Plugins that turn a workspace into a full product stack

Every Foundry project can enable a managed PostgreSQL development database with a private connection string injected as DATABASE_URL. Schema work typically uses Drizzle ORM and migrations. A read-only database explorer helps teams inspect tables, columns, indexes, and sample rows without exposing credentials to the browser.

• Managed PostgreSQL for CRUD apps and form submissions
• Drizzle-friendly schema and migration workflow
• Read-only explorer for schemas, tables, and sample rows
• Server-side only access - no browser-exposed connection strings

App Storage provisions a project-scoped Azure Blob container with a managed SAS URL injected only into the server runtime. Frontend code never sees storage secrets - it calls your own API endpoints, while the backend uploads, lists, reads, and deletes blobs through the platform-managed container.

• Managed Azure Blob container per project
• Server-side SAS injection (DATA_STORAGE_SAS_URL)
• Upload, list, read, delete, and virtual folders via API
• Ideal for attachments, exports, generated assets, and documents

LLM/AI gives each project a governed path to language and embedding models through an OpenAI-compatible endpoint. Model names and credentials stay on the server. Typical uses include knowledge-base answers, assistants, summarisation, classification, and embedding-based search - without wiring a separate AI vendor stack for every app.

• OpenAI-compatible chat and embedding endpoints
• Project-scoped model configuration
• Server-side keys only - never leaked to the SPA
• Powers KB ask, agents, and AI-assisted workflows

Auth connects the app to Microsoft Entra Workforce, Entra External ID, or a custom OIDC provider using the platform-managed quick/shared or bring-your-own patterns. Redirect URIs, authorities, and scopes are injected as env vars. Protected APIs validate bearer tokens on the server - never ID tokens or Graph tokens as API credentials.

• Microsoft Entra Workforce (staff) and External ID (customers)
• Custom OIDC providers when you need them
• MSAL redirect auth with preview-safe iframe handoff
• JWT validation and fail-closed protected routes

Notifications enables transactional noreply email through Azure Communication Services. Connection strings stay server-side. Typical patterns are workflow confirmations, access requests, admin alerts, and “something happened” emails triggered only after authenticated app actions.

• Managed Azure Communication Services email
• Noreply sender address ready for app workflows
• Server-only secrets (ACS connection string)
• Demand-triggered sends from authenticated handlers

The SharePoint Connector connects delegated Microsoft 365 knowledge into the project. Agents and admins can discover sites, lists, libraries, and schema using real internal field names - then optionally enable curated list-item or library write actions when policy allows. Schema is never guessed and provisioning is never automatic on page load.

• Delegated SharePoint + Microsoft Graph discovery
• List/library schema with InternalName-first mapping
• Optional governed list-item and library writes
• Safe against surprise list/field creation on render

The Dataverse Connector brings Dynamics / Power Platform table metadata into the Foundry. Teams can discover tables, columns, relationships, and choice sets with the signed-in user’s delegated access, then build typed app experiences on top. Row writes require explicit opt-in and approved tables only.

• Table, column, relationship, and choice discovery
• Delegated environment access for the signed-in user
• Schema-first TypeScript contracts before coding
• Optional curated row create/update/delete with approval

SharePoint Embedded provisions Microsoft 365-governed document containers for the project - ideal when files need enterprise sharing, compliance, and Graph drive semantics instead of (or alongside) plain blob storage. Containers can be enabled per project and used for documents, attachments, and controlled file libraries.

• M365-governed project document containers
• Container create / list / read / upload flows
• Graph-aligned file semantics for enterprise docs
• Complements App Storage when SharePoint governance is required

Agent Tools turns admin-approved Model Context Protocol (MCP) services into callable capabilities for Foundry agents. Instead of ad-hoc API keys in prompts, operators activate curated tool packs so agents can safely reach documentation, Microsoft surfaces, or organisation-approved systems under policy.

• Admin-approved MCP services only
• Callable tools available to agents in the build loop
• Policy-gated activations rather than free-form endpoints
• Extends agents without hardcoding vendor logic into apps

Skills are reusable implementation guides and domain playbooks - auth patterns, database conventions, SharePoint rules, design systems, and more. When imported into a project (or organisation library), they become available to CDF chat and agents so delivery stays consistent across every build.

• Project and organisation skill packs
• Auth, database, design, SharePoint, and domain guides
• Exposed to CDF chat for guided delivery
• Keeps agent output aligned to your engineering standards