Last time I made a promise: that if you can build a Power Automate flow, you're most of the way to building an AI agent. This time we start proving it, and we do it the only way that really counts: by actually building something.
This is a hands-on walkthrough, not concepts. We're going to stand up a real Claude model inside Microsoft Foundry, say hello to it, and get a reply back. That's it. One small, complete, working thing. Everything else in this series stacks on top of this one step, so it's worth doing slowly and getting right.
Before you start
Nothing to install on your machine yet. But there are a few boxes to tick on the Azure side, and it's less painful to know them up front than to hit a wall halfway through.
- A paid Azure subscription with pay-as-you-go billing. This is the one that trips people up: a free trial, student credits, or a sponsored "Azure credits only" subscription won't work for Claude. You need real pay-as-you-go billing turned on.
- A Microsoft Foundry project in a supported region. If you don't have one, you'll create it the first time you open the portal.
- Azure Marketplace access, because Claude is a partner model you subscribe to through the Marketplace.
- Contributor or Owner on the resource group. If someone else runs your Azure tenant, this is the thing to go ask them for.
If you've got all four, you're good. If you're missing the billing one, sort that out first, because everything downstream depends on it.
"Do I have to pay to try this?" Barely. There's no fully free way to run Claude in Foundry. The free Azure account gives you $200 of credit, but that's credit-only, and Claude won't run on credit-only or trial subscriptions. What you actually need is a pay-as-you-go subscription: a card on file, but no upfront charge. You only pay for the tokens you use, and for today's hello-world that's a few cents. So it's less "buy a subscription" and more "put a card down and pay pennies for the experiment."
Deploying Claude from the catalog
This is the part that sounds intimidating and turns out to be about eight clicks. Here's the whole path:
- Sign in to Microsoft Foundry at ai.azure.com, with the New Foundry toggle on.
- Go to Discover > Models and pick a Claude model. I went with Claude Sonnet 4.6, the one Microsoft uses in all their examples and a sensible, capable default to learn on.
- Select Deploy > Custom settings. (There's a Default settings option too, which just picks the Azure-hosted version for you. We'll use Custom so you can see what the choices actually are.)
- Accept the Azure Marketplace terms, pick an industry, and hit Agree and Proceed.
- Choose the model version and region scope. More on what those mean in the next section.
- Rename the deployment if you like. Worth knowing: the deployment name is what you'll pass as the
modelin your code later, so give it something you'll recognise. - Hit Deploy. When it finishes you land straight in the Playground, where you can type at Claude and get a reply without writing a line of code.
- Pop over to the Details tab and check the status says Succeeded.
That's genuinely it. You now have a frontier model running under your own Azure subscription.
Two flavors of "hosted", and which to pick
At the version step you'll see two options, and it's worth a sentence each so you're choosing on purpose rather than clicking past them.
- Version 2, Hosted on Azure. This is the default, and for most people it's the right answer. The model runs on Azure infrastructure, so it sits neatly inside your existing Azure identity, networking, and governance. If you just want to get going, pick this.
- Version 1, Hosted on Anthropic infrastructure. This routes to Anthropic's own hosting. You'd reach for it if you need an Anthropic feature or a model that isn't on the Azure-hosted option yet.
There's also a region scope choice. Global Standard works for every Claude model and version, and is the safe default. Data Zone Standard (US) keeps things in a US data zone and is available for some of the Azure-hosted versions. Handy if you have data-residency requirements, which, spoiler, is exactly the kind of thing Harbor's eventual security review will care about.
For today: Hosted on Azure, Global Standard. We'll come back to the residency question in a later post when the stakes are higher.
Saying hello to Claude
The Playground is lovely, but the whole point of this series is to call Claude from code so we can wire it into real things later. So let's make one request.
First, two things to grab from your deployment's Details tab:
- Your endpoint, which looks like
https://<your-resource-name>.services.ai.azure.com/anthropic - Your deployment name (the one you set earlier). This is the
modelvalue.
Then pick how you authenticate. There are two ways:
- Microsoft Entra ID, the keyless, enterprise-friendly option. Nothing secret sits in your code; Azure hands out a short-lived token. This is the one your security team will prefer, so it's the one I'll show.
- API key, simpler to start with, copied straight from the deployment details. Fine for a quick experiment. (One gotcha: the newest Mythos models are Entra-only and don't take API keys.)
Install the SDK with pip install -U anthropic azure-identity, then here's the whole hello-world with Entra ID:
from anthropic import AnthropicFoundry
from azure.identity import DefaultAzureCredential, get_bearer_token_provider
base_url = "https://<your-resource-name>.services.ai.azure.com/anthropic"
deployment_name = "claude-sonnet-4-6" # whatever you named your deployment
token_provider = get_bearer_token_provider(
DefaultAzureCredential(), "https://ai.azure.com/.default"
)
client = AnthropicFoundry(
azure_ad_token_provider=token_provider,
base_url=base_url,
)
message = client.messages.create(
model=deployment_name,
max_tokens=512,
messages=[
{"role": "user", "content": "In one sentence, what does Harbor Supply Co. sell?"}
],
)
print(message.content)
Run it. If a sentence about pallets and forklifts comes back, congratulations: you just called a frontier model running under your own Azure subscription. If you'd rather use the API key, swap the client line for AnthropicFoundry(api_key="YOUR_KEY", base_url=base_url) and drop the token bits.
Tiny as it is, this is the hinge the whole series turns on. Every agent we build from here is just this call, with more interesting things wrapped around it.
The billing bit nobody reads until it's too late
Quick, boring, important. Skipping this is how you get a surprise later.
Claude usage shows up on your normal Azure invoice. No separate Anthropic bill, no separate vendor to onboard. For a business that already lives in Azure, that's the quiet win here: no new procurement, no new contract, it just lands on the invoice you already pay. Usage is metered in Claude Consumption Units, and if your organisation has a Microsoft Azure Consumption Commitment (MACC), eligible Claude spend can count toward it. That's the kind of sentence that makes finance teams suddenly interested.
The flip side is the eligibility rules, which are stricter than you'd expect. These subscription types can't use Claude: free trials and student or startup-credit subscriptions, sponsored "Azure credits only" subscriptions, Cloud Solution Provider subscriptions, and enterprise accounts in a couple of specific regions. The common thread is the same as the prerequisites: real pay-as-you-go billing, or it won't run.
None of this costs anything until you actually make calls, so experimenting is cheap. Just know where the meter is before you build something that hammers it.
When it breaks (because it will)
I promised at the start of this series you'd see the bits that don't work on the first try. The classic first-run error here is a 403. Here's the short list of what goes wrong and the fix, so you don't lose an afternoon to a stack trace:
| What you see | What it usually means | The fix |
|---|---|---|
| 401 | Auth isn't right | Check the API key, or confirm your Entra scope is exactly https://ai.azure.com/.default
|
| 403 | You're in, but not allowed | Check your role; for Entra ID, assign yourself Cognitive Services User |
| 404 | It can't find the model | Re-check the base URL format and that model matches your deployment name, not the model ID |
| 429 | You're going too fast | Back off and retry, or request a quota increase |
The 403 trips people up because Contributor on the resource group looks like it should be enough. For the actual calls, Entra ID also wants Cognitive Services User. Thirty seconds to fix once you know; twenty minutes of confusion if you don't.
Next up
Right now Claude will happily tell us about Seattle or Harbor's forklifts, which is fun and completely useless for actual work. Next time we put it to a real job: taking one of Harbor's messy, half-typed support tickets and turning it into clean, structured data your systems can act on. That's where this stops being a chatbot and starts being useful.
If you got your first reply back today, you're officially off the starting line. Tell me what came back from your hello-world. I'd love to hear it.
See you next time. 😊
Top comments (0)