Bing Grounding API

# 1. Login to Azure
azd auth login

# 2. Create environment (first time only)
azd env new <environment-name>

# 3. Provision and deploy everything
azd up

graph TB
    subgraph External["External Clients"]
        Client[LLM Suite / MCP Client]
    end
    
    subgraph APIM["Azure API Management"]
        Gateway[API Gateway<br/>• Circuit Breaker<br/>• Rate Limiting<br/>• Session Affinity]
    end
    
    subgraph ContainerApps["Container Apps Environment"]
        CA1[Container App 1<br/>12 Agent Endpoints]
        CA2[Container App 2<br/>12 Agent Endpoints]
        CA3[Container App 3<br/>12 Agent Endpoints]
    end
    
    subgraph Foundry["Azure AI Foundry (Single Project)"]
        Project[AI Project]
        GPT4O[GPT-4o Deployment<br/>10K TPM Capacity]
        subgraph Agents["Agent Pool (12 Agents)"]
            Agent1[Agent 1]
            Agent2[Agent 2]
            Agent12[Agent 12]
        end
        Bing[Bing Grounding<br/>Connection]
    end
    
    Client -->|HTTPS Requests| Gateway
    Gateway -->|Load Balance| CA1
    Gateway -->|Load Balance| CA2
    Gateway -->|Load Balance| CA3
    
    CA1 & CA2 & CA3 -->|Managed Identity| Project
    Project --> Agents
    Agent1 & Agent2 & Agent12 -->|Use| GPT4O
    Agent1 & Agent2 & Agent12 -->|Search| Bing
    
    style Gateway fill:#0078d4,color:#fff
    style CA1 fill:#00bcf2,color:#000
    style CA2 fill:#00bcf2,color:#000
    style CA3 fill:#00bcf2,color:#000
    style Project fill:#50e6ff,color:#000
    style GPT4O fill:#ff6b6b,color:#fff
    style Bing fill:#00b294,color:#fff

graph TB
    subgraph External["External Clients"]
        Client[LLM Suite / MCP Client]
    end
    
    subgraph APIM["Azure API Management"]
        Gateway[API Gateway]
    end
    
    subgraph ContainerApps["Container Apps (3 instances)"]
        CA[Container Apps<br/>12 Agent Endpoints]
    end
    
    subgraph Foundry["Azure AI Foundry (Single Project)"]
        Project[AI Project]
        GPT4O[GPT-4o Deployment<br/>⬆️ 100K TPM<br/>Provisioned Throughput]
        Agents[Agent Pool<br/>12 Agents]
        Bing[Bing Grounding]
    end
    
    Client -->|HTTPS| Gateway
    Gateway -->|Load Balance| CA
    CA -->|Managed Identity| Project
    Project --> Agents
    Agents -->|Use| GPT4O
    Agents -->|Search| Bing
    
    style Gateway fill:#0078d4,color:#fff
    style CA fill:#00bcf2,color:#000
    style GPT4O fill:#ff6b6b,color:#fff
    style Project fill:#50e6ff,color:#000

graph TB
    subgraph External["External Clients"]
        Client[LLM Suite / MCP Client<br/>Single Endpoint]
    end
    
    subgraph APIM["Azure API Management - Backend Pool"]
        Gateway[API Gateway<br/>Round-Robin LB<br/>Circuit Breaker]
    end
    
    subgraph Backend1["Environment 1"]
        CA1[Container Apps<br/>12 Agents]
        Project1[AI Project 1<br/>GPT-4o: 10K TPM]
    end
    
    subgraph Backend2["Environment 2"]
        CA2[Container Apps<br/>12 Agents]
        Project2[AI Project 2<br/>GPT-4o: 10K TPM]
    end
    
    subgraph Backend3["Environment 3"]
        CA3[Container Apps<br/>12 Agents]
        Project3[AI Project 3<br/>GPT-4o: 10K TPM]
    end
    
    Client -->|HTTPS| Gateway
    Gateway -->|Route 33%| CA1
    Gateway -->|Route 33%| CA2
    Gateway -->|Route 34%| CA3
    
    CA1 --> Project1
    CA2 --> Project2
    CA3 --> Project3
    
    style Gateway fill:#0078d4,color:#fff
    style CA1 fill:#00bcf2,color:#000
    style CA2 fill:#00bcf2,color:#000
    style CA3 fill:#00bcf2,color:#000
    style Project1 fill:#50e6ff,color:#000
    style Project2 fill:#50e6ff,color:#000
    style Project3 fill:#50e6ff,color:#000

graph TB
    subgraph External["External Clients"]
        Client[LLM Suite / MCP Client<br/>⬆️ Client-Side LB Logic]
    end
    
    subgraph APIM["Azure API Management"]
        Gateway[API Gateway<br/>Shared Policies]
    end
    
    subgraph Backend1["Environment 1"]
        CA1[Container Apps<br/>12 Agents]
        Project1[AI Project 1<br/>GPT-4o: 10K TPM]
    end
    
    subgraph Backend2["Environment 2"]
        CA2[Container Apps<br/>12 Agents]
        Project2[AI Project 2<br/>GPT-4o: 10K TPM]
    end
    
    subgraph Backend3["Environment 3"]
        CA3[Container Apps<br/>12 Agents]
        Project3[AI Project 3<br/>GPT-4o: 10K TPM]
    end
    
    Client -->|33% Traffic| Gateway
    Client -->|33% Traffic| Gateway
    Client -->|34% Traffic| Gateway
    
    Gateway -->|/project1/*| CA1
    Gateway -->|/project2/*| CA2
    Gateway -->|/project3/*| CA3
    
    CA1 --> Project1
    CA2 --> Project2
    CA3 --> Project3
    
    style Client fill:#ffa500,color:#fff
    style Gateway fill:#0078d4,color:#fff
    style CA1 fill:#00bcf2,color:#000
    style CA2 fill:#00bcf2,color:#000
    style CA3 fill:#00bcf2,color:#000
    style Project1 fill:#50e6ff,color:#000
    style Project2 fill:#50e6ff,color:#000
    style Project3 fill:#50e6ff,color:#000

graph TB
    subgraph External["External Clients"]
        Client[LLM Suite / MCP Client]
    end
    
    subgraph APIM["Azure API Management - Weighted LB"]
        Gateway[API Gateway<br/>80% to PTU<br/>20% to Standard]
    end
    
    subgraph PrimaryProject["Primary Project - PTU"]
        CA_PTU[Container Apps<br/>12 Agents]
        Project_PTU[AI Project<br/>GPT-4o PTU<br/>100K TPM<br/>Guaranteed]
    end
    
    subgraph FallbackProjects["Fallback Projects - Standard"]
        CA_STD1[Container Apps<br/>12 Agents]
        Project_STD1[AI Project 1<br/>GPT-4o: 10K TPM]
        
        CA_STD2[Container Apps<br/>12 Agents]
        Project_STD2[AI Project 2<br/>GPT-4o: 10K TPM]
    end
    
    Client -->|HTTPS| Gateway
    Gateway -->|80% Primary| CA_PTU
    Gateway -->|10% Spillover| CA_STD1
    Gateway -->|10% Spillover| CA_STD2
    
    CA_PTU --> Project_PTU
    CA_STD1 --> Project_STD1
    CA_STD2 --> Project_STD2
    
    style Gateway fill:#0078d4,color:#fff
    style CA_PTU fill:#4caf50,color:#fff
    style Project_PTU fill:#ff6b6b,color:#fff
    style CA_STD1 fill:#00bcf2,color:#000
    style CA_STD2 fill:#00bcf2,color:#000

graph TB
    subgraph Clients["Global Clients"]
        USClient[US Clients]
        EUClient[EU Clients]
    end
    
    subgraph APIM["Azure API Management (Global Gateway)"]
        Gateway[API Gateway<br/>• Geo-routing<br/>• Health Checks<br/>• Circuit Breaker]
    end
    
    subgraph EastUS["East US Region"]
        CA_East[Container App<br/>eastus]
        Foundry_East[AI Foundry<br/>5 Agents]
        Bing_East[Bing Grounding]
    end
    
    subgraph WestUS["West US Region"]
        CA_West[Container App<br/>westus]
        Foundry_West[AI Foundry<br/>5 Agents]
        Bing_West[Bing Grounding]
    end
    
    subgraph WestEU["West Europe Region"]
        CA_EU[Container App<br/>westeurope]
        Foundry_EU[AI Foundry<br/>5 Agents]
        Bing_EU[Bing Grounding]
    end
    
    USClient --> Gateway
    EUClient --> Gateway
    
    Gateway -->|Geo-routing| CA_East
    Gateway -->|Load balance| CA_West
    Gateway -->|Geo-routing| CA_EU
    
    CA_East --> Foundry_East
    CA_West --> Foundry_West
    CA_EU --> Foundry_EU
    
    Foundry_East --> Bing_East
    Foundry_West --> Bing_West
    Foundry_EU --> Bing_EU
    
    style Gateway fill:#0078d4,color:#fff
    style CA_East fill:#00bcf2,color:#000
    style CA_West fill:#00bcf2,color:#000
    style CA_EU fill:#00bcf2,color:#000

{
  "content": "AI-generated response...",
  "citations": [...],
  "metadata": {
    "agent_route": "gpt4o_2",
    "model": "gpt-4o",
    "agent_id": "asst_abc123...",
    "region": "westus"  ← Region identifier
  }
}

# Create new environment for westus
azd env new westus
azd env set AZURE_LOCATION westus

# Deploy (creates full stack: Foundry, agents, Container App, etc.)
azd up

# Get the Container App URL
azd env get-values | Select-String "CONTAINER_APP"

<policies>
  <inbound>
    <set-variable name="backendUrl" value="@{
        var backends = new[] {
            "https://ca-vw5lt6yc7noze.eastus.azurecontainerapps.io",
            "https://ca-abc123.westus.azurecontainerapps.io"
        };
        var random = new Random();
        return backends[random.Next(backends.Length)];
    }" />
    <set-backend-service base-url="@((string)context.Variables["backendUrl"])" />
  </inbound>
</policies>

<policies>
  <inbound>
    <set-variable name="backendUrl" value="@{
        // Get client location from X-Forwarded-For or request headers
        string clientLocation = context.Request.Headers.GetValueOrDefault("X-Forwarded-For", "");
        
        // Route based on geography
        if (clientLocation.Contains("Europe") || clientLocation.Contains("EU"))
            return "https://ca-eu.westeurope.azurecontainerapps.io";
        else if (clientLocation.Contains("West") || clientLocation.Contains("Pacific"))
            return "https://ca-west.westus.azurecontainerapps.io";
        else
            return "https://ca-east.eastus.azurecontainerapps.io";
    }" />
    <set-backend-service base-url="@((string)context.Variables["backendUrl"])" />
  </inbound>
</policies>

<policies>
  <inbound>
    <base />
    <set-variable name="healthyBackends" value="@{
        var allBackends = new[] { 
            "https://ca-east.eastus.azurecontainerapps.io",
            "https://ca-west.westus.azurecontainerapps.io",
            "https://ca-eu.westeurope.azurecontainerapps.io"
        };
        var healthyList = new List<string>();
        
        // Check cached health status
        foreach (var backend in allBackends)
        {
            string cacheKey = "backend-health-" + backend;
            string healthStatus;
            
            if (context.Cache.TryGetValue(cacheKey, out healthStatus))
            {
                if (healthStatus == "healthy")
                    healthyList.Add(backend);
            }
            else
            {
                healthyList.Add(backend); // Assume healthy if no data
            }
        }
        
        return healthyList.Count > 0 ? healthyList : allBackends;
    }" />
    
    <!-- Random selection from healthy backends -->
    <set-backend-service base-url="@{
        var backends = (List<string>)context.Variables["healthyBackends"];
        var random = new Random();
        return backends[random.Next(0, backends.Count)];
    }" />
  </inbound>
  
  <outbound>
    <base />
    <!-- Cache health status based on response -->
    <choose>
      <when condition="@(context.Response.StatusCode >= 500)">
        <cache-store-value 
          key="@("backend-health-" + context.Request.Url.Host)" 
          value="unhealthy" 
          duration="60" />
      </when>
      <otherwise>
        <cache-store-value 
          key="@("backend-health-" + context.Request.Url.Host)" 
          value="healthy" 
          duration="300" />
      </otherwise>
    </choose>
  </outbound>
</policies>

python test_mcp.py

Test 1: Region: eastus
Test 2: Region: westus
Test 3: Region: eastus
Test 4: Region: westus
...

ContainerAppConsoleLogs_CL
| where TimeGenerated > ago(1h)
| extend region = tostring(parse_json(Log_s).metadata.region)
| summarize count() by region, bin(TimeGenerated, 5m)
| render timechart

curl http://localhost:8989/health

{
  "status": "ok",
  "service": "bing-grounding-api",
  "region": "eastus",
  "agents_loaded": 5
}

curl -X POST "http://localhost:8989/bing-grounding?query=What+happened+in+finance+today?"

{
  "content": "Today in finance, the U.S. stock market saw a sharp decline, with the Dow Jones Industrial Average plunging almost 800 points (down 1.6%), and both the Nasdaq and S&P 500 also posting significant losses...",
  "citations": [
    {
      "id": 1,
      "type": "url",
      "url": "https://www.marketwatch.com/...",
      "title": "Stock Market News Today"
    },
    {
      "id": 2,
      "type": "url",
      "url": "https://www.cnbc.com/...",
      "title": "Federal Reserve Commentary"
    }
  ],
  "metadata": {
    "agent_route": "gpt4o_1",
    "model": "gpt-4o",
    "agent_id": "asst_abc123...",
    "region": "eastus"
  }
}

{
  "error": "processing_error",
  "message": "Error details...",
  "metadata": {
    "agent_route": "gpt4o_1",
    "model": "gpt-4o",
    "agent_id": "asst_abc123...",
    "region": "eastus"
  }
}

{
  "content": "Azure AI Foundry is a comprehensive platform for building, deploying, and managing AI applications...",
  "citations": [
    {
      "id": 1,
      "type": "url",
      "url": "https://azure.microsoft.com/products/ai-studio",
      "title": "Azure AI Foundry Documentation"
    }
  ],
  "metadata": {
    "agent_route": "gpt4o_3",      // ← Agent pool #3 (load balanced)
    "model": "gpt-4o",              // ← Using GPT-4o model
    "agent_id": "asst_ElHsNtK1PSFxwha7tLWIFM7T",  // ← Specific agent instance
    "region": "eastus"              // ← Request served from East US
  }
}

{
  "error": "rate_limit_exceeded",
  "message": "Model deployment TPM limit exceeded. Please retry.",
  "metadata": {
    "agent_route": "gpt4o_2",      // ← Identifies which agent hit rate limit
    "model": "gpt-4o",
    "agent_id": "asst_abc123xyz",
    "region": "westus"              // ← Regional capacity issue
  }
}

# Environment variable set by Bicep deployment
AZURE_REGION = os.getenv("AZURE_REGION", "unknown")

# On successful response (line ~133)
result["metadata"] = {
    "agent_route": agent_route,      # From URL path (gpt4o_1, gpt4o_2, etc.)
    "model": model,                  # From agent configuration
    "agent_id": AGENTS[agent_route]["agent_id"],  # From agent pool
    "region": AZURE_REGION           # From container environment
}

# On error response (line ~147)
"metadata": {
    "agent_route": agent_route,
    "model": model,
    "agent_id": AGENTS.get(agent_route, {}).get("agent_id", "unknown"),
    "region": AZURE_REGION
}

{
  name: 'AZURE_REGION'
  value: location  // Resolves to deployment region (eastus, westus, etc.)
}

# Local
curl http://localhost:8989/health

# Azure (Container App)
curl https://ca-vw5lt6yc7noze.eastus.azurecontainerapps.io/health

{
  "status": "ok",
  "service": "bing-grounding-api",
  "region": "eastus",
  "agents_loaded": 5
}

# Local
curl -X POST "http://localhost:8989/bing-grounding/gpt4o_1?query=What+is+Azure+AI+Foundry?"

# Azure (Container App)
curl -X POST "https://ca-vw5lt6yc7noze.eastus.azurecontainerapps.io/bing-grounding/gpt4o_1?query=What+is+Azure+AI+Foundry?"

{
  "content": "Azure AI Foundry is Microsoft's unified platform...",
  "citations": [
    {
      "id": 1,
      "type": "url",
      "url": "https://azure.microsoft.com/products/ai-studio",
      "title": "Azure AI Foundry Overview"
    }
  ],
  "metadata": {
    "agent_route": "gpt4o_1",
    "model": "gpt-4o",
    "agent_id": "asst_ElHsNtK1PSFxwha7tLWIFM7T",
    "region": "eastus"
  }
}

# Option 1: Azure Portal
# Navigate to: APIM → Subscriptions → "Built-in all-access subscription" → Show keys

# Option 2: Azure CLI
az apim subscription show \
  --resource-group rg-bing-grounding-mcp-dev \
  --service-name apim-xxxxxx \
  --sid master \
  --query primaryKey -o tsv

# MCP Server URL (from APIM)
APIM_MCP_SERVER_URL=https://apim-vw5lt6yc7noze.azure-api.net/bing-grounding-mcp/mcp

# Subscription Key (from APIM portal or CLI)
APIM_SUBSCRIPTION_KEY=70f2c804e2ee4f749cea4b8ab3246e7e

# Activate virtual environment
_env_activate.bat

# Run tests
python test_mcp.py

=== Testing MCP Endpoint ===
MCP Server URL: https://apim-vw5lt6yc7noze.azure-api.net/bing-grounding-mcp/mcp

Test 1: What are the latest developments in AI?
RESULT: OK (10.6s)
  Region: eastus                              ← Azure region that processed request
  Model: gpt-4o                               ← AI model used for generation
  Agent Route: gpt4o_2                        ← Agent pool identifier (load balanced)
  Agent ID: asst_ElHsNtK1PSFxwha7tLWIFM7T     ← Specific agent instance ID
  Citations: 3                                ← Number of Bing grounding citations
    [1] AI News December 2025: In-Depth and Concise
    [2] Recent Developments in Generative AI Research
    [3] OpenAI Announces GPT-4.5

  Response: During December 2025, several notable advancements have been made in artificial intelligence...

Test 2: What happened in the stock market today?
RESULT: OK (8.2s)
  Region: westus                              ← Different region (multi-region load balancing)
  Model: gpt-4o
  Agent Route: gpt4o_3                        ← Different agent (load balanced across 5 agents)
  Agent ID: asst_xyz789...
  Citations: 4
    [1] Market Watch - December 17, 2025
    [2] CNBC Stock Market Update
    [3] Bloomberg Markets Summary
    [4] S&P 500 Daily Close

  Response: Today's stock market showed mixed performance, with the S&P 500 closing up 0.3%...

Test 3: Explain quantum computing
RESULT: OK (12.1s)
  Region: eastus                              ← Back to eastus (round-robin balancing)
  Model: gpt-4o
  Agent Route: gpt4o_1                        ← Cycling through agent pool
  Agent ID: asst_def456...
  Citations: 5
    [1] Quantum Computing Basics - Nature
    [2] IBM Quantum - Overview
    [3] Google Quantum AI Research
    [4] Quantum Algorithms Explained
    [5] Introduction to Qubits

  Response: Quantum computing is a revolutionary approach to computation that leverages quantum mechanics...

===========================
Tests completed: 5
Success: 5 (100%)
Failed: 0 (0%)
Average response time: 9.4s
===========================

Test 4: What are the benefits of cloud computing?
RESULT: FAILED (2.5s) - rate_limit_exceeded
  Region: westus                              ← Helps isolate regional capacity issues
  Model: gpt-4o
  Agent Route: gpt4o_4                        ← This specific agent hit rate limit
  Agent ID: asst_ghi789...
  Error: Model deployment TPM limit exceeded  ← Error message

  Action: Increase TPM quota for westus deployment or adjust load balancing

curl -X POST "https://apim-vw5lt6yc7noze.azure-api.net/bing-grounding-mcp/mcp" \
  -H "Ocp-Apim-Subscription-Key: YOUR_SUBSCRIPTION_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "method": "tools/call",
    "params": {
      "name": "bing_grounding",
      "arguments": {
        "query": "What is the weather like today?"
      }
    },
    "id": 1
  }'

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "content": [
      {
        "type": "text",
        "text": "Today's weather varies by location. For specific weather information, please check your local forecast. As of December 17, 2025, many regions are experiencing seasonal winter conditions..."
      }
    ],
    "metadata": {
      "agent_route": "gpt4o_1",               // ← Which agent pool handled request
      "model": "gpt-4o",                      // ← Model used
      "agent_id": "asst_ElHsNtK1PSFxwha7tLWIFM7T",  // ← Specific agent instance
      "region": "eastus"                      // ← Region that processed request
    }
  }
}

# Add -v flag to see full request/response headers
curl -v -X POST "https://apim-vw5lt6yc7noze.azure-api.net/bing-grounding-mcp/mcp" \
  -H "Ocp-Apim-Subscription-Key: YOUR_SUBSCRIPTION_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "method": "tools/call",
    "params": {
      "name": "bing_grounding",
      "arguments": {
        "query": "What is Azure AI Foundry?"
      }
    },
    "id": 1
  }' | jq '.'

< HTTP/2 200
< content-type: application/json
< ocp-apim-trace-location: https://apimst...  ← APIM trace URL (if tracing enabled)
< x-backend-server: ca-vw5lt6yc7noze         ← Which Container App served request

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "content": [
      {
        "type": "text",
        "text": "Azure AI Foundry is Microsoft's comprehensive platform for building, deploying, and managing AI applications. It provides a unified experience for developing custom AI solutions, integrating with Azure OpenAI Service, and leveraging pre-built AI models..."
      }
    ],
    "citations": [
      {
        "id": 1,
        "type": "url",
        "url": "https://azure.microsoft.com/en-us/products/ai-studio",
        "title": "Azure AI Foundry - Microsoft Azure"
      },
      {
        "id": 2,
        "type": "url",
        "url": "https://learn.microsoft.com/azure/ai-studio/",
        "title": "Azure AI Foundry documentation"
      }
    ],
    "metadata": {
      "agent_route": "gpt4o_2",
      "model": "gpt-4o",
      "agent_id": "asst_xyz789abc123def456",
      "region": "eastus"
    }
  }
}

{
  "statusCode": 401,
  "message": "Access denied due to missing subscription key"
}

-H "Ocp-Apim-Subscription-Key: YOUR_KEY_HERE"

azd deploy  # Redeploy to update environment variables

# Run multiple tests to see region rotation
for i in {1..10}; do
  echo "Test $i:"
  curl -s -X POST "https://apim-xxx.azure-api.net/bing-grounding-mcp/mcp" \
    -H "Ocp-Apim-Subscription-Key: YOUR_KEY" \
    -H "Content-Type: application/json" \
    -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"bing_grounding","arguments":{"query":"test"}},"id":'$i'}' \
    | jq -r '.result.metadata.region'
done

Test 1: eastus           ← First request to East US
Test 2: westus           ← Load balanced to West US
Test 3: eastus           ← Round-robin back to East US
Test 4: westus
Test 5: eastus
Test 6: westus
Test 7: eastus
Test 8: westus
Test 9: eastus
Test 10: westus

# Get complete metadata from multiple requests
for i in {1..5}; do
  echo "=== Request $i ==="
  curl -s -X POST "https://apim-xxx.azure-api.net/bing-grounding-mcp/mcp" \
    -H "Ocp-Apim-Subscription-Key: YOUR_KEY" \
    -H "Content-Type: application/json" \
    -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"bing_grounding","arguments":{"query":"test query"}},"id":'$i'}' \
    | jq '.result.metadata'
  echo ""
done

=== Request 1 ===
{
  "agent_route": "gpt4o_1",                    ← Agent pool #1
  "model": "gpt-4o",
  "agent_id": "asst_ElHsNtK1PSFxwha7tLWIFM7T",
  "region": "eastus"                           ← East US region
}

=== Request 2 ===
{
  "agent_route": "gpt4o_3",                    ← Different agent (load balanced)
  "model": "gpt-4o",
  "agent_id": "asst_Abc123Xyz789Def456Ghi",
  "region": "westus"                           ← West US region
}

=== Request 3 ===
{
  "agent_route": "gpt4o_2",                    ← Third agent
  "model": "gpt-4o",
  "agent_id": "asst_Qrs789Tuv012Wxy345Zab",
  "region": "eastus"                           ← Back to East US
}

=== Request 4 ===
{
  "agent_route": "gpt4o_5",                    ← Fifth agent
  "model": "gpt-4o",
  "agent_id": "asst_Mno456Pqr789Stu012Vwx",
  "region": "westus"                           ← Back to West US
}

=== Request 5 ===
{
  "agent_route": "gpt4o_4",                    ← Fourth agent
  "model": "gpt-4o",
  "agent_id": "asst_Cde345Fgh678Ijk901Lmn",
  "region": "eastus"                           ← East US again
}

# Run 50 requests and count region distribution
echo "Testing 50 requests across regions..."
for i in {1..50}; do
  curl -s -X POST "https://apim-xxx.azure-api.net/bing-grounding-mcp/mcp" \
    -H "Ocp-Apim-Subscription-Key: YOUR_KEY" \
    -H "Content-Type: application/json" \
    -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"bing_grounding","arguments":{"query":"test"}},"id":'$i'}' \
    | jq -r '.result.metadata.region'
done | sort | uniq -c

     25 eastus          ← 50% of requests (good distribution)
     25 westus          ← 50% of requests (good distribution)

     45 eastus          ← 90% to one region
      5 westus          ← Only 10% to other region

# Install dependencies
pip install aiohttp asyncio

# Run load test (included in test_mcp.py)
python test_mcp.py --concurrent 10 --iterations 100

ai-bing-grounding-mcp/
├── agents/                         # AI Agent implementations
│   ├── __init__.py
│   ├── base_agent.py              # Abstract base class
│   └── bing_grounding.py          # Bing grounding agent
├── ai/                             # (Legacy - not used)
│   ├── __init__.py
│   └── azure_openai_client.py
├── app/                            # FastAPI application
│   ├── __init__.py
│   └── main.py                    # API endpoints
├── apim-policy.xml                # Main APIM policy (load balancing + circuit breaker)
├── apim-policy-with-healthcheck.xml  # Enhanced APIM policy with active health checks
├── apim-healthcheck-monitor.xml   # Optional active health monitoring policy
├── docker-compose.yaml            # Local Docker development
├── dockerfile                     # Container image definition
├── env.sample                     # Environment variable template
├── main.py                        # Application entry point
├── requirements.txt               # Python dependencies
├── _env_activate.bat              # Activate virtual environment
├── _env_create.bat                # Create virtual environment
├── _install.bat                   # Install dependencies
├── _run_server.bat                # Run FastAPI server
├── _up.bat                        # Start Docker Compose
├── _down.bat                      # Stop Docker Compose
└── README.md                      # This file

# Windows (PowerShell)
powershell -ex AllSigned -c "Invoke-RestMethod 'https://aka.ms/install-azd.ps1' | Invoke-Expression"

# macOS/Linux
curl -fsSL https://aka.ms/install-azd.sh | bash

azd auth login

azd up

SUCCESS: Your application was provisioned and deployed to Azure in X minutes.

You can view the application at https://ca-xxxxxx.eastus2.azurecontainerapps.io

azd env new <environment-name>

azd provision

azd deploy

azd env get-values | grep AZURE_CONTAINER_APP_ENDPOINT
# or
azd env get-values | findstr AZURE_CONTAINER_APP_ENDPOINT  # Windows

# Health check
curl https://ca-xxxxxx.eastus2.azurecontainerapps.io/health

# List agents
curl https://ca-xxxxxx.eastus2.azurecontainerapps.io/agents

# Query with Bing grounding
curl -X POST "https://ca-xxxxxx.eastus2.azurecontainerapps.io/bing-grounding/gpt4o_1?query=What+is+Azure+AI+Foundry?"

# Create environment
azd env new <env-name>

# Set subscription (find with: az account list -o table)
azd env set AZURE_SUBSCRIPTION_ID "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

# Set location
azd env set AZURE_LOCATION "eastus2"

# Now provision and deploy without prompts
azd up

# Show all environment variables and outputs
azd env get-values

# Show deployment status and endpoints
azd show

azd deploy

azd provision

# Get resource group from environment
RG=$(azd env get-values | grep AZURE_RESOURCE_GROUP | cut -d'=' -f2 | tr -d '"')

# Get Container App name
CA_NAME=$(azd env get-values | grep AZURE_CONTAINER_APP_NAME | cut -d'=' -f2 | tr -d '"')

# Stream logs
az containerapp logs show --name $CA_NAME --resource-group $RG --follow

# Create and deploy dev environment
azd env new dev
azd env set AZURE_LOCATION "eastus2"
azd up

# Create and deploy prod environment
azd env new prod
azd env set AZURE_LOCATION "eastus"
azd up

# Switch between environments
azd env select dev
azd env select prod

# List all environments
azd env list

# Delete all Azure resources (with confirmation)
azd down

# Delete without prompts
azd down --force --purge

# Get ACR credentials
ACR_USERNAME=$(az acr credential show --name acrbing123 --query username -o tsv)
ACR_PASSWORD=$(az acr credential show --name acrbing123 --query passwords[0].value -o tsv)

# Deploy instance 1
az containerapp create \
  --name bing-grounding-api-0 \
  --resource-group rg-bing-grounding \
  --environment cae-bing-grounding \
  --image acrbing123.azurecr.io/bing-grounding-api:latest \
  --target-port 8989 \
  --ingress external \
  --registry-server acrbing123.azurecr.io \
  --registry-username $ACR_USERNAME \
  --registry-password $ACR_PASSWORD \
  --system-assigned \
  --env-vars \
    AZURE_AI_PROJECT_ENDPOINT="https://eastus.services.ai.azure.com/api/projects/yourProject" \
    AZURE_AI_AGENT_ID="asst_xxxxxxxxxxxxx"

# Repeat for instances 1 and 2
az containerapp create --name bing-grounding-api-1 ... (same parameters)
az containerapp create --name bing-grounding-api-2 ... (same parameters)

# Get managed identity principal IDs
PRINCIPAL_ID_0=$(az containerapp identity show \
  --name bing-grounding-api-0 \
  --resource-group rg-bing-grounding \
  --query principalId -o tsv)

# Grant access to AI Project (repeat for each instance)
az role assignment create \
  --assignee $PRINCIPAL_ID_0 \
  --role "Cognitive Services User" \
  --scope "/subscriptions/<sub-id>/resourceGroups/rg-bing-grounding/providers/Microsoft.CognitiveServices/accounts/<ai-project-name>"

# Build and push new image
docker build -t acrbing123.azurecr.io/bing-grounding-api:v2 .
docker push acrbing123.azurecr.io/bing-grounding-api:v2

# Update container apps
az containerapp update \
  --name bing-grounding-api-0 \
  --resource-group rg-bing-grounding \
  --image acrbing123.azurecr.io/bing-grounding-api:v2

# Repeat for other instances

# Start services
docker-compose up -d

# View logs
docker-compose logs -f

# Stop services
docker-compose down

┌──────────────────────────────────────────┐
│      [AZURE API MANAGEMENT]              │
│                                          │
│  ┌────────────────────────────────────┐ │
│  │  Load Balancer + Circuit Breaker   │ │
│  │  • Session Affinity (Cookies)      │ │
│  │  • Health-Based Routing            │ │
│  │  • Auto Failover & Recovery        │ │
│  └─────────────────┬──────────────────┘ │
└────────────────────┼────────────────────┘
                     │
         ┌───────────┼───────────┐
         │           │           │
         ▼           ▼           ▼
┌─────────────┐ ┌─────────────┐ ... (N instances)
│ ✅ HEALTHY  │ │ ❌ UNHEALTHY│
│ Container   │ │ Container   │
│ App #1      │ │ App #2      │
│ [ACTIVE]    │ │ [REMOVED]   │
└─────────────┘ └─────────────┘

agents/
├── base_agent.py           # Abstract base class for all agents
└── bing_grounding.py       # Bing grounding implementation

class BaseAgent(ABC):
    """Abstract base class for all agents"""
    
    def __init__(self, endpoint: str = None, agent_id: str = None):
        self.endpoint = endpoint
        self.agent_id = agent_id
    
    @abstractmethod
    def chat(self, message: str) -> str:
        """Process a message and return response"""
        pass

class CustomAgent(BaseAgent):
    def __init__(self):
        endpoint = os.getenv("CUSTOM_AGENT_ENDPOINT")
        agent_id = os.getenv("CUSTOM_AGENT_ID")
        super().__init__(endpoint=endpoint, agent_id=agent_id)
    
    def chat(self, message: str) -> str:
        # Your custom implementation
        pass

// Add to resources.bicep

// Virtual Network
resource vnet 'Microsoft.Network/virtualNetworks@2023-05-01' = {
  name: 'vnet-${uniqueString(resourceGroup().id)}'
  location: location
  tags: tags
  properties: {
    addressSpace: {
      addressPrefixes: ['10.0.0.0/16']
    }
    subnets: [
      {
        name: 'subnet-containerapp'
        properties: {
          addressPrefix: '10.0.0.0/23'
          delegations: [
            {
              name: 'Microsoft.App/environments'
              properties: {
                serviceName: 'Microsoft.App/environments'
              }
            }
          ]
        }
      }
      {
        name: 'subnet-privateendpoints'
        properties: {
          addressPrefix: '10.0.2.0/24'
          privateEndpointNetworkPolicies: 'Disabled'
        }
      }
    ]
  }
}

// Update Container App Environment with VNet
resource containerAppEnv 'Microsoft.App/managedEnvironments@2023-05-01' = {
  name: containerAppEnvName
  location: location
  tags: tags
  properties: {
    vnetConfiguration: {
      infrastructureSubnetId: vnet.properties.subnets[0].id
      internal: true  // Make it internal for production
    }
    appLogsConfiguration: {
      destination: 'log-analytics'
      logAnalyticsConfiguration: {
        customerId: logAnalytics.properties.customerId
        sharedKey: logAnalytics.listKeys().primarySharedKey
      }
    }
  }
}

// Private DNS Zones (add to resources.bicep)
resource privateDnsZoneStorage 'Microsoft.Network/privateDnsZones@2020-06-01' = {
  name: 'privatelink.blob.core.windows.net'
  location: 'global'
  tags: tags
}

resource privateDnsZoneKeyVault 'Microsoft.Network/privateDnsZones@2020-06-01' = {
  name: 'privatelink.vaultcore.azure.net'
  location: 'global'
  tags: tags
}

resource privateDnsZoneACR 'Microsoft.Network/privateDnsZones@2020-06-01' = {
  name: 'privatelink.azurecr.io'
  location: 'global'
  tags: tags
}

// Link DNS Zones to VNet
resource privateDnsZoneLinkStorage 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = {
  parent: privateDnsZoneStorage
  name: 'link-storage'
  location: 'global'
  properties: {
    registrationEnabled: false
    virtualNetwork: {
      id: vnet.id
    }
  }
}

// Private Endpoint for Storage Account
resource privateEndpointStorage 'Microsoft.Network/privateEndpoints@2023-05-01' = {
  name: 'pe-storage-${uniqueString(resourceGroup().id)}'
  location: location
  tags: tags
  properties: {
    subnet: {
      id: vnet.properties.subnets[1].id  // Private endpoints subnet
    }
    privateLinkServiceConnections: [
      {
        name: 'storage-connection'
        properties: {
          privateLinkServiceId: storage.id
          groupIds: ['blob']
        }
      }
    ]
  }
}

// Private DNS Zone Group for Storage
resource privateDnsZoneGroupStorage 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2023-05-01' = {
  parent: privateEndpointStorage
  name: 'default'
  properties: {
    privateDnsZoneConfigs: [
      {
        name: 'config-storage'
        properties: {
          privateDnsZoneId: privateDnsZoneStorage.id
        }
      }
    ]
  }
}

// Update Storage Account to disable public access
resource storage 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: 'st${uniqueString(resourceGroup().id)}'
  location: location
  tags: tags
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    accessTier: 'Hot'
    supportsHttpsTrafficOnly: true
    minimumTlsVersion: 'TLS1_2'
    publicNetworkAccess: 'Disabled'  // Changed from default
    networkAcls: {
      defaultAction: 'Deny'
      bypass: 'AzureServices'
    }
  }
}

// Repeat similar patterns for:
// - Key Vault private endpoint
// - Container Registry private endpoint
// - AI Hub/Project (if supported in your region)

// Network Security Group (add to resources.bicep)
resource nsg 'Microsoft.Network/networkSecurityGroups@2023-05-01' = {
  name: 'nsg-containerapp'
  location: location
  tags: tags
  properties: {
    securityRules: [
      {
        name: 'AllowHTTPSInbound'
        properties: {
          priority: 100
          direction: 'Inbound'
          access: 'Allow'
          protocol: 'Tcp'
          sourcePortRange: '*'
          destinationPortRange: '443'
          sourceAddressPrefix: 'Internet'
          destinationAddressPrefix: '*'
        }
      }
      {
        name: 'DenyAllInbound'
        properties: {
          priority: 1000
          direction: 'Inbound'
          access: 'Deny'
          protocol: '*'
          sourcePortRange: '*'
          destinationPortRange: '*'
          sourceAddressPrefix: '*'
          destinationAddressPrefix: '*'
        }
      }
    ]
  }
}

// Associate NSG with Container App subnet
resource vnet 'Microsoft.Network/virtualNetworks@2023-05-01' = {
  // ... existing properties
  properties: {
    // ... existing properties
    subnets: [
      {
        name: 'subnet-containerapp'
        properties: {
          addressPrefix: '10.0.0.0/23'
          networkSecurityGroup: {
            id: nsg.id
          }
          delegations: [
            {
              name: 'Microsoft.App/environments'
              properties: {
                serviceName: 'Microsoft.App/environments'
              }
            }
          ]
        }
      }
    ]
  }
}

// Azure Front Door with WAF (add to resources.bicep)
resource frontDoor 'Microsoft.Cdn/profiles@2023-05-01' = {
  name: 'fd-${uniqueString(resourceGroup().id)}'
  location: 'global'
  tags: tags
  sku: {
    name: 'Premium_AzureFrontDoor'  // Premium includes WAF
  }
  properties: {
    originResponseTimeoutSeconds: 60
  }
}

// WAF Policy
resource wafPolicy 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2022-05-01' = {
  name: 'waf${uniqueString(resourceGroup().id)}'
  location: 'global'
  tags: tags
  sku: {
    name: 'Premium_AzureFrontDoor'
  }
  properties: {
    policySettings: {
      enabledState: 'Enabled'
      mode: 'Prevention'
      requestBodyCheck: 'Enabled'
    }
    managedRules: {
      managedRuleSets: [
        {
          ruleSetType: 'Microsoft_DefaultRuleSet'
          ruleSetVersion: '2.1'
        }
        {
          ruleSetType: 'Microsoft_BotManagerRuleSet'
          ruleSetVersion: '1.0'
        }
      ]
    }
  }
}

// Front Door Endpoint
resource fdEndpoint 'Microsoft.Cdn/profiles/afdEndpoints@2023-05-01' = {
  parent: frontDoor
  name: 'endpoint-${uniqueString(resourceGroup().id)}'
  location: 'global'
  properties: {
    enabledState: 'Enabled'
  }
}

// Origin Group (Container Apps)
resource originGroup 'Microsoft.Cdn/profiles/originGroups@2023-05-01' = {
  parent: frontDoor
  name: 'containerapp-origins'
  properties: {
    loadBalancingSettings: {
      sampleSize: 4
      successfulSamplesRequired: 3
      additionalLatencyInMilliseconds: 50
    }
    healthProbeSettings: {
      probePath: '/health'
      probeRequestType: 'GET'
      probeProtocol: 'Https'
      probeIntervalInSeconds: 30
    }
    sessionAffinityState: 'Enabled'  // Sticky sessions
  }
}

// Origins (one for each Container App instance)
resource origin0 'Microsoft.Cdn/profiles/originGroups/origins@2023-05-01' = {
  parent: originGroup
  name: 'origin-0'
  properties: {
    hostName: containerApp[0].properties.configuration.ingress.fqdn
    httpPort: 80
    httpsPort: 443
    originHostHeader: containerApp[0].properties.configuration.ingress.fqdn
    priority: 1
    weight: 1000
    enabledState: 'Enabled'
  }
}
// Repeat for other instances...

// Route
resource route 'Microsoft.Cdn/profiles/afdEndpoints/routes@2023-05-01' = {
  parent: fdEndpoint
  name: 'api-route'
  properties: {
    originGroup: {
      id: originGroup.id
    }
    supportedProtocols: ['Https']
    patternsToMatch: ['/*']
    forwardingProtocol: 'HttpsOnly'
    linkToDefaultDomain: 'Enabled'
    httpsRedirect: 'Enabled'
  }
  dependsOn: [
    origin0
  ]
}

// Associate WAF with Endpoint
resource wafAssociation 'Microsoft.Cdn/profiles/securityPolicies@2023-05-01' = {
  parent: frontDoor
  name: 'waf-policy'
  properties: {
    parameters: {
      type: 'WebApplicationFirewall'
      wafPolicy: {
        id: wafPolicy.id
      }
      associations: [
        {
          domains: [
            {
              id: fdEndpoint.id
            }
          ]
          patternsToMatch: ['/*']
        }
      ]
    }
  }
}

// Output the Front Door URL
output frontDoorUrl string = 'https://${fdEndpoint.properties.hostName}'

// Diagnostic Settings for Container Apps (add to resources.bicep)
resource diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [for i in range(0, containerAppInstances): {
  name: 'diag-containerapp-${i}'
  scope: containerApp[i]
  properties: {
    workspaceId: logAnalytics.id
    logs: [
      {
        category: 'ContainerAppConsoleLogs'
        enabled: true
        retentionPolicy: {
          enabled: true
          days: 30
        }
      }
      {
        category: 'ContainerAppSystemLogs'
        enabled: true
        retentionPolicy: {
          enabled: true
          days: 30
        }
      }
    ]
    metrics: [
      {
        category: 'AllMetrics'
        enabled: true
        retentionPolicy: {
          enabled: true
          days: 30
        }
      }
    ]
  }
}]

// Alert Rules
resource cpuAlert 'Microsoft.Insights/metricAlerts@2018-03-01' = {
  name: 'alert-high-cpu'
  location: 'global'
  tags: tags
  properties: {
    description: 'Alert when CPU usage exceeds 80%'
    severity: 2
    enabled: true
    scopes: [
      containerApp[0].id
      containerApp[1].id
      containerApp[2].id
    ]
    evaluationFrequency: 'PT5M'
    windowSize: 'PT15M'
    criteria: {
      'odata.type': 'Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria'
      allOf: [
        {
          name: 'HighCPU'
          metricName: 'UsageNanoCores'
          operator: 'GreaterThan'
          threshold: 80
          timeAggregation: 'Average'
        }
      ]
    }
    actions: []  // Add action groups here
  }
}