parallel, and merge results for complex questions.
• Custom retrieval toolexpose your bespoke pipeline (multi-index, re-ranking, filters by user permissions) as a function/OpenAPI tool so agents call it like any other tool — the right pattern when retrieval must enforce document-level security trimming.

Multimodal extraction: OCR, layout, field extraction

Azure AI Document Intelligence remains the document workhorse: Read (OCR), Layout (structure: paragraphs, tables, selection marks, reading order, markdown output), prebuilt models (invoices, receipts, IDs, tax forms — typed fields with confidence), and custom models (template and neural, trained on labeled samples; composed models route mixed document types). Content Understanding generalizes this beyond documents: one service, one analyzer concept, across documents, images, audio, and video — schema-driven field extraction with confidence scores and grounding (where in the source each value came from). Confidence scores drive human-in-the-loop review thresholds in production pipelines.

Grounded representations via Content Understanding

CU's differentiator is that every extracted value is grounded: field results carry source references (page/polygon for documents, timestamp ranges for audio/video), enabling verification UIs (click a value, see the highlighted source region) and audit trails. For RAG, grounded structured output means your knowledge base stores not just chunk text but provenance — so agent citations can point to the exact page or moment, and groundedness evaluation has real evidence to check against.

Content Understanding analyzers: structured and markdown outputs

An analyzer = base analysis mode + your field schema (field names, types, descriptions/generation instructions) for a content type. You create analyzers from prebuilt templates or from scratch, test on samples, and call them via REST/SDK: submit content, poll the async operation, receive results containing (a) structured JSON — the schema's fields with values, confidence, and grounding spans — and (b) content markdown — a faithful markdown rendering of the source (headings, tables, transcript) ideal for chunking into RAG indexes. Field types include extractive (pull the value), classify (choose from options), and generative (summarize/derive). Analyzers are the exam's canonical answer for "turn heterogeneous content into consistent, structured, grounded data at scale."

Exam-Day Checklist

• Weights drive time~60% of the exam is Parts 1–2 (planning/management + generative/agentic). Be fastest and surest on model selection, deployment types, quotas/429 handling, RAG mechanics, agent tools/threads/runs, multi-agent patterns, evaluators, and governance.
• Security reflexmanaged identity + DefaultAzureCredential + least-privilege RBAC + private endpoints beats keys every time.
• Deployment matchingStandard = serverless per-token; Global = bigger quota/fleet routing; PTU = reserved throughput for predictable latency; Batch = cheap async offline.
• RAG debugging orderretrieval quality → prompt/grounding instructions → model choice. Hybrid + semantic ranker is the default retrieval recipe.
• Agent loop vocabularyagent (model + instructions + tools) → thread (conversation) → run (execution) → run steps (model/tool calls) → requires_action for function outputs.
• Tool integration ladderbuilt-in tools → function tools (your Python) → OpenAPI tools (existing REST APIs) → MCP servers (shared tool catalogs).
• Orchestration patternssequential, concurrent, group chat, handoff, connected agents — match the scenario's control flow.
• Evaluatorsgroundedness = fabrication check; relevance = on-topic; agent trio = intent resolution, tool call accuracy, task adherence; XPIA = indirect-attack susceptibility; red teaming agent = pre-launch adversarial probing.
• Safety stackcontent filters (4 categories × severity) on deployments; Prompt Shields for jailbreak + indirect injection; groundedness detection; protected material; blocklists.
• Injection-via-contentimages and retrieved documents are untrusted data — spotlight/delimit, scan, and privilege-gate; never treat them as instructions.
• Tools vs LLMdeterministic schema/volume/compliance → Language/Translator/Speech/Vision/Document Intelligence; open-ended reasoning/style/novel schemas → LLM (with structured outputs).
• CU everywhereanalyzer + schema → structured JSON + grounding + markdown, across documents/images/audio/video; standard vs pro mode for video.
• Search modesBM25 = exact terms; vector = semantics; hybrid (RRF) = default; semantic ranker = precision re-rank at top-k.
• Logistics~50 questions in 120 minutes; 700/1000 to pass; case studies bookend — bank time for them; mark-and-review anything uncertain; 24-hour retake wait if needed.

Official Resources

• Exam page and skills outlinelearn.microsoft.com → Credentials → Azure AI Apps and Agents Developer Associate (AI-103): the authoritative skills-measured document (April 16, 2026) and any updates.
• Microsoft Learn learning paths for AI-103free, hands-on modules covering Foundry projects, model deployment, RAG with Azure AI Search, Agent Service, evaluation, Content Understanding, Vision, Language, Speech, and Translator.
• Microsoft Foundry documentationlearn.microsoft.com/azure/ai-foundry: model catalog, deployments, Agent Service, evaluation SDK, tracing/observability, and security configuration.
• Azure AI services documentationservice-specific docs for AI Search, Content Understanding, Document Intelligence, Content Safety, Language, Translator, Speech, and Vision.
• Foundry SDK references and samplesazure-ai-projects, azure-ai-inference, azure-ai-evaluation, and the Azure SDK for Python GitHub samples (agents, RAG, evaluation, tracing).
• Microsoft Learn practice assessmentthe official practice test for AI-103; use it to calibrate readiness and identify weak domains.
• Responsible AI resourcesMicrosoft Responsible AI Standard, transparency notes per service, and the Foundry risk & safety evaluation documentation.
• Exam sandbox and Pearson VUEfamiliarize yourself with question formats (aka.ms exam sandbox) and check online-proctoring system requirements before exam day.

Good luck — build at least one end-to-end project (RAG + agent with a function tool + evaluation run + tracing) before you sit the exam. The scenarios reward people who have actually shipped the loop, not just read about it.