Choosing the runner AI provider (Foundry or OpenAI)

A CloudRadial AutomationAI runner calls an AI provider for its AI activities. By default that is the bundled private Azure AI Foundry, but you can point it at the OpenAI public API instead. This article explains both options and how to switch by editing the runner's Key Vault secrets and restarting the Function Apps. It is for the technician operating a runner.

In this article:

• Foundry, the default
• OpenAI
• The AI-provider Key Vault secrets
• Switching an existing runner

Foundry, the Default

By default the runners call the bundled private Azure AI Foundry account, authenticated by the runner's managed identity. The Foundry account is reachable only through a private endpoint, so all AI traffic stays inside the runner's virtual network with no internet egress, and there is no API key to manage. This is the recommended posture for most installs.

OpenAI

You can instead route the runners at the OpenAI public API. In this mode the runners call api.openai.com (or an endpoint override you supply) rather than the private Foundry endpoint.

Important -> If your runner egress is locked down, allow api.openai.com before switching, or the runners will fail to reach OpenAI.

There are two ways to select OpenAI:

• After install, edit the runner's Key Vault secrets and restart the Function Apps. This needs no redeploy
• From a fresh install, run the underlying runner-sample/Deploy-Runner.ps1 directly with -AiProvider openai, which exposes the OpenAI parameters the installer does not

The AI-Provider Key Vault Secrets

All of the AI-provider configuration lives as plain secrets in the shared runner Key Vault. The Function Apps read them as Key Vault references at startup, so changing a secret value and restarting is all it takes to rotate the key, swap the model, or flip providers:

The OpenAI configuration lives in its own secrets and never reuses the Foundry endpoint or credentials. To edit these secrets you need the Key Vault Secrets Officer role on the vault and network access to its private endpoint. Because the vault is private, the installer can offer to allow your machine's IP on the vault firewall at the end of a deploy; otherwise edit the secrets from a host on the runner virtual network or a peered network.

Switching an Existing Runner

Why are we doing this? Use these steps to flip an already-deployed runner between Foundry and OpenAI without redeploying.

1. When switching to OpenAI, seed the openai-api-key and openai-model secrets first, so the runners do not restart with openai selected and no key.
2. Set the ai-provider secret to openai, or back to foundry.
3. Restart every runner Function App in the resource group so they pick up the new values.

No redeploy is needed. The runner's README.md includes the exact PowerShell commands for setting each secret and restarting the apps.

With the provider chosen, you are ready to register the runner. Next: Registering and managing runners.

If you are still having trouble, we're here to help! Submit a ticket here for assistance, and don't forget to check our status page to ensure there are no outages in your area.