credential = DefaultAzureCredential

response = openai_client.responses.create

The correct authentication class is DefaultAzureCredential because the requirement is Microsoft Entra-based authentication, and this credential supports managed identity in hosted Azure environments. The Microsoft Foundry quickstart for Python shows the project client being created with AIProjectClient(endpoint=PROJECT_ENDPOINT, credential=DefaultAzureCredential()), which enables the Foundry SDK to authenticate without using API keys or embedded secrets. The same guidance shows creating an OpenAI-compatible client from the project by calling project.get_openai_client().

The correct Responses API method is create because the application must send a new prompt to the deployed model and receive generated output. Microsoft’s Foundry quickstart demonstrates the exact pattern: response = openai.responses.create(model= " gpt-5-mini " , input= " ... " ), followed by reading response.output_text. The retrieve operation is used to fetch an existing response, not submit a new inference request, and compact is not the correct method for generating a model response. AzureKeyCredential would violate the Microsoft Entra managed identity requirement, while ClientSecretCredential uses an application secret rather than managed identity. Reference topics: Microsoft Foundry SDK, AIProjectClient, Microsoft Entra authentication, DefaultAzureCredential, and Azure OpenAI Responses API.