The Azure OCR app exposes two Azure AI services behind a single Prisme.ai connector: Azure Computer Vision for lightweight image OCR and visual analysis (Read, Caption, Tags, Objects, People) and Azure Document Intelligence for structured extraction of documents (layouts, invoices, receipts, ID documents). It can be consumed two ways: as a remote MCP server that Agent Factory agents call through two entity tools (image, document), or as a Builder app whose instructions you call directly from DSUL. It runs in the tenant app-instance context — each workspace pastes its own per-service Azure credentials (endpoint hostname + API key), resolved server-side and never exposed to the agent. Agents are identified by the capability Scope context_id,agent_id,user_id and gated by a per-workspace authorized-agents allowlist.
Computer Vision
Fast image OCR and visual analysis through a single synchronous
image tool (Read, Caption, Tags, Objects, People).Document Intelligence
Structured extraction for PDFs and complex layouts via the
document tool, with prebuilt models (layout, read, invoice, receipt, ID document) — async submit-and-poll handled internally.LLM-ready output
Return flattened text or markdown for LLM pipelines, or the structured Azure response with tables, key-value pairs and pages.
Who is this for?
This connector is used by three different roles. Jump to the section that matches yours — each one is self-contained.Agent builder
You build agents in Agent Factory and want them to extract text from images and documents. → Agent builder tab.
Platform admin
You run the platform and want to know what to set up once for everyone. → Platform admin setup accordion below.
Workspace builder
You write Builder automations (DSUL) that call Azure OCR operations directly. → Workspace builder tab.
Prerequisites
- An Azure subscription with access to Azure AI services.
- A Computer Vision (or Multi-Service Cognitive) resource — for the
imagetool. From the Azure portal, under the resource’s Keys and Endpoint page, note its endpoint hostname (e.g.az-aismsa-xxx.cognitiveservices.azure.com) and one of its API keys. - A Document Intelligence resource — for the
documenttool. Same Keys and Endpoint page: note the endpoint hostname (e.g.az-di-xxx.cognitiveservices.azure.com) and an API key.
You can configure only one of the two services — each tool only requires the service it targets to be configured. The Computer Vision and Document Intelligence keys are independent and not interchangeable.
Platform admin (Governance) — one-time platform setup
Platform admin (Governance) — one-time platform setup
Goal: Azure OCR is a per-workspace connector — each workspace pastes its own Azure endpoints and API keys in the connector’s configuration app (see the Workspace builder tab), so there is no platform-wide credential to provision and no central OAuth client.
There is no shared Azure credential for this connector. The Computer Vision and Document Intelligence keys always live in the consuming workspace’s secrets, written by the connector’s configuration app. The platform operator has nothing to register centrally.
Declare the capability in AI Governance (optional)
If you want agent builders to pick Azure OCR from the capability catalog instead of pasting an MCP endpoint URL by hand, expose it as a reusable capability in AI Governance, pointing at the MCP endpoint of the workspace that runs the connector.1
Open AI Governance > Capabilities
Create (or edit) the Azure OCR capability.
2
Point it at the MCP endpoint
Set the capability’s MCP server URL to the MCP Endpoint of the workspace running the connector, and set its Scope to:The
agent_id in the scope is what lets the connector identify and authorize the calling agent.3
Make it available to agent builders
Once created, the capability appears in the capability picker for agent builders in your organization. Access to the catalog follows your organization’s existing roles; there is no per-capability role grant for this tenant-context connector.
The connector’s configuration app also offers a one-click Add to catalog button (owner / admin only) that publishes the capability to the organization-wide Capabilities catalog for you — the easiest way to expose Azure OCR to agent builders without hand-editing Governance.
- Agent builder (Agent Factory)
- Workspace builder (DSUL)
Agent builder
Goal: let an agent you build in Agent Factory extract text and structured data from images and documents through theimage and document MCP tools.Before an agent can call the connector, a Workspace builder must have installed and configured the Azure OCR app in a workspace (see the Workspace builder tab) — or a Platform admin must have published an Azure OCR capability in AI Governance (see the Platform admin setup accordion above).
agent_id that Agent Factory injects through the capability Scope, and that agent must appear in the connector’s authorized-agents allowlist (managed in the configuration app). The Azure credentials themselves are resolved server-side — never exposed to the agent.1
Install and configure the connector in your workspace
Follow the Workspace builder tab: install Azure OCR in your workspace, open its Configuration app, and paste the Azure endpoint hostname + API key for the service(s) you use (Computer Vision, Document Intelligence, or both).
2
Allowlist your agent
In that workspace’s config app, open Authorized agents and tick your agent (the Install capability button does this for you), or enable Allow all agents.
3
Add the MCP capability to your agent
In your agent, add a capability pointing at your workspace’s MCP Endpoint URL, and set its Scope to:The
agent_id is what lets the connector identify and authorize your agent — without it, every call is rejected with an explicit “agent could not be identified” message.4
Brief the agent
Tell the agent the tools exist and when to use each (see Brief the agent in its system prompt below).
Easiest path — Add to catalog. Instead of wiring the capability by hand, a workspace owner can click Add to catalog in the connector’s configuration app to publish Azure OCR to the organization-wide Capabilities catalog (see the Platform admin setup accordion). Agent builders then enable it from the catalog with the endpoint and Scope already wired.
Brief the agent in its system prompt
Azure OCR exposes two tools with distinct strengths. A short brief avoids the agent guessing:Legacy AI Knowledge agents (no native MCP picker): add the connector under Advanced > Tools > MCP and paste the MCP Endpoint URL. The agent still has to be allowlisted in the config app and its identity propagated so the connector can read its
agent_id.Available Tools
Each tool takes anaction argument (currently analyze) plus per-action parameters.Output Formats
Both tools accept anoutputFormat argument that controls the MCP response shape:both(default) — the structured payload, with its JSON also rendered as text.verbose— a human-readable text view, optimized for LLM consumption.structured— concise machine-readable JSON instructuredContent.
outputFormat — it only wraps the result:imagereturns the Azure Image Analysis body (readResult,captionResult,tagsResult,objectsResult,peopleResult, depending on the requestedfeatures).documentreturns a simplifiedanalyzeResult(flattenedcontentin text or markdown, pluspages,tables,keyValuePairs,paragraphs).
Tool Details
image — analyze
Synchronous OCR and visual analysis of a single image via Azure Computer Vision (Image Analysis API2024-02-01).document — analyze
Submit a document to Azure Document Intelligence, poll for completion (2s interval, 60s timeout), and return the extraction. Uses Document Intelligence API2024-11-30.Available prebuilt models:
Error Handling
Both operations return a structured error payload (and emit anerror event) instead of raising. The MCP image / document tools surface the same failure as an isError tool result. The payload shape is:
Common Issues
- “This agent is not authorized to use this connector” — The calling agent is not in the allowlist. Open the configuration app → Authorized agents → tick this agent (or enable Allow all agents) and Save. The Install capability button does this for you.
- “The calling agent could not be identified” — The MCP capability Scope does not declare
agent_id, so Agent Factory never injects the agent identity. Set the Scope tocontext_id,agent_id,user_idon the capability, then allow the agent in the config app. ConfigurationError(”… is not configured”) — The targeted service has no endpoint or API key in the connector configuration. Each workspace must paste its own Azure endpoint and key in the config app; there is no platform-level credential to fall back on. Configure only the service(s) you call.Unauthorized(401, invalid key) — Azure rejected the key. Regenerate or copy a current key from the resource’s Keys and Endpoint page, and confirm it matches the service you are calling (Computer Vision keys do not work on Document Intelligence and vice versa).Forbidden(403, API not enabled) — The key is valid but the resource does not expose the requested API. Confirm the resource type (a Document Intelligence key cannot serve Image Analysis) and that the feature is enabled on the Azure resource.NetworkError/NotFound(404, bad endpoint) — Almost always a malformed endpoint. Store the hostname only (nohttps://, no path); the connector strips a leading scheme and trailing slash but cannot recover a wrong host.Timeoutondocument— Document Intelligence is asynchronous: the connector submits the document, then polls for up to 60s. Long or heavy PDFs can exceed this limit. Reducepages, switch to the lighterprebuilt-readmodel, or split the document upstream.- Service-specific gotcha —
imageis synchronous anddocumentis an async submit-and-poll cycle handled internally; both return their error payload instead of raising. After a DSUL call, always branch on{{result.error}}— a failed extraction is a normal value, not an exception, so a missing check silently passes the error object downstream.
External Resources
Azure Computer Vision
Image Analysis 4.0 reference, prebuilt features and supported languages.
Azure Document Intelligence
Document Intelligence overview, prebuilt models and the analyze API.
Tool Agents
How Agent Factory agents consume MCP tools and capabilities.