Daily Defender News
Aboutmerill.net
Microsoft Security Exposure Management
Vulnerabilities and exposure

Mdash Foundry Integration

29 September 2026Doc update+8 / −21 lines

In brief

The page clarifies that Standard deployments use each of the three models once, refers to required model deployments for the Foundry resource, and consolidates the guidance that disconnecting Foundry disables agentic code scanning unless another connection is provided.

What Defender admins need to know

Administrators should use the updated deployment guidance and account for the loss of agentic code scanning when disconnecting Foundry without a replacement.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  1. Select the Deployments tab.
  2. Select Deploy a base model.
  3. Choose and deploy the following models with default or custom settings:

    • Standard: Deploy all three models:

      models only once:

    • gpt-5.4

      • gpt-5.3-codex

      • gpt-5.4-mini

        Deploy each model only once.

    • MAI Cyber** (Preview)**(Preview): To use this configuration, deploy the three models listed previously and:

    • MAI-Cyber-1-Flash

Important

Prerequisites

  • A Microsoft Foundry resource is created, and threethe required model deployments are completed.
  • The same setup applies to the new MAI-Cyber-1-Flash model, which is part of the MAI Cyber (Preview) configuration .

Create a content filter

Allow Codename MDASH to access your Microsoft Foundry resource

Codename MDASH needs to access your Microsoft Foundry endpoint to validate credentials and run agentic scans. When your Foundry resource networking is set to Selected networks and private endpoints, all inbound traffic is blocked by default, including requests from MDASH. Without allowing the required IP addresses, validation of the Foundry resource during MDASH onboarding will fail.

Note

If your Foundry resource has public access set to All networks, no action is required and you can continue to the next step.

To allow Codename MDASH to access your Microsoft Foundry resource, you should run script to configure access:

Disconnect Foundry

To replace a connected Foundry with a different one, or to remove the connection, you can disconnect at any time. Disconnecting the connected Foundry without providing an alternative will disable the use of the agentic code scanning.

  1. Go to the Initiative and select Settings (top-right).
  2. Select Disconnect next to the connected Foundry resource, then confirm by selecting Disconnect.

Once disconnected, you can leave it as is or reconnect at any time to the same Foundry or to a different one.

Note

  • Disconnecting the connected Foundry without providing an alternative will disable the use of the agentic code scanning.
  • Disconnecting removes the connection from MDASH. ItMDASH but it doesn't delete the Microsoft Foundry resource.

For Keyless authentication, disconnecting doesn't remove the managed identity, federated identity credential, or RBAC role assignment created for the connection. When you disconnect the Foundry resource in the portal, the confirmation dialog provides an optional cleanup script that removes these resources—select Copy script to run it. Running it is optional - run it if your organization requires full cleanup.