Browse the docs

Deploy and register in AMC

Push the image, run it as a container with secrets and volumes, and register its endpoint in AMC.

Before you startAn AMC-variant image that passes a local smoke test, a container registry, and a role that can register agents.View as Markdown

The generated README targets Azure Container Apps. Any host that runs a container and exposes HTTPS works, as long as AMC can reach the endpoint.

Build and push

bash
# From the repo root
docker build \
  -f azurefoundry_report_generator_skills/Dockerfile \
  -t <registry>.azurecr.io/a2a-report-generator-skills-agent:$(date +%Y%m%d-%H%M%S) \
  .
docker push <registry>.azurecr.io/a2a-report-generator-skills-agent:<tag>

The generated README tags each build with a timestamp.

Set credentials as secrets

bash
az containerapp secret set \
  --name report-generator-skills-agent-uami --resource-group <resource-group> \
  --secrets anthropic-api-key=<your-anthropic-api-key>

az containerapp update \
  --name report-generator-skills-agent-uami --resource-group <resource-group> \
  --set-env-vars ANTHROPIC_API_KEY=secretref:anthropic-api-key

For Foundry credentials, also set CLAUDE_CODE_USE_FOUNDRY=1, ANTHROPIC_FOUNDRY_RESOURCE, and ANTHROPIC_FOUNDRY_API_KEY. See Configuration and environment.

Mount volumes the skill needs

Without a mount, anything the skill writes is lost when the container restarts. Register an Azure Files share with the Container Apps environment, then attach it at the path the Dockerfile expects (/outputs, or /mnt/<name> for a token directory).

bash
az containerapp env storage set \
  --name <environment-name> --resource-group <resource-group> \
  --storage-name report-outputs \
  --azure-file-account-name <storage-account> \
  --azure-file-account-key <storage-account-key> \
  --azure-file-share-name report-outputs \
  --access-mode ReadWrite

Then add a volumeMounts entry with mountPath: /outputs to the container app. Azure Files suits outputs under 100 MB; for larger files or many files, use blob storage.

Register in AMC

  1. On Agents, select Register.
  2. Enter a Name, choose the Kind (Workflow or Agent), choose the Flight Director / custom adapter, and pick a Department.
  3. Check This resource uses the AMC SDK (no path segments required).
  4. Enter the Endpoint URL: the container's base URL, for example https://<your-agent>.example.com.
  5. Under Authentication, choose API key or Managed Identity (same tenant).
  6. Select Register. AMC probes the endpoint and reports the result.

Full registration detail, including input contracts and declared steps, is in Register your agent.

What the registration probe checks

AMC makes one GET <endpoint>/health call with a 5-second timeout, presenting the credential you chose.

ResponseAMC reports
Any 2xxHealthy
401 or 403Access not granted
Any other status, a timeout, or a connection failureUnreachable

The endpoint must be http or https, and the probe does not follow redirects, so register the final URL. Managed identity with a self-hosted endpoint needs all of: a Tenant Admin registering it, an https endpoint, an api:// resource scope, and the host pre-approved in the installation's SelfHostedManagedIdentityTargets list. That list is empty by default, so a default install refuses it. Use an API key unless your installation has approved the host.

Related

Last updated 2026-10-21