TL;DR: If you proxy requests to Azure AI Foundry, leave the mode parameter out of the payload; including it the wrong way is a common source of 400s. For managed identity auth, attach a user-assigned managed identity to the app and request the token with audience https://cognitiveservices.azure.com/.default, not the Foundry endpoint.

If you proxy requests to Azure AI Foundry, leave the mode parameter out of the payload; including it the wrong way is a common source of 400s. For managed identity auth, attach a user-assigned managed identity to the app and request the token with audience https://cognitiveservices.azure.com/.default, not the Foundry endpoint. Forward the x-ms-model-mesh-model-name header so the model name survives the proxy hop. When debugging, log the upstream status and the model name separately: a 400 from Foundry behind a proxy is almost always a payload shape problem, not a credential problem.

## When to use
You hit exactly this: Proxying AI Foundry: omit mode, use the Cognitive Services token audience in Proxying AI Foundry.

## When not to use
A different error, or the same symptom in a different tool. This page only covers the failure above.

## Compatibility
Proxying AI Foundry.

## Edge cases
- For managed identity auth, attach a user-assigned managed identity to the app and request the token with audience https://cognitiveservices.azure.com/.default, not the Foundry endpoint.