AI AgentInvoice Automation
Touchless invoice capture, validation and posting
The challenge
Accounts payable keys invoice headers and line items into the ERP by hand, matches them against purchase orders on screen, and chases approvers by email. Cost per invoice stays high, early-payment discounts are missed, duplicates slip through, and audit season means reassembling evidence out of mailboxes.
The outcome
Azure AI Document Intelligence extracts header, line, tax and total into structured data, Azure Functions apply the match and tolerance rules, and a Microsoft Foundry agent posts clean invoices straight to the ERP. Exceptions queue to a named approver with the document, the match result and the reason already attached.
01 — Architecture
End-to-end architecture
Invoices arrive from any channel, land in Blob, and are extracted by Document Intelligence. The Foundry agent matches them against the purchase order and goods receipt, validates tax, currency and duplicates, then either posts to the ERP or queues a named approver — with the ledger, audit trail and dashboards updated either way.
- Supplier: Supplier / AP inbox
- Intake: Azure Logic Apps, Azure Blob Storage
- Extraction: Azure API Management, AI Document Intelligence, Azure Functions
- AI & validation: Microsoft Foundry Agent, Azure OpenAI models, Azure AI Search
- Data & records: Azure SQL, Azure Cosmos DB, Azure Key Vault
- Posting & insight: Dynamics 365 / ERP, AP approver review, Power BI / Fabric
02 — Workflow
Process & decision workflow
How an invoice is received, extracted, matched, validated and routed — then branched. Clean, in-tolerance invoices post straight through to the ERP, while exceptions go to a named approver with the document, the match result and the reason.
- Receive: Invoices arrive by email, portal, EDI or scan
- Store: Original files secured in Azure Blob Storage
- Extract: Header, line items, tax and totals via Document Intelligence
- Match: Two and three-way match against PO and goods receipt
- Validate: Duplicate, tax, currency, tolerance and vendor checks
- Route: Approval path chosen by amount, cost centre and risk
- Path 1 · touchless — Auto post to the ERP: Approved, posted and queued for the pay run
- Path 2 · exception or over tolerance — AP approver review: Reviewer sees the invoice, the match and the flag
03 — Components
Key Microsoft components
Touchless accounts payable needs accurate extraction, trustworthy matching and a hard audit trail — all on the Microsoft stack.
Azure Logic AppsMailbox, folder and portal watchers plus retry and routing.
Azure Blob StorageOriginal invoices, extracted artefacts and audit evidence.
Azure AI Document IntelligenceHeader, line item, tax and total extraction into structured JSON.
Microsoft Foundry Agent ServiceMatching, validation and routing orchestration with tools.
Azure OpenAI modelsReasoning over exceptions, vendor variants and free-text terms.
Azure AI SearchLookup across vendor master, contracts and price lists.
Azure FunctionsNormalisation, tolerance rules and approval routing.
Azure API ManagementSecure gateway for ERP, procurement and supplier APIs.
Azure SQLInvoice ledger, posting records and reconciliation data.
Azure Cosmos DBProcess state, retries and per-invoice audit history.
Azure Key VaultERP credentials, certificates and integration secrets.
Azure Communication ServicesSupplier and approver notifications by email or SMS.
Azure Container AppsContainerised extraction and matching workers.
Power BI / Microsoft FabricSpend, cycle time, touchless rate and exception dashboards.
04 — AI
What the agent consumes
The capabilities the agent applies to every invoice, and the line it does not cross.
AI capabilities embedded in the agent
- OCR
- Table extraction
- Key-value extraction
- Line-item matching
- Duplicate detection
- Tax and currency validation
- Vendor normalisation
- Anomaly and fraud flagging
- Exception reasoning
- Approval routing
- Audit summarisation
- Workflow orchestration
AI responsibility boundaries
The agent posts only invoices that pass the configured match and tolerance rules; everything else is queued for a named approver with the document, the match result and the reason. It never changes supplier bank details, approves outside the delegation matrix or suppresses a duplicate warning. Every posting stores the extracted data, the rule applied and the approver.
05 — Personalization
Personalization & evolving process
The same methodology applies to every agent in the catalog. Tune the vendor profile, the workflow, the tolerances and the value model — the page structure stays identical.
Vendor & document profile
Define the invoice formats, languages, currencies and tax regimes in scope, the vendor master, the PO versus non-PO mix and the cost-centre structure. The personas are the supplier, the AP clerk, the approver and the auditor.
Workflow template
One consistent flow for every automation agent: receive, store, extract, match, validate, route, approve, post, notify and reconcile — with an exception queue at every branch.
Rules & tolerances
Configure the match type, tolerance bands, delegation matrix, duplicate rules, tax codes and blocked vendors. Every rule is versioned and every application of it is auditable.
Value model
Capture baseline metrics first, then map the expected benefits: cost per invoice, touchless rate, cycle time, exception rate, early-payment discounts captured and audit preparation effort.
06 — Impact
Key outcomes & business impact
Starting targets for the value case — validate each one against the customer baseline during discovery.
- Touchless posting70%+Clean, in-tolerance invoices post without human keying.
- Cost per invoice−50%Manual data entry and rework leave the accounts payable queue.
- Cycle timeSame dayInvoices move from receipt to posting inside one working day.
- Audit readiness100%Every posting stores the document, extraction, rule and approver.
Illustrative improvement index
Manual baseline = 100. Illustrative targets, not a commitment — confirm against the customer baseline.
- Cost per invoice: manual baseline 100, AI-assisted target 50
- Processing time: manual baseline 100, AI-assisted target 20
- Exception rework: manual baseline 100, AI-assisted target 40
07 — Deployment
Deploy this agent
Reads, matches and risk-checks every supplier invoice on arrival, so reviewers spend their time on the exceptions instead of finding them. This agent ships as a versioned, evaluated package: 9 Azure resources described in Bicep, 12 scoped tools, and a blocking evaluation gate that must pass before it is considered ready.
- Package version1.0.0foundation maturity, hosted agent on Microsoft Agent Framework, probed on port 8088.
- Azure resources9Provisioned from Bicep in roughly 25 minutes, excluding model capacity approval.
- Evaluation cases2710 evaluators run as a blocking gate on every change.
- Review triggers1813 of them stop the agent and hand the case to a person.
What gets provisioned
Every resource below is declared in the agent's Bicep templates and deployed with a user-assigned managed identity. No key or connection string is stored in the package.
- Microsoft Foundry account and projectHosts the agent, its model deployments and its managed identity.Microsoft.CognitiveServices/accounts
- Azure AI Document IntelligenceLayout, table and field extraction from scanned invoices. Effectively required here: line-item tables are the input to matching.Microsoft.CognitiveServices/accounts
- Azure StorageInvoice intake and immutable assessment records for audit.Microsoft.Storage/storageAccounts
- Azure Key VaultHolds ERP credentials that cannot use managed identity.Microsoft.KeyVault/vaults
- Application Insights and Log AnalyticsTraces, metrics and the human-review audit trail.Microsoft.Insights/components
Optional: Azure AI Search.
Deployment parameters
Collected before provisioning and validated against the manifest. Credentials are never parameters: the agent resolves them through managed identity, or by Key Vault secret name.
Identity
- Tenant identifierrequiredData isolation boundary. Every tool call is scoped to it.
Infrastructure
- Azure regionuaenorthRegion for the Foundry project and supporting resources.
- Environmentdev
Model
- Document understanding model deploymentgpt-5.4-mini
- Case reasoning model deploymentgpt-5.4
Thresholds
- Extraction confidence floor0.7Below this score the case is routed to a human.
- Assessment confidence floor0.7
- Fast-track recommendation floor0.85Both confidence scores must reach this before fast track is recommended.
- High-value invoice threshold25000Invoices at or above this value always reach a human, whatever the confidence.
Matching
- Unit price tolerance2Permitted variance between the invoiced unit price and the purchase order, as a percentage. Applied together with the absolute floor below; the larger of the two is allowed.
- Invoice total tolerance2Permitted variance between the invoice total and the purchase order total. Applied in one direction only: billing below the order is a partial delivery, billing above it is an exception at any size.
- Absolute tolerance floor5Minimum permitted variance in currency units. Without it a percentage tolerance on a low-value line flags rounding noise as an exception and buries reviewers in false positives.
- Duplicate detection window365How far back the ledger is searched for a possible duplicate. Beyond this window an identical invoice number is more likely an annual recurrence.
- New vendor window90An invoice from a vendor created within this many days is treated as elevated risk regardless of value. Invoice fraud overwhelmingly arrives through newly created or newly modified vendor records.
Locale
- Expected tax rate5Standard rate used to validate invoice arithmetic. Leave empty in a jurisdiction with mixed rating to disable the check rather than generate noise.
- Default currencyAED
- Dates are day-firsttrueResolves ambiguous numeric dates such as 03/04/2026.
- Invoice number formatrequiredRegular expression a supplier invoice number must match. Leave empty unless the organisation genuinely enforces a format across all suppliers.
Integrations
- ERP credential secret namerequiredKey Vault secret NAME holding the ERP credential, used only when the integration cannot authenticate with managed identity. The secret value is never collected here and never appears in a manifest or a deployment log.
Deployment lifecycle
A deployment moves through an explicit state machine. Illegal transitions are rejected, so a deployment record can never sit in an undefined position — and a failure is always either retried or torn down, never abandoned.
- 01 Requested
- 02 Validating request
- 03 Waiting for configuration
- 04 Provisioning Azure resources
- 05 Configuring Foundry project
- 06 Deploying agent
- 07 Connecting tools
- 08 Connecting knowledge
- 09 Running deployment validation
- 10 Running evaluation gate
- 11 Ready
- 12 Degraded
- 13 Failed
- 14 Updating
- 15 Decommissioning
- 16 Decommissioned
Tools and their blast radius
12 tools across 1 toolbox. 4 can write, and every write is scoped, audited and reversible.
- lookup_vendor
- get_vendor
- get_purchase_order
- find_open_orders
- search_contract_terms
- check_duplicate_invoice
- get_invoice_status
- calculate_invoice_totals
- register_invoice · write
- update_invoice · write
- create_review_task · write
- request_missing_information · write
What this agent will never do on its own
- Approving an invoice for payment
- Authorising, scheduling or releasing any payment
- Changing, adding or verifying a vendor bank account
- Creating or modifying a vendor master record
- Creating or amending a purchase order to make an invoice match
- Overriding, widening or waiving a matching tolerance
- Posting an invoice to a terminal or paid status
- Making or recording an allegation of fraud
- Requesting or storing data belonging to another tenant
Evidence before it ships
The evaluation gate is blocking: a regression on any evaluator stops the release rather than documenting it.
- golden-invoices15 casesRepresentative payables cases with expected routing and match outcome, including partial delivery, credit notes and unretrievable orders.
- adversarial-invoices12 casesPrompt injection, payment redirection, self-asserted approval and authority-boundary probes, with benign controls that must stay clean.
Evaluators
- routing_accuracy
- completeness_accuracy
- review_decision_accuracy
- match_outcome_accuracy
- finding_recall
- trigger_recall
- injection_containment
- injection_false_positive_rate
- authority_boundary
- bank_detail_containment
Identity, isolation and network
- Agent identityuser-assigned-managed-identity. No shared keys, no embedded credentials.
- Public network accessconfigurable. Private endpoints available for Azure AI Search, Azure Storage, Azure Key Vault, Azure AI Document Intelligence.
Role assignments
- Foundry UserFoundry projectRun the agent and read its project configuration.
- Search Index Data ReaderAzure AI Search serviceRetrieve supplier contract terms for grounded citations. Read-only by design.
- Storage Blob Data ContributorInvoice intake containerRead submitted invoices and write the immutable assessment record.
- Key Vault Secrets UserKey VaultResolve ERP credentials that cannot use managed identity.
- Monitoring Metrics PublisherApplication InsightsEmit traces and metrics.
What you can see once it is running
Traced with opentelemetry and exported to Application Insights. Document content and model reasoning are dropped before export — neither is ever written to a log.
- invoices.processed
- invoices.review_required_rate
- invoices.confidence.extraction
- invoices.confidence.assessment
- invoices.recommended_action
- invoices.match_outcome
- invoices.duplicate_detected
- invoices.payment_risk_detected
- invoices.injection_detected
- invoices.tool_failure_rate
- invoices.processing_duration_ms
Cost drivers
- Document Intelligence pages analysed
- Model inference for document understanding
- Hosted-agent container compute
- Azure AI Search unit hours
Supported regions
- uaenorth
- westeurope
- swedencentral
- eastus2
Getting it deployed
The package is ready to provision into a customer subscription: infrastructure as Bicep, the agent as a container image, and the evaluation gate as a pipeline step. Provisioning runs against your own tenant with your own approvals, so the last step is a conversation about region, capacity and the systems this agent will read from.
Published by Cloud Mechanics · Owner Cloud Mechanics - AI Solutions · standard support
Deploy this agentRelated & recommended
Derived automatically from our solution knowledge graph.
Related professional services
How we design, build and secure it.
ServiceAI Integration
AI Integration delivered by Cloud Mechanics certified experts.
ServiceData Engineering
Data Engineering delivered by Cloud Mechanics certified experts.
ServiceAI Agent Development
AI Agent Development delivered by Cloud Mechanics certified experts.
ServiceAI Governance
AI Governance delivered by Cloud Mechanics certified experts.
Related quick wins
Ready-made Azure AI to start fast.
Technologies
What powers this solution.
Related managed services
Keep it running and optimised.
ManagedData Managed Services
Data Managed Services from our UAE-based 24/7 Cloud Operations Center.
ManagedAI Managed Services
AI Managed Services from our UAE-based 24/7 Cloud Operations Center.
ManagedCloud Managed Services
Cloud Managed Services from our UAE-based 24/7 Cloud Operations Center.
ManagedDevOps Managed Services
DevOps Managed Services from our UAE-based 24/7 Cloud Operations Center.
Ready to move from challenge to solution?
Talk to a Cloud Mechanics expert or build your solution in minutes.