Add model endpoint identity setup guide (#915)

Author: paullizer

docs/admin_configuration.md

@@ -246,7 +246,7 @@ Use this section when you need to configure an area, validate it, and know what
 
 ![Annotated AI model controls](./images/admin-settings/ai-models.png)
 
-1. Open **AI Models** and add the chat model endpoint configuration: direct Azure OpenAI or APIM endpoint, authentication type, deployment names, and any default model choices.
+1. Open **AI Models** and add the chat model endpoint configuration: direct Azure OpenAI, Foundry (classic), New Foundry, or APIM endpoint, authentication type, deployment names, and any default model choices. For managed identity or service principal RBAC setup, see [Configure Model Endpoint Identity]({{ '/how-to/model_endpoint_identity_setup/' | relative_url }}).
 2. Configure **Embeddings** before enabling retrieval-backed workspace features, then use the connection test to verify the endpoint and authentication path.
 3. Enable **Processing Thoughts** and **Image Generation** only for deployments where users should see reasoning traces or generate images, then save and confirm the model selector appears in chat.
 
@@ -363,6 +363,7 @@ The Admin Settings page supports two navigation layouts:
 - **APIM vs Direct**: When using Azure API Management (APIM), you'll need to manually specify model names as automatic model fetching is not available
 - **Managed Identity**: When using Managed Identity authentication, ensure your Service Principal has the appropriate roles assigned:
   - **Azure OpenAI**: Cognitive Services OpenAI User role
+  - **Model Endpoints**: Azure OpenAI multi-endpoint discovery also needs Reader on the Azure OpenAI resource. Foundry (classic) and New Foundry endpoints need Foundry User, or Azure AI User where older role names are still shown, on the target project or backing Foundry resource. See [Configure Model Endpoint Identity]({{ '/how-to/model_endpoint_identity_setup/' | relative_url }}).
   - **Speech Service**: Start with `Cognitive Services Speech User`; add `Cognitive Services Speech Contributor` if transcription operations still require it. Managed identity also requires the custom-domain Speech endpoint, and text-to-speech needs the Speech Resource ID.
   - **Video Indexer**: Grant the App Service system-assigned managed identity `Contributor` on the Video Indexer resource. If Azure asks for a user-assigned managed identity during Video Indexer resource creation, that identity is for the Video Indexer resource itself, not for Simple Chat runtime calls.
 - **Dependencies**: The walkthrough will alert you if required services aren't configured when you enable dependent features (e.g., workspaces require embeddings, AI Search, and Document Intelligence)

docs/explanation/features/v0.241.001/WORKSPACE_MULTI_ENDPOINTS.md

@@ -42,6 +42,8 @@ Workspace multi-endpoint management extends the admin multi-endpoint system to p
 2. Users open Personal Workspace or Group Workspace and add endpoints under the new Workspace/Group Model Endpoints card.
 3. In the agent modal, select a model from the combined endpoint list.
 
+For Azure OpenAI, Foundry (classic), or New Foundry managed identity and service principal setup, see [Configure Model Endpoint Identity]({{ '/how-to/model_endpoint_identity_setup/' | relative_url }}). The same RBAC guidance applies to global, personal, and group-scoped endpoints.
+
 ### Foundry Agent Import
 1. Select an Azure AI Foundry endpoint in the Foundry section of the agent modal.
 2. Click **Fetch Agents** to list available agents.

docs/how-to/index.md

@@ -23,8 +23,8 @@ How-to guides assume you already know what area of the product you are working i
     <article class="latest-release-card">
         <div class="latest-release-card-icon"><i class="bi bi-person-badge"></i></div>
         <h2>Identity and security</h2>
-        <p>Use the managed identity and Azure Speech guides when you want to replace stored secrets or handle service-specific authentication correctly.</p>
-        <p><a href="{{ '/how-to/use_managed_identity/' | relative_url }}">Managed identity</a> · <a href="{{ '/how-to/azure_speech_managed_identity_manul_setup/' | relative_url }}">Azure Speech setup</a></p>
+        <p>Use the model endpoint, managed identity, and Azure Speech guides when you want to replace stored secrets or handle service-specific authentication correctly.</p>
+        <p><a href="{{ '/how-to/model_endpoint_identity_setup/' | relative_url }}">Model endpoint identity</a> · <a href="{{ '/how-to/use_managed_identity/' | relative_url }}">Managed identity</a> · <a href="{{ '/how-to/azure_speech_managed_identity_manul_setup/' | relative_url }}">Azure Speech setup</a></p>
     </article>
     <article class="latest-release-card">
         <div class="latest-release-card-icon"><i class="bi bi-palette"></i></div>