[Jose Alvarez (jpalvarezl)]

Motivation & Context

Framework-created Azure OpenAI clients can inherit OpenAI-specific organization and project defaults from the OpenAI SDK when OPENAI_ORG_ID or OPENAI_PROJECT_ID are present in the process environment. Azure-routed clients should use Azure configuration without implicitly forwarding those OpenAI metadata values.

This change also keeps Azure API-key authentication isolated from the base client's bearer header behavior across supported OpenAI SDK versions.

Description & Review Guide

• What are the major changes? Azure client construction now uses the OpenAI SDK's omission mechanism for organization and project headers when callers have not explicitly supplied them. Non-bridge Azure API-key routes also omit the SDK-generated bearer header. Explicit headers are normalized case-insensitively and preserved. Regression tests cover Azure API-key and token routes, the /openai/v1 bridge, explicit headers, generic OpenAI environment fallback, and preconfigured clients.
• What is the impact of these changes? Framework-created Azure clients no longer inherit ambient OpenAI organization/project metadata, and Azure API-key requests use only the Azure api-key header across supported OpenAI SDK versions. Generic OpenAI clients, explicit caller headers, token credentials, and preconfigured client instances retain their existing behavior.
• What do you want reviewers to focus on? Please focus on the case-insensitive preservation of explicit headers and the distinction between native Azure clients and the /openai/v1 compatibility bridge.

Related Issue

No public issue is associated with this change.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation is focused, compatibility-tested, and no blocking correctness issues were found.

Review effort: Balanced
Findings: None

What changed in this PR

Isolates Azure OpenAI requests from ambient OpenAI metadata while preserving explicit headers and existing OpenAI behavior.

Changes:

• Omits OpenAI organization/project headers from Azure routes.
• Suppresses SDK-generated bearer authorization for native Azure API-key requests.
• Adds regression coverage across authentication and routing scenarios.

File	Description
python/​packages/​openai/​agent_framework_openai/​_shared.py	Normalizes and suppresses Azure-route headers.
python/​packages/​openai/​tests/​openai/​test_openai_shared.py	Tests metadata and authentication behavior.
python/​packages/​openai/​tests/​openai/​conftest.py	Isolates project-ID environment state in tests.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-code-quality]

Code Coverage Overview

Languages: Python

Python / code-coverage/python

The overall line coverage in commit 21f5a61 in the jpalvarezl-assess-op... branch is 91%. Line coverage data for the main branch is not yet available.

Show a line coverage summary of the most covered files.

File	main	jpalvarezl-assess-op... 21f5a61	+/-
packages/core/a...ework/_tools.py	—	96%	—
packages/core/a...work/_skills.py	—	96%	—
packages/core/a...ework/_types.py	—	95%	—
packages/openai..._chat_client.py	—	94%	—
packages/core/a.../_compaction.py	—	94%	—
packages/core/a...ork/_vectors.py	—	93%	—
packages/core/a...amework/_mcp.py	—	92%	—
packages/ag-ui/...i/_agent_run.py	—	90%	—
packages/core/a...ork/security.py	—	90%	—
packages/foundr...g/_responses.py	—	88%	—

---

_{Updated October 02, 2026 12:18 UTC}

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 28006a1d259a
Model: gpt-5.6-sol

Overview

The PR isolates framework-created Azure clients from ambient OpenAI organization and project metadata while preserving explicit headers, token authentication, /openai/v1 bridge behavior, generic OpenAI routing, and preconfigured clients. Case-insensitive normalization, route-specific suppression, and focused request-building tests provide concrete guardrails. No publishable Critical, High, or Medium issue was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.