Connect Logic Apps and Knowledge Tools to Azure AI Agents

Enterprises want AI agents that can both act and explain. That means connecting a trustworthy action layer (Logic Apps) with permission-aware knowledge sources (Azure AI Search, Blob Storage, and SharePoint) so agents can retrieve evidence, trigger workflows, and stay governed in production.

What is Connecting Logic Apps and Knowledge Tools to Azure AI Agents

Connecting Logic Apps and knowledge tools to Azure AI Agents is the practice of wiring an agent runtime (Microsoft Foundry Agent Service) to two kinds of capabilities:

• Action tools such as Azure Logic Apps that let an agent trigger workflows across SaaS, on-prem, and Azure services using connectors and HTTP actions.
• Knowledge tools such as Foundry IQ knowledge bases powered by Azure AI Search, with sources from Azure Blob Storage, SharePoint, and other enterprise systems.

In Foundry Agent Service, agents are built around a model, instructions, and tools. Tools let an agent retrieve enterprise knowledge or take actions. Foundry IQ provides a managed knowledge base layer that uses agentic retrieval to plan queries, run parallel searches, and return grounded answers with citations. Logic Apps supplies the orchestration backbone, built from triggers and actions that connect 1,400+ services through built-in and managed connectors.

In short: Logic Apps delivers reliable automation, while knowledge tools deliver evidence and context. Together, they move agents from demo to production.

Why it Matters

Production AI needs more than a prompt. It needs secure access to data, guardrails, and repeatable workflows. The combination of Logic Apps and knowledge tools makes that possible.

• Integration at scale: Logic Apps is designed for workflows across cloud, on-prem, and hybrid systems, with built-in and managed connectors and visual workflows.
• Grounded answers: Foundry IQ knowledge bases use Azure AI Search and agentic retrieval so agents answer with citations and permission checks.
• Governance by design: Foundry Agent Service supports Microsoft Entra RBAC, content filters, and network isolation. Logic Apps supports connection security, encryption, and Azure Policy controls to restrict connector usage.
• Operational reliability: Logic Apps uses triggers and actions with retry policies and monitoring, and Foundry provides tracing and observability for tool calls.

"Agents that can act without evidence are risky, and agents that have evidence but cannot act are limited. The integration closes that gap."

Architecture / How it Works

At a high level, the architecture has three layers that map to a typical enterprise workflow:

1. Knowledge layer - Azure AI Search plus Foundry IQ knowledge bases built from Azure Blob Storage and SharePoint content.
2. Agent layer - Foundry Agent Service with model, instructions, and tools (including MCP knowledge base tools).
3. Orchestration layer - Logic Apps workflows for ingestion, enrichment, approvals, and downstream actions.

A typical flow looks like this:

• A SharePoint or Blob update triggers a Logic Apps workflow.
• The workflow normalizes content, stores it in Blob Storage, and signals indexing.
• Azure AI Search indexes the content into a Foundry IQ knowledge base.
• The agent uses the MCP tool to retrieve answers from the knowledge base.
• When action is required, the agent calls a Logic Apps endpoint (HTTP trigger) to run a governed workflow.

Connector and tool options

Step-by-Step Example

This example connects SharePoint documents to a Foundry agent and routes approvals through Logic Apps. The goal is a governed knowledge assistant that can answer questions and open a ticket when policy changes are detected.

1) Create the knowledge base

• Create an Azure AI Search service that supports agentic retrieval.
• Add SharePoint and Blob Storage as knowledge sources.
• Create a knowledge base in Foundry IQ.

2) Create a Foundry project connection (MCP tool)

Use a project connection so the agent can call the knowledge base MCP endpoint.

import requests
from azure.identity import DefaultAzureCredential, get_bearer_token_provider

credential = DefaultAzureCredential()
project_resource_id = "{project_resource_id}"
project_connection_name = "kb-mcp-connection"
search_service_endpoint = "https://{search-service}.search.windows.net"
knowledge_base_name = "policy-kb"

mcp_endpoint = f"{search_service_endpoint}/knowledgebases/{knowledge_base_name}/mcp?api-version=2025-11-01-preview"

bearer_token_provider = get_bearer_token_provider(credential, "https://management.azure.com/.default")
headers = {"Authorization": f"Bearer {bearer_token_provider()}"}

response = requests.put(
    f"https://management.azure.com{project_resource_id}/connections/{project_connection_name}?api-version=2025-10-01-preview",
    headers=headers,
    json={
        "name": project_connection_name,
        "type": "Microsoft.MachineLearningServices/workspaces/connections",
        "properties": {
            "authType": "ProjectManagedIdentity",
            "category": "RemoteTool",
            "target": mcp_endpoint,
            "isSharedToAll": True,
            "audience": "https://search.azure.com/",
            "metadata": {"ApiType": "Azure"}
        }
    }
)

response.raise_for_status()

3) Create the agent with the MCP tool

Create an agent definition that requires the knowledge base tool for answers.

from azure.ai.projects import AIProjectClient
from azure.ai.projects.models import PromptAgentDefinition, MCPTool
from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential()
project_endpoint = "{project_endpoint}"
project_connection_name = "kb-mcp-connection"
agent_model = "{deployed_LLM}"  # example: gpt-4.1-mini
agent_name = "policy-assistant"

mcp_endpoint = "{search_service_endpoint}/knowledgebases/{knowledge_base_name}/mcp?api-version=2025-11-01-preview"

project_client = AIProjectClient(endpoint=project_endpoint, credential=credential)

instructions = """
You are a helpful assistant.
Use the knowledge base tool to answer user questions.
If the knowledge base does not contain the answer, respond with "I do not know".
"""

mcp_kb_tool = MCPTool(
    server_label="knowledge-base",
    server_url=mcp_endpoint,
    require_approval="never",
    allowed_tools=["knowledge_base_retrieve"],
    project_connection_id=project_connection_name
)

agent = project_client.agents.create_version(
    agent_name=agent_name,
    definition=PromptAgentDefinition(
        model=agent_model,
        instructions=instructions,
        tools=[mcp_kb_tool]
    )
)

4) Build the Logic Apps workflow

Use a SharePoint trigger, store the document in Blob Storage, and notify the agent pipeline. Here is a simplified workflow definition snippet:

{
  "definition": {
    "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
    "triggers": {
      "When_a_file_is_created": {
        "type": "ApiConnection",
        "inputs": {
          "host": {"connection": {"name": "@parameters('$connections')['sharepoint']['connectionId']"}},
          "method": "get",
          "path": "/datasets/@{encodeURIComponent('https://contoso.sharepoint.com/sites/policies')}/triggers/onupdatedfile"
        }
      }
    },
    "actions": {
      "Create_blob": {
        "type": "ApiConnection",
        "inputs": {
          "host": {"connection": {"name": "@parameters('$connections')['azureblob']['connectionId']"}},
          "method": "post",
          "path": "/v2/datasets/@{encodeURIComponent('AccountName')}/files",
          "body": {"name": "@{triggerBody()?['Name']}", "content": "@{triggerBody()?['$content']}"}
        }
      },
      "Notify_indexer": {
        "type": "Http",
        "inputs": {
          "method": "POST",
          "uri": "https://{search-service}.search.windows.net/indexers/policy-kb-indexer/run?api-version=2024-07-01",
          "headers": {"api-key": "@parameters('searchAdminKey')"}
        },
        "runAfter": {"Create_blob": ["Succeeded"]}
      }
    }
  }
}

5) Expose a Logic Apps HTTP trigger for actions

Expose a Logic Apps workflow with an HTTP trigger so the agent can request approvals or create tickets. Use managed identity or OAuth for authentication, and lock it down with IP restrictions or private endpoints for production.

Tip: Keep ingestion and action workflows separate. This makes it easier to enforce least privilege and to apply different run history retention policies.

6) Test with governance in mind

• Validate that the knowledge base returns citations.
• Confirm the agent uses the MCP tool instead of its own memory.
• Audit Logic Apps run history and tool calls for traceability.

Best Practices

• Use managed identity whenever possible to avoid secret sprawl and to align with Entra RBAC.
• Separate ingestion, retrieval, and action workflows so each can have its own permissions and SLAs.
• Prefer built-in connectors in single-tenant Logic Apps when you need higher throughput or VNet isolation.
• Treat the knowledge base as a governed product with versioning, access controls, and refresh schedules.
• Instrument end-to-end tracing across Logic Apps runs and agent tool calls to simplify incident response.
• Design for idempotency because Logic Apps uses at-least-once delivery semantics.

Common Mistakes

• Using a single workflow for everything, which mixes permissions and makes auditing harder.
• Skipping knowledge base instructions, leading the agent to answer from model memory instead of retrieval.
• Ignoring connector limits and retry policies, causing silent failures under load.
• Exposing HTTP triggers publicly without authentication or network restrictions.
• Indexing without access control, which breaks governance expectations for SharePoint content.

Real-World Use Cases

• Policy and compliance assistant: Answer policy questions from SharePoint and trigger approval workflows in Logic Apps.
• IT operations triage: Retrieve runbooks from Blob Storage and open incident tickets through ServiceNow or Azure DevOps connectors.
• Procurement and vendor onboarding: Ingest contracts, extract key terms, and run approval sequences with audit trails.
• Customer support copilots: Ground answers in product documentation and update CRM records through Logic Apps connectors.

Conclusion

Connecting Logic Apps with knowledge tools turns Azure AI Agents into production-grade systems that can act, explain, and comply. Logic Apps provides the reliable orchestration layer, while Foundry IQ and Azure AI Search provide grounded, permission-aware retrieval from Blob Storage and SharePoint. Build the integration once, apply governance everywhere, and your agents can safely move from proof of concept to real workflows.