Last updated: July 24, 2026
The short answer
Do not replace Foundry with Kimss. Pair them: Foundry remains the execution plane; Kimss adds workspaces, Entra SSO, RBAC, Kimss Credits, PostgreSQL isolation, and one /v1 gateway for chat and agents.
Foundry projects hold models, agents, and Azure-native tooling. What Foundry does not automatically provide is a SaaS-style multi-tenant product layer: per-customer isolation, productized RBAC, finance-friendly usage units, and a single developer key that embeds governed agents into many codebases.
Kimss fills that gap for ISVs, internal platform teams, and enterprises shipping AI into products. Each workspace maps members, API keys, agent definitions, file storage, and credit pools—while routing selects the appropriate Foundry project or shared infrastructure shard.
Capability comparison
Use this table in architecture reviews. Columns contrast Foundry alone with Foundry plus Kimss—not Kimss as a competing model runtime.
| Capability | Azure AI Foundry alone | Foundry + Kimss |
|---|---|---|
| Model & agent execution | Native Foundry projects | Same Foundry backend |
| Multi-tenant workspaces | Build yourself | PostgreSQL workspace isolation |
| Identity (Entra SSO, SCIM) | Wire yourself | Productized Entra + workspace RBAC |
| One key: chat + agents | Separate integration paths | Universal /v1 gateway |
| Spend control | Ad-hoc / per-project | Kimss Credits, pools, soft/hard caps |
| Usage & chargeback | Custom metering | Normalized credits + attribution |
| Audit trail | You design the sink | Optional APIM → Log Analytics |
| Procurement | Foundry billing only | Marketplace PAYG + invoice options |
When to choose Foundry alone
A single team with one Foundry project, no multi-tenant product surface, and no need for productized credits may stay on Foundry alone—especially for early prototypes.
If you are exploring models inside Azure without embedding agents into customer-facing applications, Foundry Studio and project-level controls may be enough. Governance can live in runbooks and Azure Cost Management until you productize.
The tipping point is usually the second tenant, the first finance review that asks for chargeback, or the first security questionnaire that asks who can change prompts and which key can call production agents.
When to add Kimss
Add Kimss when you need many teams or customers on shared Azure AI infrastructure with enforceable identity, budgets, and audit-friendly metadata—without staffing a permanent internal control-plane team.
Platform teams use Kimss so internal products share Foundry capacity safely. ISVs map each customer tenant to workspace-scoped agents, files, and usage rows. Builders keep POST /v1/agents/run and the Python SDK; operators configure policy once per workspace.
Optional Azure API Management logging can supplement Kimss-side attribution for Article 12-style audit discussions—verify your deployment path in /docs/architecture before enabling gateway-only modes in production.
Related Foundry governance reading
Deepen the governance story with dedicated authority pages and the CTO brief.
Read /azure-ai-foundry-governance for workspace-boundary patterns, /azure-ai-foundry-agent-gateway for gateway positioning, and /why-kimss for the executive narrative used in sales and architecture reviews.
Frequently asked questions
Is Kimss an Azure AI Foundry alternative?
Search intent often means “I need governance Foundry does not productize.” Kimss complements Foundry: execution stays on Foundry; Kimss is the multi-tenant control plane.
We already pay for Foundry—why Kimss?
Foundry is execution. Kimss adds identity, billing units, logs, and SDK so every team can embed agents safely. You keep Foundry.
Can we build the control plane ourselves?
Yes—budget platform engineering for orchestration, metering, audit, and ongoing API churn. Kimss ships that layer as a managed product.
Does Kimss lock agents to one Foundry project?
Kimss owns portable agent definitions; Foundry runs a materialized copy. Environment promotion re-materializes agents without application lock-in to a single project key.
Where should engineers start?
Create a workspace, follow /docs/quick_start and /python-sdk-mcp-quickstart, and treat /docs/api_docs as the public contract.