AI-103 Practice Questions and Answers: 15 Worked Examples (2026)

Last updated: June 2026. Researched against the official Microsoft Learn AI-103 study guide and certification pages, accessed 29 June 2026. Examinotion fact-checks every exam article against Microsoft's published skills outline before publishing.

TL;DR AI-103 practice questions are the fastest way to test your readiness for Microsoft's new Azure AI Apps and Agents Developer Associate exam, because no official practice assessment exists yet. This guide gives you 15 worked questions across all five skill domains, with full explanations for every option, grounded in the current Microsoft Foundry skills outline.

Exam AI-103: Developing AI Apps and Agents on Azure earns the Microsoft Certified: Azure AI Apps and Agents Developer Associate certification, and it replaces AI-102, which retires on 30 June 2026 [1][15]. If you are preparing for AI-103, structured practice questions are the single fastest readiness check you can run, because Microsoft has not yet published an official practice assessment for the exam [2].

This article gives you 15 fully worked AI-103 practice questions spanning all five skill domains, plus a method for using practice questions to find and close gaps before exam day. Every question is original, written from the current AI-103 skills outline and the Microsoft Learn documentation. None of these are real exam questions, and you will not find real exam questions on any reputable preparation site, because Microsoft candidates sign a non-disclosure agreement promising not to share them.

AI-103 exam overview

AI-103 validates your ability to design, build, deploy, and operate AI applications and agents on Azure using Python and Microsoft Foundry [1]. It sits at the Associate (intermediate) level, the same tier as the AI-102 exam it replaces, and the questions are scenario-led rather than recall-led. Most questions describe a situation and ask which Foundry service, agent pattern, or retrieval configuration fits, so understanding why a service exists matters more than memorising its API surface.

Here are the verified fast facts as published by Microsoft.

The passing score is fixed at 700 out of 1000 on Microsoft's scaled scoring, regardless of how hard your particular question set turns out to be [1]. Microsoft does not publish a question count for AI-103, so plan around the scheduled length your Pearson VUE booking confirms rather than a fixed number.

The five AI-103 skill domains and their weightings

The official skills outline divides AI-103 into five domains, and your practice should mirror the weightings rather than splitting evenly [1]. The table below shows where the marks sit, and the 15 questions in this guide are distributed in the same proportion.

For a full walkthrough of what each domain tests and a structured study timeline, read our companion guide on how to pass the AI-103 exam. This article focuses on drilling the question patterns.

How to use these AI-103 practice questions

Each question below is followed by a full explanation: why the correct answer is correct, and why each distractor is wrong. The wrong-answer reasoning matters because Microsoft writes distractors so that more than one option looks plausible at first glance. Reading the wrong-answer explanations is what trains your eye for the distractor patterns the real exam uses.

Cover the answers before you read on, and aim to score at least 12 out of 15 before you book. Rework the explanation on any question you miss, then return to the underlying Microsoft Learn module rather than just memorising the answer.

Domain 1: Plan and manage an Azure AI solution

This domain covers architecture, security, deployment, and responsible AI configuration. Role-based access control (RBAC) and content moderation settings are frequent question themes, and the service names changed with Microsoft Foundry, so older AI-102 material will mislead you here.

Question 1 (RBAC roles)

A developer needs a managed identity to call a Microsoft Foundry project endpoint to run inference and use agents. Security policy requires the least-privilege role that grants data-plane access and nothing more. Which built-in role should you assign to the managed identity?

• A. Cognitive Services Contributor
• B. Foundry User
• C. Azure AI Developer
• D. Foundry Account Owner

Correct answer: B. Foundry User.

Foundry User is the least-privilege built-in role for Microsoft Foundry projects and grants the data-plane actions needed to call a project endpoint, run inference, and use agents [5]. Microsoft recommends assigning the project's managed identity the Foundry User role on the Foundry resource.

Why the distractors are wrong:

• A. Cognitive Services Contributor belongs to the older role family and grants management of AI Services resources, but it does not grant the data-plane actions required to call a Foundry project endpoint [5]. Roles beginning with "Cognitive Services" are the wrong family for Foundry project work.
• C. Azure AI Developer is scoped to Azure Machine Learning workspaces and Foundry hubs, not Foundry projects, so it does not fit a project-endpoint scenario [5].
• D. Foundry Account Owner can create accounts and projects and manage models, but it does not include the build and data actions, so it both over-privileges control operations and fails to grant the data-plane access the scenario needs [5].

When a question names a "Foundry project endpoint" and asks for least privilege, Foundry User is almost always the answer. Memorise the four Foundry roles and what each can and cannot do.

Question 2 (Content safety severity)

You configure Azure AI Content Safety to moderate user-uploaded images in a generative application. During testing, a colleague claims an image returned a Violence severity score of 3. Why is this result impossible?

• A. Content Safety does not moderate images, only text
• B. The image content model returns only severity values 0, 2, 4, and 6
• C. Severity 3 is reserved for the Self-Harm category only
• D. Image moderation always returns a binary blocked or allowed flag, never a severity

Correct answer: B. The image content model returns only severity values 0, 2, 4, and 6.

The Azure AI Content Safety image model uses a trimmed severity scale that returns only 0, 2, 4, and 6, so an odd value such as 3 cannot occur for image content [7]. The text model uses the full 0 to 7 scale, which is where odd-numbered severities appear.

Why the distractors are wrong:

• A. Content Safety moderates both text and images across all four harm categories, so the claim that it only handles text is wrong [7].
• C. Severity values are not reserved per category. All four categories (Hate and Fairness, Sexual, Violence, Self-Harm) share the same severity scale [7].
• D. Image moderation returns a severity level per category, not just a binary flag. The blocking decision is then made by comparing severity against your configured threshold [7].

Remember the asymmetry: text severities run the full 0 to 7 range, image severities are trimmed to 0, 2, 4, 6. A question quoting an odd severity for an image is a trap.

Question 3 (Keyless authentication)

A production application authenticates to Microsoft Foundry using an API key stored in an environment variable. Your security team requires that you remove hardcoded secrets and enable per-principal auditing of every call. Which approach meets both requirements?

• A. Move the API key into Azure Key Vault and rotate it monthly
• B. Authenticate with Microsoft Entra ID using a managed identity (keyless)
• C. Share a single API key across services and restrict it with IP allow-listing
• D. Embed the API key in the deployment pipeline as a masked variable

Correct answer: B. Authenticate with Microsoft Entra ID using a managed identity (keyless).

Keyless authentication with Microsoft Entra ID issues short-lived OAuth bearer tokens scoped per principal, which removes hardcoded secrets and produces per-principal audit trails [6]. A managed identity extends this to service-to-service calls without storing any credential in code or configuration.

Why the distractors are wrong:

• A. Key Vault improves how a secret is stored, but an API key still grants full access with no per-principal identity, so it fails the auditing requirement [6].
• C. A shared API key cannot attribute calls to individual principals and grants full access, which is the opposite of per-principal auditing [6].
• D. Masking a variable hides it from logs but the secret still exists and still lacks a per-principal identity for auditing [6].

API keys bypass RBAC entirely and grant full access, so when a scenario stresses auditing or secret elimination, the answer is keyless Entra ID authentication.

Question 4 (Model deployment options)

A team wants to deploy a model from the Foundry catalogue with the fastest possible setup, pay only for the tokens they consume, and avoid provisioning any virtual machine (VM) quota. Which deployment option fits?

• A. Managed compute (managed endpoint) deployment
• B. Serverless API deployment, also called models as a service (MaaS)
• C. Self-hosted deployment on Azure Kubernetes Service
• D. A local container running on a developer workstation

Correct answer: B. Serverless API deployment, also called models as a service (MaaS).

Serverless API deployment runs on Microsoft-managed infrastructure, bills per input and output token, and needs no VM quota, so it is the fastest path that matches token-based billing [9]. It is the standard choice when you want pay-per-use economics without managing compute.

Why the distractors are wrong:

• A. Managed compute provisions a dedicated VM that you pay for per core-hour whether or not traffic uses it, and it requires VM quota in your subscription, which conflicts with both constraints [9].
• C. Azure Kubernetes Service is a custom infrastructure pattern that requires substantial cluster setup, contradicting the fastest-setup requirement.
• D. A local container is not a production deployment pattern and would not serve a scalable application reliably.

Learn the decision cue: serverless MaaS for token-based billing and no quota, managed compute when you need dedicated capacity, and Azure OpenAI deployments accessed through the Foundry project endpoint for GPT-family models.

Domain 2: Implement generative AI and agentic solutions

This is the largest domain at 30 to 35%, and it is where underprepared candidates lose the most marks [1]. Expect questions on agents, retrieval-augmented generation, model choice, evaluation, and the current agent APIs.

Question 5 (RAG versus fine-tuning)

A customer support agent must answer from an internal knowledge base that is updated weekly with new product documentation, and its answers must always reflect the latest content. Which approach should you implement?

• A. Fine-tune the base model on the new documents every week
• B. Implement retrieval-augmented generation (RAG) over an index of the documents
• C. Raise the model temperature to improve recall of recent facts
• D. Apply Direct Preference Optimization (DPO) to the documents

Correct answer: B. Implement retrieval-augmented generation (RAG) over an index of the documents.

RAG injects fresh, frequently changing knowledge at inference time by retrieving relevant content from an index and grounding the model's answer in it, which is exactly the "chat with your data" pattern this scenario describes [10]. Microsoft's guidance is direct on the boundary between the two techniques.

Use fine-tuning when you need to change model behavior, style, or task performance, rather than add fresh knowledge.

— Microsoft Learn, Foundry fine-tuning considerations [10]

Why the distractors are wrong:

• A. Fine-tuning changes a model's behaviour, style, or task performance, not its store of fresh knowledge, and retraining weekly is costly and slow for content that changes that often [10].
• C. Temperature controls output randomness, not what the model knows, so raising it cannot add new product facts.
• D. DPO is a fine-tuning method for aligning a model to preferences, not a way to inject changing knowledge [10].

When a scenario stresses frequently changing or private data and grounded answers, choose RAG. Fine-tuning is the distractor that catches candidates who confuse behaviour with knowledge.

Question 6 (Agent components)

You are defining an agent in Microsoft Foundry Agent Service. The agent uses a catalogue model for reasoning, a system instruction that sets its goals, and a file search capability that reads a knowledge store. Which three components does this combination represent?

• A. Endpoint, API key, deployment name
• B. Model, instructions, tools
• C. Trigger, action, condition
• D. Embedding, retriever, generator

Correct answer: B. Model, instructions, tools.

Microsoft Foundry Agent Service defines every agent as the combination of three core components: a model that provides reasoning, instructions that set goals and behaviour, and tools that give access to data or actions [4]. The scenario maps exactly, with the catalogue model, the system instruction, and the file search tool.

Why the distractors are wrong:

• A. Endpoint, API key, and deployment name are properties used to authenticate to a deployed model, not the conceptual components of an agent [4].
• C. Trigger, action, and condition describe workflow automation platforms such as Power Automate, not the Foundry Agent Service definition.
• D. Embedding, retriever, and generator describe a RAG pipeline. An agent can use RAG through its tools, but the components of the agent itself are still model, instructions, and tools [4].

If you can recite "model, instructions, tools" without thinking, you have the most-tested agentic definition covered.

Question 7 (Responses API versus Assistants API)

In mid-2026 you are starting a brand-new agentic application on Azure and want to build on the generally available, supported entry point for Foundry agents. Which API should you target?

• A. The Assistants API
• B. The Responses API via Foundry Agent Service
• C. The legacy text Completions API
• D. The LUIS runtime API

Correct answer: B. The Responses API via Foundry Agent Service.

The Responses API is the generally available single entry point for Foundry Agent Service and supports both prompt agents and hosted agents [4]. It is the API Microsoft directs new agentic development towards.

Why the distractors are wrong:

• A. The Assistants API is deprecated and retires on 26 August 2026, so it is the wrong foundation for a new project [4].
• C. The Completions API is a legacy text-completion interface, not an agentic runtime, and does not provide tool orchestration or conversation management.
• D. LUIS is a retired language-understanding service and is not part of the AI-103 toolset at all.

Any answer recommending the Assistants API for new 2026 development is a trap built on outdated material. The Responses API is the current path.

Question 8 (Evaluators)

You need to add an automated grounding check to a RAG application's continuous evaluation. The check must return a simple pass or fail result and must not require you to deploy a separate judge model. Which evaluator should you use?

• A. Groundedness, which returns a 1 to 5 score
• B. Groundedness Pro
• C. Fluency
• D. Relevance

Correct answer: B. Groundedness Pro.

Groundedness Pro returns a binary pass or fail result and runs on the Azure AI Content Safety service, so it does not require you to deploy a model to act as a judge [11]. That matches both requirements in the scenario.

Why the distractors are wrong:

• A. The standard Groundedness evaluator returns a 1 to 5 score using model-based judgement, which requires a deployed model and does not give a binary result [11].
• C. Fluency measures the natural-language quality of a response, not whether it is grounded in the retrieved context [11].
• D. Relevance measures how well a response addresses the query, which is related but distinct from grounding in the source content [11].

Groundedness and Groundedness Pro are two separate evaluators with different outputs. The binary, no-model-deployment cue points to Groundedness Pro.

Question 9 (Agent tools)

An agent must call your organisation's internal inventory system, which is exposed as a set of tools. You want the tool definitions maintained centrally and reusable across several agents rather than redefined in each agent. Which Foundry capability fits?

• A. Add a Model Context Protocol (MCP) server as an agent tool
• B. Increase the model's context window
• C. Fine-tune the model on the inventory system's API schema
• D. Enable the code interpreter tool

Correct answer: A. Add a Model Context Protocol (MCP) server as an agent tool.

A Model Context Protocol (MCP) server exposes a reusable, centrally maintained set of tools that any agent can connect to, and Foundry Agent Service supports adding MCP servers from the tools catalogue [4]. This is the standard pattern for connecting agents to external systems through shared tool definitions.

Why the distractors are wrong:

• B. The context window controls how much text the model can consider at once, which does not connect the agent to an external inventory system.
• C. Fine-tuning adjusts model behaviour and cannot establish a live connection to call an external API.
• D. The code interpreter runs sandboxed code for data tasks, but it does not provide a maintained, reusable interface to your inventory system [4].

Foundry's built-in agent tools include web search, file search, memory, code interpreter, MCP servers, and custom functions. When a question stresses reusable, centrally maintained external tools, MCP is the answer.

Domain 3: Implement computer vision solutions

This domain covers image and video generation, multimodal understanding, and responsible AI for visual content [1]. Two services dominate the questions: Azure Content Understanding, and Prompt Shields for visual prompt injection.

Question 10 (Content Understanding standard versus pro mode)

A finance team must extract named fields, such as invoice number and total, from invoices, and they need a per-field confidence score so that low-confidence values can be routed to a human reviewer. Which Azure Content Understanding mode should they use?

• A. Pro mode
• B. Standard mode
• C. Either mode, because both return confidence scores
• D. Neither, because confidence scoring requires Azure AI Document Intelligence

Correct answer: B. Standard mode.

Standard mode in Azure Content Understanding supports extract fields and returns confidence scores and grounding, which is exactly what a human-in-the-loop review workflow needs [12]. Pro mode is built for multi-step reasoning across documents and deliberately omits confidence scoring.

Content Understanding pro mode currently doesn't offer confidence scores or grounding. It supports classify and generate fields, but it doesn't support extract fields.

— Microsoft Learn, Content Understanding standard and pro modes [12]

Why the distractors are wrong:

• A. Pro mode does not return confidence scores or grounding and does not support extract fields, so it cannot drive a confidence-based review workflow [12].
• C. Only standard mode returns confidence scores, so "either mode" is wrong [12].
• D. Content Understanding standard mode provides per-field confidence scoring natively, so you do not need to fall back to Document Intelligence for this requirement [12].

A naming note worth knowing: the frozen AI-103 study guide refers to "single-task" pipelines, while the current product documentation calls the same thing "standard mode" [1][12]. Both terms can appear in answer options, so recognise them as the same idea.

Question 11 (Prompt Shields and indirect injection)

A multimodal agent processes user-uploaded images. An attacker embeds hidden text instructions inside an image, hoping the agent will read and act on them. Which Azure AI Content Safety capability is designed to detect this kind of attack?

• A. A content filter set to High severity for the Violence category
• B. Prompt Shields, which detects document and indirect prompt injection
• C. Raising the image resolution threshold on the analyser
• D. Disabling the agent's file search tool

Correct answer: B. Prompt Shields, which detects document and indirect prompt injection.

Prompt Shields detects prompt injection attacks, including indirect injection where malicious instructions are embedded in content the model processes, such as text hidden inside an image [8]. The AI-103 skills outline explicitly covers detecting and mitigating indirect prompt injection using embedded text in images [1].

Why the distractors are wrong:

• A. Content filters classify harm categories and severity, such as violence or hate, but they do not detect instruction-injection attempts hidden in content [8].
• C. Image resolution has no bearing on whether embedded instructions are detected.
• D. Disabling a tool reduces the agent's function and still does not detect the injected instructions in the uploaded image.

Keep the distinction sharp: content filters detect harmful content by category and severity, while Prompt Shields detects attack attempts, returning a binary attack-detected flag rather than a severity score [8].

Domain 4: Implement text analysis solutions

This domain blends classic language capabilities with large language model approaches, surfaced through Foundry Tools, and it includes speech as an agent modality [1]. Candidates who skip speech give away easy marks.

Question 12 (Translation approach)

An application must translate a high volume of standard product descriptions into 20 languages quickly, consistently, and at the lowest cost. The text is straightforward, with no domain-specific nuance. Which approach best fits?

• A. A large language model translation flow with a custom system prompt
• B. Azure Translator in Foundry Tools
• C. A separately fine-tuned model for each of the 20 target languages
• D. Azure AI Document Intelligence

Correct answer: B. Azure Translator in Foundry Tools.

Azure Translator in Foundry Tools provides deterministic, broad-language translation at scale and at lower cost, which suits high-volume, straightforward content [1]. The AI-103 skills outline lists translating text with Azure Translator in Foundry Tools or with large language model flows, and the deterministic, cost-efficient option fits this scenario.

Why the distractors are wrong:

• A. A large language model translation flow is better for nuanced, contextual, or domain-specific translation, but it costs more, adds latency, and is non-deterministic, which is unnecessary for straightforward descriptions at scale.
• C. Fine-tuning a separate model per language is expensive, slow to maintain, and offers no benefit over a managed translation service for standard content.
• D. Azure AI Document Intelligence extracts content from documents and does not perform translation.

Match the tool to the need: Azure Translator for deterministic translation at scale, large language model flows when translation is one step in a richer reasoning pipeline or needs domain adaptation.

Question 13 (Speech as an agent modality)

You are building a voice agent for a pharmacy. It must accept spoken questions, reply with synthesised speech, and accurately recognise specialised medicine names that a general speech model often mishears. Which capability should you configure?

• A. A custom speech model for speech-to-text within the agent
• B. Only the default text-to-speech voice
• C. Azure Translator to convert the audio
• D. Azure AI Document Intelligence on the audio stream

Correct answer: A. A custom speech model for speech-to-text within the agent.

A custom speech model improves recognition of specialised vocabulary, such as medicine names, by adapting speech-to-text (STT) to your domain, and AI-103 covers integrating speech, including custom speech models, as an agent modality [1]. This directly addresses the accuracy problem in the scenario.

Why the distractors are wrong:

• B. Text-to-speech (TTS) handles the agent's spoken output, not the accurate recognition of specialised input terms, so the default voice alone does not solve the problem.
• C. Azure Translator converts text between languages and does not improve recognition of domain-specific spoken terms.
• D. Azure AI Document Intelligence processes documents, not audio streams.

Speech appears in this domain as both STT and TTS for agentic interactions. When a question stresses recognising domain-specific spoken terms, the answer is a custom speech model.

Domain 5: Implement information extraction solutions

This domain is the data plumbing behind RAG and agents: ingesting and indexing content, configuring search for grounding, and extracting fields from documents [1]. Two decisions dominate: Document Intelligence versus Content Understanding, and standard search versus agentic retrieval.

Question 14 (Document Intelligence versus Content Understanding)

A legal team must extract clauses and inferred fields from unstructured contracts. One required field is the contract end date, which is not stated explicitly and must be derived from the start date plus the term. The team has no labelled training data. Which tool best fits?

• A. An Azure AI Document Intelligence custom model trained on labelled samples
• B. Azure Content Understanding using a prebuilt-contract or zero-shot custom analyser
• C. The Azure AI Search semantic ranker
• D. Azure Translator in Foundry Tools

Correct answer: B. Azure Content Understanding using a prebuilt-contract or zero-shot custom analyser.

Azure Content Understanding handles unstructured documents, works zero-shot without labelled data, and can infer fields that are not explicitly present, such as deriving a contract end date from the start date and term [13]. That matches every requirement in the scenario.

Why the distractors are wrong:

• A. Document Intelligence custom models need labelled samples and are built for structured, templated forms, and they extract only what is explicitly present rather than inferring derived fields [13].
• C. The Azure AI Search semantic ranker reorders search results by relevance; it does not extract named or inferred fields from a document.
• D. Azure Translator performs translation, not field extraction.

The core cue: Document Intelligence for structured, templated forms with labelled training, Content Understanding for unstructured, multimodal content, zero-shot extraction, and inferred fields. Document Intelligence containers remain the answer when on-premises or air-gapped deployment is required [13].

Question 15 (Agentic retrieval)

A copilot must answer multi-part questions that depend on earlier turns in the conversation. You want the system to break each complex question into focused subqueries, run them in parallel, and semantically rerank the results before composing an answer. Which Azure AI Search capability provides this?

• A. Classic keyword search with a scoring profile
• B. Agentic retrieval
• C. A single vector query with a high similarity threshold
• D. Increasing the top-k value on a single keyword query

Correct answer: B. Agentic retrieval.

Agentic retrieval in Azure AI Search uses a large language model to decompose a complex query into focused subqueries, runs them in parallel, semantically reranks each set of results, and merges them into a unified response, while taking conversation history into account [14]. That is precisely the behaviour the scenario describes.

Agentic retrieval adds latency compared to a single-query pipeline, but it handles query complexity that a single query can't.

— Microsoft Learn, Agentic retrieval overview [14]

Why the distractors are wrong:

• A. Classic keyword search with a scoring profile runs a single query and does not decompose multi-part questions or use conversation context [14].
• C. A single vector query handles one semantic ask and cannot split a multi-part question into parallel subqueries.
• D. Increasing the top-k value returns more results from one query, but it still does not decompose the question or apply conversation context.

Agentic retrieval trades extra latency for the ability to answer complex, conversational, multi-part questions. When a scenario lists subquery decomposition and conversation history, it is the answer.

How to use AI-103 practice questions effectively

Working through practice questions is not the same as studying them. Three habits separate effective preparation from time spent feeling productive.

Time yourself per question. AI-103 gives you 120 minutes, and scenario questions reward quick recognition. If a practice question takes you more than two to three minutes, you do not yet know the underlying concept well enough. Flag it, pick your best answer, and revisit the Microsoft Learn module for that skill before retrying.

Score the wrong-answer explanations, not just the correct ones. Microsoft writes distractors deliberately, so a question that looks like it is about RAG might really be testing whether you can rule out fine-tuning. If you picked the right answer but cannot explain why each wrong option fails, you answered by elimination and may miss the same pattern under pressure.

Track your domain split. If you score well on planning questions but stumble on agents and evaluation, you do not need more architecture practice. You need to open a Foundry project, build an agent, and wire up a RAG pipeline. The generative and agentic domain is 30 to 35% of the exam, so a deficit there costs you disproportionately [1].

Why AI-103 questions differ from AI-102

If you are migrating from AI-102 study material, the question patterns have shifted in three ways that change how you should practise.

Everything runs through Microsoft Foundry. AI-102-era questions named standalone services and the Azure AI Studio portal. AI-103 reframes the same workloads around Microsoft Foundry, Foundry Tools, and the Foundry project endpoint [1]. Practice questions that name Cognitive Services as a current product, or Form Recognizer rather than Azure AI Document Intelligence, are misaligned with AI-103.

Agentic AI is the largest domain. AI-102 treated agents as a minor topic. AI-103 makes building, orchestrating, and safeguarding agents the single biggest domain, so your practice should weight agent questions heavily [1]. For the full picture of what moved, see our guide to the AI-102 to AI-103 successor path.

The current APIs and services changed. The Responses API supersedes the Assistants API, Azure Content Understanding is new, and agentic retrieval is now a named skill [4][12][14]. Any practice question grounded in pre-2026 Azure services is suspect, so build your AI-103 study list from material updated since the April 2026 skills freeze.

Free AI-103 practice resources beyond Examinotion

Practice questions are one tool among several. Combine these free resources for stronger coverage.

• Microsoft Learn AI-103 study guide. The official skills outline is the single most important free resource, because skills listed there are testable and skills not listed there are not. Read it at the start and end of your preparation [1].
• Microsoft Learn training modules. Each AI-103 sub-skill maps to a free interactive module, several with sandbox environments where you can deploy a Foundry model or build an agent without spending Azure credits.
• Microsoft Foundry portal sandbox. A free Azure account lets you build a deployed model, a single agent, and a RAG pipeline end to end, which is the hands-on experience scenario questions reward.
• Examinotion AI-103 practice tests. When you are ready for a fuller, exam-format pool, start practising for AI-103 with Examinotion's practice tests, built to mirror the current skills outline and weighting.

There is no official Microsoft practice assessment for AI-103 yet [2], and the exam does not appear in Microsoft's full list of available practice assessments [3]. Microsoft typically publishes one within eight weeks of an exam reaching general availability, so independent practice pools are the main structured option for now.

Tips for answering AI-103 exam questions

Four tactical habits help on AI-103 specifically.

Read the full stem before the options. Microsoft writes long, scenario-led stems, and the deciding constraint often sits near the end, such as "no VM quota", "no labelled data", or "must return a binary result". Read to the end before you scan the answers.

Eliminate outdated service names first. Any option naming Cognitive Services as a current product, Form Recognizer instead of Document Intelligence, or the Assistants API for new development is more likely a distractor than the answer.

For service-choice questions, match the cue to the decision. RAG for fresh knowledge, fine-tuning for behaviour, Content Understanding for unstructured and inferred fields, Document Intelligence for structured templates, serverless for token billing, managed compute for dedicated capacity.

Use your Microsoft Learn access wisely. AI-103 is an associate role-based exam, so you can access Microsoft Learn during the test, but the timer keeps running [1]. Practise navigating the Foundry documentation quickly so a lookup costs seconds, not minutes. Our guide to using Microsoft Learn during your exam explains exactly what is and is not allowed.

Frequently asked questions

Are there free AI-103 practice questions available?

Yes. The 15 worked examples in this guide are free and grounded in the current Microsoft Learn AI-103 skills outline. Microsoft has not yet published an official AI-103 practice assessment, so independent practice pools and the free Foundry portal sandbox are currently the main ways to test your readiness.

How many questions are on the AI-103 exam?

Microsoft does not publish a fixed question count for AI-103. Associate exams typically run around 40 to 60 questions, and the exam lasts 120 minutes with a passing score of 700 out of 1000. Plan your timing around the scheduled length your Pearson VUE booking confirms rather than a fixed number.

Are AI-102 practice questions still useful for AI-103?

Only partly. Core concepts such as RAG and responsible AI overlap, but anything grounded in standalone Cognitive Services, Form Recognizer, Azure AI Studio, or the Assistants API is outdated. AI-103 reframes every workload around Microsoft Foundry, so rely on material updated since the April 2026 skills freeze for the agentic and Foundry-specific content.

What is the passing score for AI-103?

The AI-103 passing score is 700 out of 1000. Microsoft uses scaled scoring rather than a flat percentage, so the threshold stays at 700 regardless of how hard your particular question set is. Aim to score above 80% on varied practice questions before booking, to leave a margin for proctored conditions.

Does Microsoft offer an official AI-103 practice assessment?

Not as of June 2026. The official certification page states the practice assessment is not currently available, and Microsoft usually publishes one within eight weeks of an exam reaching general availability. Until then, structured third-party practice pools and hands-on Foundry work are the main preparation options.

How hard are AI-103 practice questions compared with the real exam?

Practice questions written from the published skills outline match the exam well at the concept and recognition level. The real exam adds time pressure, possible interactive components, and deeper scenarios that practice questions cannot fully replicate. Score consistently above 80% across all five domains to give yourself a buffer.

Which AI-103 domain should I practise most?

Implement generative AI and agentic solutions, weighted at 30 to 35%, is the largest domain and the one candidates most often underprepare for. Prioritise agents, retrieval-augmented generation, model selection, and evaluation, then give the planning domain at 25 to 30% the next-largest share of your practice time.

Conclusion

AI-103 rewards builders who can match a scenario to the right Foundry service, agent pattern, or retrieval configuration under time pressure. Use these 15 questions to find your weak domains, rework every wrong-answer explanation, and verify any older study note against the current skills outline rather than trusting AI-102-era material.

When you are ready to test yourself against a fuller question pool, start practising for AI-103 with Examinotion's practice tests, or work through the AI-103 study guide to drill each domain in order. To plan where this certification fits in your wider path, browse the full Microsoft AI exam catalogue or read our Microsoft AI certification roadmap.

Sources

1. Study guide for Exam AI-103: Developing AI Apps and Agents on Azure — Microsoft Learn, accessed 2026-06-29
2. Microsoft Certified: Azure AI Apps and Agents Developer Associate — Microsoft Learn, accessed 2026-06-29
3. Practice Assessments for Microsoft Certifications — Microsoft Learn, accessed 2026-06-29
4. What is Microsoft Foundry Agent Service? — Microsoft Learn, accessed 2026-06-29
5. Role-based access control for Microsoft Foundry — Microsoft Learn, accessed 2026-06-29
6. Authentication and authorization in Microsoft Foundry — Microsoft Learn, accessed 2026-06-29
7. Harm categories in Azure AI Content Safety — Microsoft Learn, accessed 2026-06-29
8. Prompt Shields in Azure AI Content Safety — Microsoft Learn, accessed 2026-06-29
9. Microsoft Foundry Models overview — Microsoft Learn, accessed 2026-06-29
10. Fine-tuning considerations in Microsoft Foundry — Microsoft Learn, accessed 2026-06-29
11. Built-in evaluators reference for Microsoft Foundry — Microsoft Learn, accessed 2026-06-29
12. Azure Content Understanding standard and pro modes — Microsoft Learn, accessed 2026-06-29
13. Choose the right Azure AI tool for document processing — Microsoft Learn, accessed 2026-06-29
14. Agentic retrieval overview in Azure AI Search — Microsoft Learn, accessed 2026-06-29
15. Retired certification exams — Microsoft Learn, accessed 2026-06-29