Microsoft Foundry SDK for .NET 2.0

Apply the C# 14 baseline first. These rules cover Azure.AI.Projects 2.0 project clients, identity, connections, agents, assets, datasets, evaluation, tracing, networking, and operations.

Project client and identity

• Construct AIProjectClient with the exact trusted HTTPS project endpoint <account>.services.ai.azure.com/api/projects/<project> and a TokenCredential; never accept the endpoint, account, or project path from a caller.
• Use the Foundry data-plane v1 endpoint expected by Azure.AI.Projects 2.0; do not carry forward hub-project connection strings or old beta endpoint assumptions.
• Prefer ManagedIdentityCredential or a deliberately constrained DefaultAzureCredential in production so developer CLI, IDE, or interactive credentials cannot be selected unexpectedly.
• Assign separate least-privilege Azure roles to application, agent administration, connection administration, dataset upload, evaluation, and deployment identities.
• Scope each client and cached resource identifier to one environment, Entra tenant, Foundry project, and privilege boundary; a resource ID returned by the SDK is not proof of caller access.

Connections and secret material

• List connections with Connections.GetConnections() and retrieve them with includeCredentials:false, the default; treat includeCredentials:true and credential-returning helpers as secret-export operations restricted to an administrative path.
• Never send returned connection keys, access tokens, SAS values, or credential-bearing ClientConnection objects to logs, model context, traces, API