@ivannxbt/ai-config 0.1.0

package/.agents/skills/microsoft-foundry/references/auth-best-practices.md

@@ -0,0 +1,128 @@
+# Azure Authentication Best Practices
+
+> Source: [Microsoft — Passwordless connections for Azure services](https://learn.microsoft.com/azure/developer/intro/passwordless-overview) and [Azure Identity client libraries](https://learn.microsoft.com/dotnet/azure/sdk/authentication/).
+
+## Golden Rule
+
+Use **managed identities** and **Azure RBAC** in production. Reserve `DefaultAzureCredential` for **local development only**.
+
+## Authentication by Environment
+
+| Environment | Recommended Credential | Why |
+|---|---|---|
+| **Production (Azure-hosted)** | `ManagedIdentityCredential` (system- or user-assigned) | No secrets to manage; auto-rotated by Azure |
+| **Production (on-premises)** | `ClientCertificateCredential` or `WorkloadIdentityCredential` | Deterministic; no fallback chain overhead |
+| **CI/CD pipelines** | `AzurePipelinesCredential` / `WorkloadIdentityCredential` | Scoped to pipeline identity |
+| **Local development** | `DefaultAzureCredential` | Chains CLI, PowerShell, and VS Code credentials for convenience |
+
+## Why Not `DefaultAzureCredential` in Production?
+
+1. **Unpredictable fallback chain** — walks through multiple credential types, adding latency and making failures harder to diagnose.
+2. **Broad surface area** — checks environment variables, CLI tokens, and other sources that should not exist in production.
+3. **Non-deterministic** — which credential actually authenticates depends on the environment, making behavior inconsistent across deployments.
+4. **Performance** — each failed credential attempt adds network round-trips before falling back to the next.
+
+## Production Patterns
+
+### .NET
+
+```csharp
+using Azure.Identity;
+
+var credential = Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"
+    ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials
+    : new ManagedIdentityCredential();                      // production — deterministic, no fallback chain
+// For user-assigned identity: new ManagedIdentityCredential("<client-id>")
+```
+
+### TypeScript / JavaScript
+
+```typescript
+import { DefaultAzureCredential, ManagedIdentityCredential } from "@azure/identity";
+
+const credential = process.env.NODE_ENV === "development"
+  ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials
+  : new ManagedIdentityCredential();                      // production — deterministic, no fallback chain
+// For user-assigned identity: new ManagedIdentityCredential("<client-id>")
+```
+
+### Python
+
+```python
+import os
+from azure.identity import DefaultAzureCredential, ManagedIdentityCredential
+
+credential = (
+    DefaultAzureCredential()                              # local dev — uses CLI/VS credentials
+    if os.getenv("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"
+    else ManagedIdentityCredential()                      # production — deterministic, no fallback chain
+)
+# For user-assigned identity: ManagedIdentityCredential(client_id="<client-id>")
+```
+
+### Java
+
+```java
+import com.azure.identity.DefaultAzureCredentialBuilder;
+import com.azure.identity.ManagedIdentityCredentialBuilder;
+
+var credential = "Development".equals(System.getenv("AZURE_FUNCTIONS_ENVIRONMENT"))
+    ? new DefaultAzureCredentialBuilder().build()          // local dev — uses CLI/VS credentials
+    : new ManagedIdentityCredentialBuilder().build();      // production — deterministic, no fallback chain
+// For user-assigned identity: new ManagedIdentityCredentialBuilder().clientId("<client-id>").build()
+```
+
+## Local Development Setup
+
+`DefaultAzureCredential` is ideal for local dev because it automatically picks up credentials from developer tools:
+
+1. **Azure CLI** — `az login`
+2. **Azure Developer CLI** — `azd auth login`
+3. **Azure PowerShell** — `Connect-AzAccount`
+4. **Visual Studio / VS Code** — sign in via Azure extension
+
+```typescript
+import { DefaultAzureCredential } from "@azure/identity";
+
+// Local development only — uses CLI/PowerShell/VS Code credentials
+const credential = new DefaultAzureCredential();
+```
+
+## Environment-Aware Pattern
+
+Detect the runtime environment and select the appropriate credential. The key principle: use `DefaultAzureCredential` only when running locally, and a specific credential in production.
+
+> **Tip:** Azure Functions sets `AZURE_FUNCTIONS_ENVIRONMENT` to `"Development"` when running locally. For App Service or containers, use any environment variable you control (e.g. `NODE_ENV`, `ASPNETCORE_ENVIRONMENT`).
+
+```typescript
+import { DefaultAzureCredential, ManagedIdentityCredential } from "@azure/identity";
+
+function getCredential() {
+  if (process.env.NODE_ENV === "development") {
+    return new DefaultAzureCredential();          // picks up az login / VS Code creds
+  }
+  return process.env.AZURE_CLIENT_ID
+    ? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID)  // user-assigned
+    : new ManagedIdentityCredential();                            // system-assigned
+}
+```
+
+## Security Checklist
+
+- [ ] Use managed identity for all Azure-hosted apps
+- [ ] Never hardcode credentials, connection strings, or keys
+- [ ] Apply least-privilege RBAC roles at the narrowest scope
+- [ ] Use `ManagedIdentityCredential` (not `DefaultAzureCredential`) in production
+- [ ] Store any required secrets in Azure Key Vault
+- [ ] Rotate secrets and certificates on a schedule
+- [ ] Enable Microsoft Defender for Cloud on production resources
+
+## Further Reading
+
+- [Passwordless connections overview](https://learn.microsoft.com/azure/developer/intro/passwordless-overview)
+- [Managed identities overview](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview)
+- [Azure RBAC overview](https://learn.microsoft.com/azure/role-based-access-control/overview)
+- [.NET authentication guide](https://learn.microsoft.com/dotnet/azure/sdk/authentication/)
+- [Python identity library](https://learn.microsoft.com/python/api/overview/azure/identity-readme)
+- [JavaScript identity library](https://learn.microsoft.com/javascript/api/overview/azure/identity-readme)
+- [Java identity library](https://learn.microsoft.com/java/api/overview/azure/identity-readme)

package/.agents/skills/microsoft-foundry/references/sdk/foundry-sdk-py.md

@@ -0,0 +1,263 @@
+# Microsoft Foundry - Python SDK Guide
+
+Python-specific implementations for working with Microsoft Foundry.
+
+## Prerequisites
+
+```bash
+pip install azure-ai-projects azure-identity azure-ai-inference openai azure-ai-evaluation python-dotenv
+```
+
+### Environment Variables
+
+```bash
+PROJECT_ENDPOINT=https://<resource>.services.ai.azure.com/api/projects/<project>
+MODEL_DEPLOYMENT_NAME=gpt-4o
+AZURE_AI_SEARCH_CONNECTION_NAME=my-search-connection
+AI_SEARCH_INDEX_NAME=my-index
+AZURE_OPENAI_ENDPOINT=https://<resource>.openai.azure.com
+AZURE_OPENAI_DEPLOYMENT=gpt-4o
+```
+
+## Model Discovery and Deployment (MCP)
+
+```python
+foundry_models_list()                              # All models
+foundry_models_list(publisher="OpenAI")             # Filter by publisher
+foundry_models_list(search_for_free_playground=True) # Free playground models
+
+foundry_models_deploy(
+    resource_group="my-rg", deployment="gpt-4o-deployment",
+    model_name="gpt-4o", model_format="OpenAI",
+    azure_ai_services="my-foundry-resource",
+    model_version="2024-05-13", sku_capacity=10, scale_type="Standard"
+)
+```
+
+## RAG Agent with Azure AI Search
+
+> **Auth:** `DefaultAzureCredential` is for local development. See [auth-best-practices.md](../auth-best-practices.md) for production patterns.
+
+```python
+import os
+from azure.ai.projects import AIProjectClient
+from azure.identity import DefaultAzureCredential
+from azure.ai.agents.models import (
+    AzureAISearchToolDefinition, AzureAISearchToolResource,
+    AISearchIndexResource, AzureAISearchQueryType,
+)
+
+project_client = AIProjectClient(
+    endpoint=os.environ["FOUNDRY_PROJECT_ENDPOINT"],
+    credential=DefaultAzureCredential(),
+)
+
+azs_connection = project_client.connections.get(
+    os.environ["AZURE_AI_SEARCH_CONNECTION_NAME"]
+)
+
+agent = project_client.agents.create_agent(
+    model=os.environ["FOUNDRY_MODEL_DEPLOYMENT_NAME"],
+    name="RAGAgent",
+    instructions="You are a helpful assistant. Use the knowledge base to answer. "
+        "Provide citations as: `[message_idx:search_idx†source]`.",
+    tools=[AzureAISearchToolDefinition(
+        azure_ai_search=AzureAISearchToolResource(indexes=[
+            AISearchIndexResource(
+                index_connection_id=azs_connection.id,
+                index_name=os.environ["AI_SEARCH_INDEX_NAME"],
+                query_type=AzureAISearchQueryType.HYBRID,
+            ),
+        ])
+    )],
+)
+```
+
+### Querying a RAG Agent (Streaming)
+
+```python
+openai_client = project_client.get_openai_client()
+
+stream = openai_client.responses.create(
+    stream=True, tool_choice="required", input="Your question here",
+    extra_body={"agent": {"name": agent.name, "type": "agent_reference"}},
+)
+for event in stream:
+    if event.type == "response.output_text.delta":
+        print(event.delta, end="", flush=True)
+    elif event.type == "response.output_item.done":
+        if event.item.type == "message" and event.item.content[-1].type == "output_text":
+            for ann in event.item.content[-1].annotations:
+                if ann.type == "url_citation":
+                    print(f"\nCitation: {ann.url}")
+```
+
+## Creating Agents
+
+### Basic Agent
+
+```python
+agent = project_client.agents.create_agent(
+    model=os.environ["MODEL_DEPLOYMENT_NAME"],
+    name="my-agent",
+    instructions="You are a helpful assistant.",
+)
+```
+
+### Agent with Custom Function Tools
+
+```python
+from azure.ai.agents.models import FunctionTool, ToolSet
+
+def get_weather(location: str, unit: str = "celsius") -> str:
+    """Get the current weather for a location."""
+    return f"Sunny and 22°{unit[0].upper()} in {location}"
+
+functions = FunctionTool([get_weather])
+toolset = ToolSet()
+toolset.add(functions)
+
+agent = project_client.agents.create_agent(
+    model=os.environ["MODEL_DEPLOYMENT_NAME"],
+    name="function-agent",
+    instructions="You are a helpful assistant with tool access.",
+    toolset=toolset,
+)
+```
+
+### Agent with Web Search
+
+```python
+from azure.ai.projects.models import (
+    PromptAgentDefinition, WebSearchPreviewTool, ApproximateLocation,
+)
+
+agent = project_client.agents.create_version(
+    agent_name="WebSearchAgent",
+    definition=PromptAgentDefinition(
+        model=os.environ["MODEL_DEPLOYMENT_NAME"],
+        instructions="Search the web for current information. Provide sources.",
+        tools=[
+            WebSearchPreviewTool(
+                user_location=ApproximateLocation(
+                    country="US", city="Seattle", region="Washington"
+                )
+            )
+        ],
+    ),
+)
+```
+
+> 💡 **Tip:** `WebSearchPreviewTool` requires no external resource or connection. For Bing Grounding (which requires a dedicated Bing resource and project connection), see [Bing Grounding reference](../../foundry-agent/create/references/tool-bing-grounding.md).
+
+### Interacting with Agents
+
+```python
+from azure.ai.agents.models import ListSortOrder
+
+thread = project_client.agents.threads.create()
+project_client.agents.messages.create(thread_id=thread.id, role="user", content="Hello")
+
+run = project_client.agents.runs.create_and_process(thread_id=thread.id, agent_id=agent.id)
+if run.status == "failed":
+    print(f"Run failed: {run.last_error}")
+
+messages = project_client.agents.messages.list(thread_id=thread.id, order=ListSortOrder.ASCENDING)
+for msg in messages:
+    if msg.text_messages:
+        print(f"{msg.role}: {msg.text_messages[-1].text.value}")
+
+project_client.agents.delete_agent(agent.id)
+```
+
+## Agent Evaluation
+
+### Single Response Evaluation (MCP)
+
+```python
+foundry_agents_query_and_evaluate(
+    agent_id="<agent-id>", query="What's the weather?",
+    endpoint="https://my-foundry.services.ai.azure.com/api/projects/my-project",
+    azure_openai_endpoint="https://my-openai.openai.azure.com",
+    azure_openai_deployment="gpt-4o",
+    evaluators="intent_resolution,task_adherence,tool_call_accuracy"
+)
+
+foundry_agents_evaluate(
+    query="What's the weather?", response="Sunny and 22°C.",
+    evaluator="intent_resolution",
+    azure_openai_endpoint="https://my-openai.openai.azure.com",
+    azure_openai_deployment="gpt-4o"
+)
+```
+
+### Batch Evaluation
+
+```python
+from azure.ai.evaluation import AIAgentConverter, IntentResolutionEvaluator, evaluate
+
+converter = AIAgentConverter(project_client)
+converter.prepare_evaluation_data(thread_ids=["t1", "t2", "t3"], filename="eval_data.jsonl")
+
+result = evaluate(
+    data="eval_data.jsonl",
+    evaluators={
+        "intent_resolution": IntentResolutionEvaluator(
+            azure_openai_endpoint=os.environ["AZURE_OPENAI_ENDPOINT"],
+            azure_openai_deployment=os.environ["AZURE_OPENAI_DEPLOYMENT"]
+        ),
+    },
+    output_path="./eval_results"
+)
+print(f"Results: {result['studio_url']}")
+```
+
+> 💡 **Tip:** Continuous evaluation requires project managed identity with **Azure AI User** role and Application Insights connected to the project.
+
+## Knowledge Index Operations (MCP)
+
+```python
+foundry_knowledge_index_list(endpoint="<project-endpoint>")
+foundry_knowledge_index_schema(endpoint="<project-endpoint>", index="my-index")
+```
+
+## Best Practices
+
+1. **Never hardcode credentials** — use environment variables and `python-dotenv`
+2. **Check `run.status`** and handle `HttpResponseError` exceptions
+3. **Reuse `AIProjectClient`** instances — don't create new ones per request
+4. **Use type hints** in custom functions for better tool integration
+5. **Use context managers** for agent cleanup
+
+## Error Handling
+
+```python
+from azure.core.exceptions import HttpResponseError
+
+try:
+    agent = project_client.agents.create_agent(
+        model=os.environ["MODEL_DEPLOYMENT_NAME"],
+        name="my-agent", instructions="You are helpful."
+    )
+except HttpResponseError as e:
+    if e.status_code == 429:
+        print("Rate limited — wait and retry with exponential backoff.")
+    elif e.status_code == 401:
+        print("Authentication failed — check credentials.")
+    else:
+        print(f"Error: {e.message}")
+```
+
+### Context Manager for Agent Cleanup
+
+```python
+from contextlib import contextmanager
+
+@contextmanager
+def temporary_agent(project_client, **kwargs):
+    agent = project_client.agents.create_agent(**kwargs)
+    try:
+        yield agent
+    finally:
+        project_client.agents.delete_agent(agent.id)
+```

package/.agents/skills/microsoft-foundry/resource/create/create-foundry-resource.md

@@ -0,0 +1,150 @@
+---
+name: microsoft-foundry:resource/create
+description: |
+  Create Azure AI Services multi-service resource (Foundry resource) using Azure CLI.
+  USE FOR: create Foundry resource, new AI Services resource, create multi-service resource, provision Azure AI Services, AIServices kind resource, register resource provider, enable Cognitive Services, setup AI Services account, create resource group for Foundry.
+  DO NOT USE FOR: creating ML workspace hubs (use microsoft-foundry:project/create), deploying models (use microsoft-foundry:models/deploy), managing permissions (use microsoft-foundry:rbac), monitoring resource usage (use microsoft-foundry:quota).
+compatibility:
+  required:
+    - azure-cli: ">=2.0"
+  optional:
+    - powershell: ">=7.0"
+    - azure-portal: "any"
+---
+
+# Create Foundry Resource
+
+This sub-skill orchestrates creation of Azure AI Services multi-service resources using Azure CLI.
+
+> **Important:** All resource creation operations are **control plane (management)** operations. Use **Azure CLI commands** as the primary method.
+
+> **Note:** For monitoring resource usage and quotas, use the `microsoft-foundry:quota` skill.
+
+## Quick Reference
+
+| Property | Value |
+|----------|-------|
+| **Classification** | WORKFLOW SKILL |
+| **Operation Type** | Control Plane (Management) |
+| **Primary Method** | Azure CLI: `az cognitiveservices account create` |
+| **Resource Type** | `Microsoft.CognitiveServices/accounts` (kind: `AIServices`) |
+| **Resource Kind** | `AIServices` (multi-service) |
+
+## When to Use
+
+Use this sub-skill when you need to:
+
+- **Create Foundry resource** - Provision new Azure AI Services multi-service account
+- **Create resource group** - Set up resource group before creating resources
+- **Register resource provider** - Enable Microsoft.CognitiveServices provider
+- **Manual resource creation** - CLI-based resource provisioning
+
+**Do NOT use for:**
+- Creating ML workspace hubs/projects (use `microsoft-foundry:project/create`)
+- Deploying AI models (use `microsoft-foundry:models/deploy`)
+- Managing RBAC permissions (use `microsoft-foundry:rbac`)
+- Monitoring resource usage (use `microsoft-foundry:quota`)
+
+## Prerequisites
+
+- **Azure subscription** - Active subscription ([create free account](https://azure.microsoft.com/pricing/purchase-options/azure-account))
+- **Azure CLI** - Version 2.0 or later installed
+- **Authentication** - Run `az login` before commands
+- **RBAC roles** - One of:
+  - Contributor
+  - Owner
+  - Custom role with `Microsoft.CognitiveServices/accounts/write`
+- **Resource provider** - `Microsoft.CognitiveServices` must be registered in your subscription
+  - If not registered, see [Workflow #3: Register Resource Provider](#3-register-resource-provider)
+  - If you lack permissions, ask a subscription Owner/Contributor to register it or grant you `/register/action` privilege
+
+> **Need RBAC help?** See [microsoft-foundry:rbac](../../rbac/rbac.md) for permission management.
+
+## Core Workflows
+
+### 1. Create Resource Group
+
+**Command Pattern:** "Create a resource group for my Foundry resources"
+
+#### Steps
+
+1. **Ask user preference**: Use existing or create new resource group
+2. **If using existing**: List and let user select from available groups (0-4: show all, 5+: show 5 most recent with "Other" option)
+3. **If creating new**: Ask user to choose region, then create
+
+```bash
+# List existing resource groups
+az group list --query "[-5:].{Name:name, Location:location}" --out table
+
+# Or create new
+az group create --name <rg-name> --location <location>
+az group show --name <rg-name> --query "{Name:name, Location:location, State:properties.provisioningState}"
+```
+
+See [Detailed Workflow Steps](./references/workflows.md) for complete instructions.
+
+---
+
+### 2. Create Foundry Resource
+
+**Command Pattern:** "Create a new Azure AI Services resource"
+
+#### Steps
+
+1. **Verify prerequisites**: Check Azure CLI, authentication, and provider registration
+2. **Choose location**: Always ask user to select region (don't assume resource group location)
+3. **Create resource**: Use `--kind AIServices` and `--sku S0` (only supported tier)
+4. **Verify and get keys**
+
+```bash
+# Create Foundry resource
+az cognitiveservices account create \
+  --name <resource-name> \
+  --resource-group <rg> \
+  --kind AIServices \
+  --sku S0 \
+  --location <location> \
+  --yes
+
+# Verify and get keys
+az cognitiveservices account show --name <resource-name> --resource-group <rg>
+az cognitiveservices account keys list --name <resource-name> --resource-group <rg>
+```
+
+**Important:** S0 (Standard) is the only supported SKU - F0 free tier not available for AIServices.
+
+See [Detailed Workflow Steps](./references/workflows.md) for complete instructions.
+
+---
+
+### 3. Register Resource Provider
+
+**Command Pattern:** "Register Cognitive Services provider"
+
+Required when first creating Cognitive Services in subscription or if you get `ResourceProviderNotRegistered` error.
+
+```bash
+# Register provider (requires Owner/Contributor role)
+az provider register --namespace Microsoft.CognitiveServices
+az provider show --namespace Microsoft.CognitiveServices --query "registrationState"
+```
+
+If you lack permissions, ask a subscription Owner/Contributor to register it or use `microsoft-foundry:rbac` skill.
+
+See [Detailed Workflow Steps](./references/workflows.md) for complete instructions.
+
+---
+
+## Important Notes
+
+- **Resource kind must be `AIServices`** for multi-service Foundry resources
+- **SKU must be S0** (Standard) - F0 free tier not available for AIServices
+- Always ask user to choose location - different regions may have varying availability
+
+---
+
+## Additional Resources
+
+- [Common Patterns](./references/patterns.md) - Quick setup patterns and command reference
+- [Troubleshooting](./references/troubleshooting.md) - Common errors and solutions
+- [Azure AI Services documentation](https://learn.microsoft.com/en-us/azure/ai-services/multi-service-resource?pivots=azcli)

package/.agents/skills/microsoft-foundry/resource/create/references/patterns.md

@@ -0,0 +1,134 @@
+# Common Patterns: Create Foundry Resource
+
+## Pattern A: Quick Setup
+
+Complete setup in one go:
+
+```bash
+# Ask user: "Use existing resource group or create new?"
+
+# ==== If user chooses "Use existing" ====
+# Count and list existing resource groups
+TOTAL_RG_COUNT=$(az group list --query "length([])" -o tsv)
+az group list --query "[-5:].{Name:name, Location:location}" --out table
+
+# Based on count: show appropriate list and options
+# User selects resource group
+RG="<selected-rg-name>"
+
+# Fetch details to verify
+az group show --name $RG --query "{Name:name, Location:location, State:properties.provisioningState}"
+# Then skip to creating Foundry resource below
+
+# ==== If user chooses "Create new" ====
+# List regions and ask user to choose
+az account list-locations --query "[].{Region:name}" --out table
+
+# Variables
+RG="rg-ai-services"  # New resource group name
+LOCATION="westus2"  # User's chosen location
+RESOURCE_NAME="my-foundry-resource"
+
+# Create new resource group
+az group create --name $RG --location $LOCATION
+
+# Verify creation
+az group show --name $RG --query "{Name:name, Location:location, State:properties.provisioningState}"
+
+# Create Foundry resource in user's chosen location
+az cognitiveservices account create \
+  --name $RESOURCE_NAME \
+  --resource-group $RG \
+  --kind AIServices \
+  --sku S0 \
+  --location $LOCATION \
+  --yes
+
+# Get endpoint and keys
+echo "Resource created successfully!"
+az cognitiveservices account show \
+  --name $RESOURCE_NAME \
+  --resource-group $RG \
+  --query "{Endpoint:properties.endpoint, Location:location}"
+
+az cognitiveservices account keys list \
+  --name $RESOURCE_NAME \
+  --resource-group $RG
+```
+
+## Pattern B: Multi-Region Setup
+
+Create resources in multiple regions:
+
+```bash
+# Variables
+RG="rg-ai-services"
+REGIONS=("eastus" "westus2" "westeurope")
+
+# Create resource group
+az group create --name $RG --location eastus
+
+# Create resources in each region
+for REGION in "${REGIONS[@]}"; do
+  RESOURCE_NAME="foundry-${REGION}"
+  echo "Creating resource in $REGION..."
+
+  az cognitiveservices account create \
+    --name $RESOURCE_NAME \
+    --resource-group $RG \
+    --kind AIServices \
+    --sku S0 \
+    --location $REGION \
+    --yes
+
+  echo "Resource $RESOURCE_NAME created in $REGION"
+done
+
+# List all resources
+az cognitiveservices account list --resource-group $RG --output table
+```
+
+## Quick Commands Reference
+
+```bash
+# Count total resource groups to determine which scenario applies
+az group list --query "length([])" -o tsv
+
+# Check existing resource groups (up to 5 most recent)
+# 0 → create new | 1-4 → select or create | 5+ → select/other/create
+az group list --query "[-5:].{Name:name, Location:location}" --out table
+
+# If 5+ resource groups exist and user selects "Other", show all
+az group list --query "[].{Name:name, Location:location}" --out table
+
+# If user selects existing resource group, fetch details to verify and get location
+az group show --name <selected-rg-name> --query "{Name:name, Location:location, State:properties.provisioningState}"
+
+# List available regions (for creating new resource group)
+az account list-locations --query "[].{Region:name}" --out table
+
+# Create resource group (if needed)
+az group create --name rg-ai-services --location westus2
+
+# Create Foundry resource
+az cognitiveservices account create \
+  --name my-foundry-resource \
+  --resource-group rg-ai-services \
+  --kind AIServices \
+  --sku S0 \
+  --location westus2 \
+  --yes
+
+# List resources in group
+az cognitiveservices account list --resource-group rg-ai-services
+
+# Get resource details
+az cognitiveservices account show \
+  --name my-foundry-resource \
+  --resource-group rg-ai-services
+
+# Delete resource
+az cognitiveservices account delete \
+  --name my-foundry-resource \
+  --resource-group rg-ai-services
+```