From first project to a governed fleet of AI agents

1. Sign in to Microsoft FoundryMake sure the New Foundry toggle is on. You need an Azure subscription and a role that can create a Foundry resource, such as Foundry Account Owner or Foundry Owner on the subscription or resource group.
2. Select the project name (upper left), then Create new projectGive it a name and select Create project.
3. Optional: advanced optionsPick an existing resource group or create a new one (recommended when starting, so you can manage and delete everything together), and choose the Location where project resources are hosted.
4. Wait for provisioning, then copy the project endpointThe welcome screen shows it in the form https://<resource>.services.ai.azure.com/api/projects/<project>. Deploy a model next (Discover › Model catalog › Deploy).

Create the resource, then a default project. Requires azure-identity and azure-mgmt-cognitiveservices>=13.7.0 and an az login session.

from azure.identity import DefaultAzureCredential
from azure.mgmt.cognitiveservices import CognitiveServicesManagementClient

client = CognitiveServicesManagementClient(
    credential=DefaultAzureCredential(),
    subscription_id="<subscription-id>",
    api_version="2025-04-01-preview",
)

# 1) Foundry resource
client.accounts.begin_create(
    resource_group_name="<rg>", account_name="<foundry-resource>",
    account={
        "location": "eastus", "kind": "AIServices", "sku": {"name": "S0"},
        "identity": {"type": "SystemAssigned"},
        "properties": {"allowProjectManagement": True,
                       "customSubDomainName": "<foundry-resource>"},
    },
).result()

# 2) Project on that resource
client.projects.begin_create(
    resource_group_name="<rg>", account_name="<foundry-resource>",
    project_name="<project>",
    project={"location": "eastus", "identity": {"type": "SystemAssigned"}, "properties": {}},
).result()

The docs include an Azure CLI path (Azure CLI 2.80 or later, Contributor or Owner on the resource group) and template options for repeatable, policy-compliant setups:

• Create a project (portal, SDK, CLI)
• Create resources using a Bicep template
• Manage resources using Terraform
• Upgrade an Azure OpenAI resource to a Foundry resource (keeps endpoint, keys and state)

Foundry roles separate control plane from data plane. Assign the least privilege that fits the job.

For a team, you need a role that can assign roles (such as Owner) plus the email addresses or Entra security group IDs of the members.

Basic agent setup uses Microsoft-managed resources. Standard agent setup stores agent state in your own single-tenant Azure resources, for full data sovereignty and project-level isolation:

Pair it with network isolation (private link or managed virtual network) when you need to keep traffic off the public internet.

Azure OpenAI in Foundry models are sold by Azure. Model highlights listed in the docs include these series (newest first):

Claude is offered in two hosting versions. Both are sold and operated by Anthropic, purchased through Azure Marketplace, billed in CCU (see the cost sections), and supported through Microsoft Support.

• Current Claude models list a 1M token context window and up to 128K output, with adaptive thinking and an effort parameter.
• Gated research preview models (Mythos) use Microsoft Entra ID authentication only.
• Foundry does not apply built-in content filtering to Claude at deployment time. Configure Azure AI Content Safety during inference.

Other collections you can reach from the catalog (per the models-sold-by-Azure and partner pages):

Microsoft's own model families in Foundry include MAI models (MAI-Image, MAI-Thinking-1, MAI-Voice, MAI-Transcribe), Phi models and healthcare AI models. See each model's page for deployment options and regions.

1. Deploy a modelAn agent needs a deployed model. Any Foundry direct model works; gpt-5-mini is used in the quickstart.
2. Build › Agents › CreateName the agent and choose the model deployment.
3. Write instructionsDefine role, tone, what the agent must and must not do, and how to use its tools. Keep them specific and testable.
4. Add tools and knowledgeAttach a toolbox, MCP servers, file search, Foundry IQ, memory, web search, code interpreter and more (see the tools section).
5. Test in the playgroundChat, inspect tool calls, adjust, and save. Each save is a new version.
6. Evaluate, then shareRun an evaluation, add a guardrail, then Publish to Teams and Microsoft Copilot or call the endpoint from your app.

Install azure-ai-projects>=2.3.0 (the 2.x SDK targets the current portal; it is not compatible with 1.x) and sign in with az login.

from azure.identity import DefaultAzureCredential
from azure.ai.projects import AIProjectClient
from azure.ai.projects.models import PromptAgentDefinition

project = AIProjectClient(
    endpoint="https://<resource>.services.ai.azure.com/api/projects/<project>",
    credential=DefaultAzureCredential(),
)

# Create (or update) the agent: every call produces a new immutable version
agent = project.agents.create_version(
    agent_name="my-agent",
    definition=PromptAgentDefinition(
        model="gpt-5-mini",
        instructions="You are a helpful assistant that answers general questions",
    ),
)

# Chat with it over the Responses API, with server-side conversation state
openai = project.get_openai_client(agent_name="my-agent")
conversation = openai.conversations.create()
reply = openai.responses.create(conversation=conversation.id, input="Hello!")
print(reply.output_text)

The same flow exists for C#, TypeScript, Java and REST.

Every agent gets a stable endpoint. It is live from creation, and you do not need to publish for programmatic access.

• Version routing. By default 100% of traffic goes to the latest version. Pin a version with a version_selector when an agent is in production or published.
• Inbound auth. Azure RBAC (Entra) by default, plus agent-blueprint and Bot Service schemes used when publishing. API key authentication is not supported for agent endpoints.
• Classic migration. Assistants-style agents move to the new agent model and the Responses API.

• Keep instructions short, concrete and verifiable. Put long reference content in a knowledge source, not in the prompt.
• Describe when to use each tool and what its parameters mean; vague tool descriptions are a common cause of wrong tool calls.
• Prefer one agent with the right tools over a multi-agent workflow until you need orchestration.
• Build an evaluation dataset early so every change is measured, not anecdotal.
• Let the agent optimizer propose better instructions and tool descriptions against your dataset (next sections).

1. Open Build › KnowledgeMake sure New Foundry is on and select your project.
2. Create or connect a search serviceIt must support agentic retrieval. For a proof of concept use the free tier of Azure AI Search and the free allocation of tokens for agentic retrieval.
3. Create a knowledge baseAdd one knowledge source at a time, then configure retrieval behavior.
4. Build › Agents: connect the knowledge baseCreate or select an agent and connect it. Refine in the playground.

Create knowledge sources, create a knowledge base that references them, connect an agent, then send messages and refine. You can use a knowledge base from Foundry Agent Service, Microsoft Agent Framework or any custom app through the knowledge base REST API or Azure AI Search SDK clients. A private agentic retrieval tutorial covers inbound and outbound private connectivity.

After you connect a knowledge base to an Agent Service agent you can also add that agent to Microsoft Copilot Studio Preview.

Each is standalone, and you can use them together for broader organizational context.

Hosted agents can add persistent memory too (see the hosted agent quickstart), and LangChain and LangGraph can use Foundry Memory.

• Item-level CRUD: create, read, update, list and delete individual memories.
• Store-level default retention: a default TTL in seconds for new entries, set at store creation.
• Direct commands: immediate remember-or-forget when users ask.
• Each type (user profile, chat summary, procedural) can be enabled or disabled when you create a store.

• Requires compatible Azure OpenAI chat and embedding model deployments.
• Virtual network integration is not supported for memory stores.
• Billed for the underlying chat and embedding models you configure; pricing can change during preview.
• Available in a defined list of regions; check the docs before choosing yours.

Because an LLM extracts and consolidates memories from conversations, incorrect or harmful content can be stored and later steer the agent (prompt injection, memory corruption). Mitigate by:

• Using Azure AI Content Safety and prompt-injection detection on content entering and leaving the memory system.
• Regularly stress-testing the agent with controlled adversarial exercises (AI red teaming).
• Keeping per-user scopes so one user's memories never reach another.

1. Open the agent's Optimize tabBuild › Agents › your agent › Optimize. No code changes are required for prompt agents.
2. Select the baseline versionThe prompt-agent version you will compare candidates against.
3. Choose a datasetGenerate one from agent traces, pick an existing Foundry dataset, or upload one.
4. Choose evaluation criteriaBuilt-in or custom evaluators for the behaviors you want to improve.
5. Choose models and review the cost estimatePick the evaluation model and candidate models. The Review step shows a modeled Minimum, Estimated and Maximum cost before you submit.
6. Review results and promoteCompare scores, the before-and-after prompt and per-evaluator results, then promote the best candidate to a new version.

Hosted agents must be optimizer-ready: the agent loads its configuration (instructions and optionally skills and tool definitions) through the optimization package, so it can load a candidate during a run with no feature flags. Foundry Toolkit for VS Code scaffolds this automatically; with the Azure Developer CLI you add it yourself. Datasets can be local JSONL files or datasets registered in your project, including those generated from traces. After a run, apply the winning candidate locally, review, and redeploy.

azd ai agent optimize apply --candidate <candidate-id>
azd deploy

• Two models are used: an eval model that scores responses (any chat-completion model) and an optimization model that generates candidates (a more capable one usually produces better candidates).
• The portal estimate is modeled from static token assumptions. It is neither a spending limit nor a substitute for your invoice. Measured token usage appears after the run.
• The pre-run estimate is currently available for prompt agents in the portal; hosted-agent flows show post-run token usage.

The tool catalog includes 1,000+ connectors to SaaS, data and line-of-business systems Preview. Adding one makes Foundry create a managed MCP server in your account's Connector Namespace, so you write no server code.

1. BrowseFind the connector in the Tools catalog (Build › Tools).
2. ConnectAuthenticate to the service (API key, OAuth account or personal access token).
3. Select actionsChoose which actions to expose as MCP tools.
4. Add toolFoundry creates the managed MCP server and adds it to your agent or toolbox.

Only actions are supported (no triggers). Managed MCP servers are scoped to the project where they are created and available in a defined list of regions. You need the Foundry Project Manager role on the project.

• Custom MCP: Build › Tools › Custom › Model Context Protocol, then paste your endpoint and pick an auth type. Build your own MCP server if none exists.
• Private tool catalog: publish approved tools for your organization to discover and reuse. A private skill catalog is also available in preview.
• Skills Preview: versioned, immutable, multi-step workflows packaged as capabilities. Tools define what an agent can do; skills define how.

The toolbox handles credential injection, token refresh and policy enforcement at run time, so consuming agents do not manage per-tool secrets.

• Microsoft Entra ID and OAuth identity passthrough (user delegation) for tools that act on behalf of a user.
• Agent identity for autonomous or background work.
• Key-based where a tool requires it, stored through a Key Vault connection rather than in code.

Treat tools as a supply chain. Third-party MCP servers are Non-Microsoft Products; vet them, review data sharing, and require approvals for risky actions.

• Route new MCP tools through an AI gateway Preview to enforce authentication, rate limits, IP restrictions and audit logging without changing the MCP server or agent code.
• Apply guardrails to tool calls and tool responses at the toolbox.
• Version toolboxes and promote a new default only after testing.

1. Test thoroughly in the portalConfirm responses and every tool work as expected.
2. Select the active versionDetails tab › Agent configuration › Active version › Edit, or from the Publish button. Choose Always use latest or pin a specific version (recommended for production).
3. Select Publish › Teams and Microsoft CopilotAn Azure Bot Service resource is created automatically, or shown read-only if one exists.
4. Complete the metadataName, a three-part publish version (major.minor.patch), short description, description and developer. Optionally add website, terms of use and privacy statement URLs (HTTPS).
5. Choose the scopeJust you, or people in your organization.
6. Get admin approval if you chose organization scopeAfter approval the agent appears for everyone in your tenant under Built by your org.

• Foundry User role on the project to create, manage and publish agents.
• Azure Bot Service Contributor (or Contributor or Owner) on the resource group, to create the bot and configure its channels. Foundry roles do not grant these permissions.
• Register the provider: az provider register --namespace Microsoft.BotService.
• An agent version you tested and want to publish.

• Projects that disable public network access cannot publish from the portal. Use the REST API and enable the source-IP-filtered public Activity Protocol route with enable_m365_public_endpoint; requests must come from Azure Bot Service or Microsoft 365 source ranges and still satisfy authorization.
• Hosted agents built on the Responses protocol are bridged to the Activity protocol automatically for channel delivery. Interactive calls can use OAuth on-behalf-of flows; background calls use the agent's own Entra identity.
• You can also publish an agent as an autopilot in Agent 365.

• Per session, not per replica. A new VM-isolated sandbox is created for each session on demand. There is no replica count to configure and no warm pool to size. The CPU and memory you set describe a single session.
• Right-size with data. Run a representative workload and watch CPU, memory and request duration in Application Insights (Investigate › Performance). If sustained peaks exceed about 70% of allocation, raise the next version; if they stay well below, lower it to cut cost. Versions are immutable, so retest after each change.
• Disk. Up to 20 GiB per session at 1 vCPU or larger (scaled down for smaller tiers); about 20% is reserved for the system. The rest is shared by your image, $HOME and other writable paths.

Compute follows the session, not the request. Click a state, or let it play.

• The platform permanently deletes a session after 30 days of inactivity.
• Responses protocol: the conversation ID is primary and the platform keeps history. Invocations: the session ID is primary and you manage state (for example in Cosmos DB or the durable state store).
• A durable state store Preview holds keyed JSON items that survive crashes, restarts and idle eviction (default 30-day idle window), handy for framework checkpoints.

Not sure? Start with Responses. An agent can support several protocols at once, so the choice is not permanent.

Responses   {project_endpoint}/agents/{name}/endpoint/protocols/openai/responses
Invocations {project_endpoint}/agents/{name}/endpoint/protocols/invocations
WebSocket   wss://{account}.services.ai.azure.com/api/projects/{project}/agents/{name}/endpoint/protocols/invocations_ws?api-version=v1
A2A         {project_endpoint}/agents/{name}/endpoint/protocols/a2a

• The agent identity can reach model inference and session storage by default. For other resources (such as your own storage), assign RBAC roles to the agent's Entra identity.
• User-invoked calls can use OAuth 2.0 on-behalf-of with the user's delegated permissions. Autonomous calls use the agent's own identity.
• No secrets in images or environment variables. Use managed identities, connections and Key Vault.
• Private networking: deploy within network-isolated Foundry resources and send outbound traffic through your virtual network. Projects created after June 25, 2026 support a private Azure Container Registry.
• Network egress controls Preview in a guardrail limit which outbound destinations a hosted agent may reach.

1. Write the agentUse Microsoft Agent Framework, LangGraph or your own code, with a protocol library that serves HTTP or WebSocket, health checks and OpenTelemetry.
2. Package and pushBuild a container image and push it to Azure Container Registry.
3. Create a versionWith the Azure Developer CLI (azure.ai.agent service in azure.yaml) or the Foundry SDK: image, CPU and memory, environment variables and protocols. Each call creates an immutable version.
4. Call the endpointLive as soon as it deploys; publishing is only for Teams and Microsoft 365.
5. ObserveAn Application Insights connection string is injected automatically. Traces appear under Investigate › Transaction search.
6. IterateShip a new version to change code, size, variables or protocols. An endpoint serves one version at a time with 100% of traffic; traffic splitting is not supported.

Hosted agents have full access to Foundry-managed tools through a Toolbox MCP endpoint (Code Interpreter, web search, Azure AI Search, OpenAPI, MCP, A2A, skills). With Microsoft Agent Framework use FoundryToolbox (Python) or AddFoundryToolboxes (.NET).

• Pricing: managed hosting runtime is billed on consumption of CPU and memory during active sessions. See the Foundry pricing page for current rates. You also pay for the models and tools the agent calls.
• Regions (31 at the doc date): Australia East, Brazil South, Canada Central and East, Central US, East US and East US 2, France Central, Germany West Central, Italy North, Japan East and West, Korea Central, North Central US, Norway East, Poland Central, South Africa North, South Central US, South India, Southeast Asia, Spain Central, Sweden Central, Switzerland North and West, UAE North, UK South and West, West Central US, West Europe, West US and West US 3.
• Languages: Python and C#.
• Third-party risk: third-party servers, code and non-Azure-direct models are used at your own risk and you own responsible AI mitigations.

Three factors turn your traffic into a PTU count:

1. Request shapeRequests per minute, average input tokens and average output tokens.
2. Output-to-input ratioOutput tokens need more capacity than input tokens. Each model has a ratio that expresses how many input tokens one output token is equivalent to.
3. Cache rateThe fraction of input served from prompt cache. Cached tokens do not consume PTU capacity, so a higher cache rate lowers the PTUs you need.

The calculation normalizes these into one TPM figure and divides by the model's input-TPM-per-PTU value. Use the capacity calculator in the Foundry portal for a guided estimate.

• Hourly billing is flexible but not intended for steady production. A deployment that exists for 15 minutes is charged one quarter of the hourly rate.
• Azure Reservations give a discounted rate for a term commitment. Global reservations are not region-specific; Data Zone and Regional reservations are tied to the deployment's region.
• If deployed PTUs exceed the reservation quantity, the excess is billed at the hourly rate.
• Reservations can be canceled or exchanged, which might incur fees.

Spillover routes overage from a fully used provisioned deployment to a standard deployment, instead of returning 429.

• Whole deployment: set spilloverDeploymentName on the provisioned deployment to a standard deployment of the same model and version in the same resource.
• Per request: send the x-ms-spillover-deployment header. If spillover occurs, the response carries x-ms-spillover-from-deployment.
• If both are set, the deployment property wins.

CCU does not change how you size Claude workloads. Plan with RPM, ITPM (uncached input tokens per minute) and OTPM (output tokens per minute), per model.

• Subscription-level pools. All Global Standard deployments of the same model and version in a subscription share one quota pool across regions. Data Zone Standard deployments share a pool within each data zone (for example the US zone).
• Cache-aware ITPM. For most Claude models only uncached input counts: input after the last cache breakpoint plus cache-creation tokens (5-minute or 1-hour). Cache-read tokens do not count, which makes caching a throughput lever as well as a cost lever.
• Default limits depend on your subscription type (pay-as-you-go, Enterprise and MCA-E, Free Trial). Some preview models start at zero until you request quota.

Traces are built from spans (single operations, nestable) with attributes, following the OpenTelemetry GenAI semantic conventions (development status, may change). Microsoft and Cisco Outshift contribute conventions for multi-agent workflows, integrated in Foundry, Microsoft Agent Framework, LangChain and LangGraph.

Build › Agents › your agent › Monitor tab Preview. Summary cards on top, charts below, for the selected time range.

Data is stored in your connected Application Insights resource, so retention and billing follow its configuration. For log-based views you also need Log Analytics Reader.

Assign the project's managed identity the Foundry User role so continuous evaluation rules can run. A Notification Center and Insights surface issues and suggested improvements, and the fleet-level Operate panes add cost and token anomaly tracking.

The control plane can also register custom agents from other platforms so you see Foundry, Microsoft and non-Microsoft agents in one fleet view.

1. Connect Application Insights to the projectTracing and the Monitor dashboard read from it.
2. Grant accessLog Analytics Reader (and Privileged Monitoring Data Reader if tables are protected).
3. InstrumentPrompt and hosted agents emit traces by default; for your own code use OpenTelemetry with the Foundry SDK, or framework integrations.
4. Open Operate › Tracing and the agent's Monitor tabVerify spans, tokens and latency.
5. Turn on continuous evaluation and alertsUse the gear icon in Monitor settings.

• Textual similarity: Similarity (AI-assisted), F1, BLEU, GLEU, ROUGE and METEOR against ground truth.
• Azure OpenAI graders and rubric evaluators for criteria-based scoring.
• Custom evaluators for your own pass/fail logic or model-judged criteria.

Tool call and tool response controls need moderation support from the tool itself. Supported today: Azure AI Search, Azure Functions, OpenAPI, SharePoint grounding, Fabric data agent, Bing grounding, Bing Custom Search and Browser Automation.

• Actions: Annotate (models only) or Annotate and block (models and agents).
• Override rule: an agent uses the guardrail assigned to the agent; it fully overrides the model's guardrail. If the agent's guardrail has no control for a risk at a point, that point is not scanned for it.
• Classification models can produce false positives and negatives: evaluate controls with content representative of your workload.

Foundry Models include DefaultV2 safety by default, for every model except transcription models.

• Core harm filters (hate and fairness, violence, sexual, self-harm) are on, at Medium, for prompts and completions.
• User prompt attack (jailbreak) detection is on for prompts; protected material (text and code) is on for completions.
• Document attack detection is off by default and must be enabled.
• Blocked input returns an error response; blocked output can return a filtered completion.

1. Open Build › Guardrails (or Operate › Compliance)You need the Foundry Account Owner role.
2. Create a guardrail and add controlsFor each: choose the risk, intervention point (for example Indirect attack at Tool response), action and blocking level. A Guided Guardrail experience is in preview.
3. Assign itOne guardrail can apply to many models and many agents in a project. Controls not relevant to models (tool call, tool response) simply do not run on them.
4. Test, then evaluateProbe with the AI Red Teaming Agent and run safety evaluators.
5. Enforce fleet-wideUse guardrail policies (Azure Policy) to mandate minimum controls across a subscription or resource group (governance section).

• Network: choose a networking option, then configure private link or a managed virtual network; reach on-premises resources; add Foundry to a network security perimeter. Hosted agents and the publishing flow have virtual-network paths.
• Encryption: understand and configure customer-managed keys.
• Secrets: store them in your own Azure Key Vault through a connection; rotate API access keys where keys still exist.
• Data residency: data at rest stays in the chosen geography; processing depends on the deployment type (global, data zone, regional).
• Standard agent setup: keep agent files, vector stores and conversation state in your own Storage, AI Search and Cosmos DB.

• Built-in policy definitions for AI services and Foundry, plus a built-in policy for model deployment (control which models may be deployed) and custom policy definitions.
• Govern model router with Azure Policy to restrict which models it may route to.
• Guardrail policies mandate minimum guardrail controls for deployments across a subscription or resource group.
• Creating or editing guardrail policies needs Owner or Resource Policy Contributor at subscription or resource-group scope. Most users can still view compliance status.

Operate › Compliance. Use the subscription and project filters first, then switch tabs.

Compliance status updates within a few minutes of saving a fix. Use the latest agent versions for full support.

Together they address prompt injection, sensitive data leakage and model misuse in a defense-in-depth model, and alerts appear on the control plane dashboard.

• Manage agents at scale across supported platforms: filter, drill into evaluation and monitoring, act on recommendations.
• Register custom agents from other platforms into the control plane registry (preview) and route them through the AI gateway.
• Agent availability for administrators: use Agent 365 and Microsoft Entra governance actions, with Azure infrastructure intervention as the emergency path.
• Schedule red-team scans and drift monitoring for ongoing agent testing.

• Transparency notes for Azure OpenAI and for Foundry Agent Service; data, privacy and security pages for models and agents; a code of conduct; abuse monitoring; content provenance and text watermarking for supported models.
• High availability and disaster recovery guidance, including recovery from platform outage and from resource and data loss, and a Foundry security baseline.
• Model lifecycle: track retirement dates so a governed fleet does not depend on a retired model.

1. Check permissionsContributor or Owner on the resource group (to create APIM) or API Management Service Contributor on an existing instance; Foundry Account Owner or Owner on the Foundry resource.
2. Manage › AI Gateway › Add AI GatewayPick the Foundry resource.
3. Create new or Use existing APIMCreate new makes a Basic v2 instance. Existing instances must be a v2 tier, in the same tenant and subscription.
4. Name it and AddWait until the status is Enabled.
5. Add projectsNew projects in the resource have the gateway enabled by default. Existing projects need Add project to gateway.

Manage › AI Gateway › your gateway › Token management › + Set limit: choose the project and deployment, then enter a tokens-per-minute value.

• Use it for multi-team containment, cost control by capping aggregate usage, and compliance ceilings.
• Concurrent requests can briefly exceed a limit until responses are processed. New limits apply immediately to later requests.
• If latency rises after enabling, compare against calling the model directly; check APIM region versus the resource region and cold start.

Route MCP traffic through the gateway Preview for a single governed entry point with authentication, rate limits, IP restrictions and audit logging, without modifying your MCP servers or agent code.

• Only new MCP tools created in the portal that do not use managed OAuth are routed through the gateway. The tool's endpoint then shows the APIM URL instead of the server URL.
• Supported MCP auth: managed identity (Entra), key-based, custom OAuth identity passthrough, or unauthenticated where applicable.
• Apply policies in APIM: rate limit, IP filter, correlation ID header, and removal of sensitive headers (Cookie, Referer).
• Register custom agents from other platforms in the control plane and govern them through the same gateway.
• Bring your own model: connect models hosted behind your own gateway (APIM or a non-Azure gateway) to Foundry Agent Service, keeping control of the endpoint.

<inbound>
  <base />
  <rate-limit-by-key calls="60" renewal-period="60" counter-key="@(context.Request.IpAddress)" />
  <set-header name="X-Correlation-Id" exists-action="override"><value>@(context.RequestId)</value></set-header>
</inbound>

1. Check metricsAzure portal › your APIM › Monitoring › Metrics › Requests. Make a test call and watch the count rise.
2. Turn on logsDiagnostic settings › Logs related to ApiManagement Gateway › Log Analytics, resource-specific tables.
3. QueryApiManagementGatewayLogs | where TimeGenerated > ago(1h). Look for 200 responses with your API name.
4. Test limitsExceed the TPM limit (429) and the quota (403) on purpose.