Documentation sample

Azure AI Foundry Platform Onboarding Guide

A governance-first onboarding guide for rolling out Azure AI Foundry in regulated enterprise environments.

Doc typePrimary usersSuccess metricArtifacts
Doc type: Platform onboarding guide
Primary users: Enablement, platform teams
Success metric: First production deploy in 14 days
Artifacts: Hub model, runbook, guardrails

0. Why this guide exists

Enterprise AI programs rarely fail because models are weak. They fail because teams move faster than governance.

This guide is for platform and AI enablement teams rolling out Azure AI Foundry at scale. It balances developer velocity with security, compliance, cost control, and organizational trust.

Problem

Experimentation starts before boundaries are defined. Governance arrives after early incidents.

Outcome

Teams ship inside guardrails with clear ownership, fewer escalations, and predictable spend.

Goal

Controlled momentum over raw speed.

1. Azure AI Foundry mental model (Hub -> Project -> Workload)

Azure AI Foundry is built around a governance-first hierarchy. The fastest teams succeed because they align to it early.

AI Hub

Governance boundary. Security, identity, model access, and network constraints live here.

AI Project

Execution boundary. Teams experiment and build with inherited controls.

Workloads

Behavior layer. Playgrounds, APIs, and integrations where cost and risk show up.

Leadership framing: Decisions should be made once, at the highest reasonable layer, and inherited everywhere else.

AI Hub AI Project Workload
Governance flows from Hub to Project to Workload.
AI Hub to Project to Workload flow in Azure AI Foundry.
Mental model diagram: Hub to Project to Workload.

2. Creating the AI Hub (governance first)

Outcome: A centralized governance boundary with clear ownership and inherited controls.

Create the AI Hub in Azure AI Foundry before any team builds. This is where you define identity, networking, and model access.

Identity

Assign Owner, Security Admin, and Billing Admin roles using Azure RBAC.

Networking

Define region and network boundaries. Use private endpoints where required.

Model access

Approve model families and tiers for the org, not per team.

Developer callout: You will not create the Hub. You will inherit it.

AI Hub creation form with RBAC roles and networking settings.
AI Hub creation with RBAC roles.

3. Creating a Project (isolation and safety)

Outcome: Teams can move fast in a contained workspace without affecting each other.

Create one Project per team or workload. Projects inherit Hub policies by default, which keeps governance consistent while enabling autonomy.

Isolation

Separate dev, staging, and prod Projects to control access and quotas.

Ownership

Assign a Project Owner and a Support Contact for escalations.

Quotas

Apply project-specific rate limits and budget alerts.

Project setup showing owners, quotas, and budget limits.
Project setup with quotas and owners.

4. Chat Playground (learning before building)

Outcome: Teams learn model behavior safely before writing production code.

Use the Chat Playground to test prompts, evaluate model responses, and align on tone and constraints. Require teams to document the final system prompt as part of onboarding.

Prompt baseline

Define a system prompt that reflects policy and tone.

Model selection

Test at least two tiers for cost and quality tradeoffs.

Known limits

Capture refusal behavior and edge cases early.

Chat Playground with system prompt and sample conversation.
Chat Playground with approved system prompt.

5. First API call (proof of access)

Outcome: Verified access with logging, cost awareness, and failure handling from day one.

Use the Azure OpenAI SDK with deployment names configured inside your Project.

import os
from openai import AzureOpenAI

client = AzureOpenAI(
    api_key=os.environ["AZURE_OPENAI_API_KEY"],
    api_version="2024-02-15-preview",
    azure_endpoint=os.environ["AZURE_OPENAI_ENDPOINT"],
)

response = client.chat.completions.create(
    model="foundry-chat-prod",
    messages=[
        {"role": "system", "content": "You are a precise support assistant."},
        {"role": "user", "content": "Summarize this ticket in one sentence."},
    ],
    temperature=0.2,
)

print(response.choices[0].message.content)
import { AzureOpenAI } from "openai";

const client = new AzureOpenAI({
  apiKey: process.env.AZURE_OPENAI_API_KEY,
  apiVersion: "2024-02-15-preview",
  endpoint: process.env.AZURE_OPENAI_ENDPOINT,
});

const response = await client.chat.completions.create({
  model: "foundry-chat-prod",
  messages: [
    { role: "system", content: "You are a precise support assistant." },
    { role: "user", content: "Summarize this ticket in one sentence." },
  ],
  temperature: 0.2,
});

console.log(response.choices[0].message.content);
Deployment list with key vault secrets configuration.
API deployment and key vault configuration.

6. Guardrails and limits (preventing early failures)

Outcome: Fewer policy violations, controlled spend, and predictable latency.

Enable Azure content filters, set rate limits, and route all prompts through a validation layer.

Content filters

Use Azure safety filters and log all blocked responses.

Budget alerts

Apply project budgets and cost anomaly alerts.

Rate limits

Set per-project limits to avoid accidental spikes.

Leadership framing: Guardrails are a cost and trust control, not a blocker.

Content filters with budget alerts enabled.
Content filter configuration and budget alerts.

7. Common failure modes (what breaks in real orgs)

These issues show up repeatedly in enterprise rollouts. Plan for them up front.

Untracked spend

Teams ship without budgets or alerts. Costs spike within the first week.

Policy drift

Prompt changes bypass review and create unsafe outputs.

Access sprawl

Keys are shared and ownership is unclear when incidents occur.

Fix: Tie access, prompts, and budgets to named owners with documented review cadence.

8. What "ready" actually means

A team is ready to go live when these statements are true:

  • Governance: The Hub enforces identity, region, and model policy defaults.
  • Safety: Content filters and input validation are enabled and logged.
  • Cost: Budgets and alerts exist at the Project level.
  • Operational: An on-call owner and rollback path are documented.

Business impact: Faster onboarding, fewer incidents, and higher confidence across teams.

Project readiness checklist marked complete.
Readiness checklist completed in Project.

Author note

I treat onboarding as a governance exercise: clarify decisions early so developers can move fast without surprises.