Azure-AI_Foundry

Lesson 1: Azure AI Foundry Architecture

Learning Objectives

By the end of this lesson, you will be able to:

Explain the Hub and Project hierarchy
Identify the underlying Azure resources created by AI Foundry
Describe networking and security options
Understand how Connections link external resources

📖 Official docs: Azure AI Foundry architecture

Hub and Project Hierarchy

Azure AI Foundry uses a two-level hierarchy for organizing resources:

Hub (Top Level)

A hub is the governance boundary. It provides:

Shared infrastructure (compute, storage, networking)
Centralized security and access control
Connections to external services
Policies that apply to all child projects

Project (Child Level)

A project is the development workspace. Each project:

Lives inside exactly one hub
Has its own models, data, evaluations, and endpoints
Can have project-specific RBAC
Isolates work between teams or applications

Subscription
  └── Resource Group
        └── AI Hub (hub-contoso-prod)
              ├── Project: chatbot-v2
              ├── Project: doc-search
              └── Project: agent-assistant

When to Create a New Hub vs. Project

Create a new Hub when…	Create a new Project when…
Different security/networking requirements	New application or workload
Separate billing/cost centers	New team within same org
Different Azure regions	Different stage of same app (dev/test)
Regulatory isolation needed	Experimenting with new models

Underlying Azure Resources

When you create a hub, Azure provisions several supporting resources automatically:

# Resources created with a new AI Hub
hub_resources = {
    "Azure AI Services":     "Multi-service AI resource (OpenAI, Speech, Vision, etc.)",
    "Storage Account":       "Stores project data, flow artifacts, and evaluation results",
    "Key Vault":             "Manages secrets, API keys, and connection strings",
    "Container Registry":    "Stores Docker images for custom deployments (optional)",
    "Application Insights":  "Monitoring and telemetry (optional)",
    "Log Analytics":         "Centralized logging (optional)",
}

Resource Relationship Diagram

┌─ AI Hub ────────────────────────────────────┐
│                                             │
│  ┌─ Managed Resources ──────────────────┐   │
│  │  • Storage Account (data, artifacts) │   │
│  │  • Key Vault (secrets, keys)         │   │
│  │  • AI Services (multi-service)       │   │
│  │  • Container Registry (optional)     │   │
│  └──────────────────────────────────────┘   │
│                                             │
│  ┌─ Connections ────────────────────────┐   │
│  │  • Azure OpenAI endpoints            │   │
│  │  • Azure AI Search instances         │   │
│  │  • Custom APIs / data sources        │   │
│  └──────────────────────────────────────┘   │
│                                             │
│  ┌─ Projects ───────────────────────────┐   │
│  │  Project A    Project B    Project C │   │
│  └──────────────────────────────────────┘   │
└─────────────────────────────────────────────┘

Networking and Security Model

AI Foundry supports three network configurations:

1. Public Access (Default)

Hub and projects accessible over the internet
Suitable for development and experimentation
Can restrict access using IP allowlists

2. Private Endpoints

Hub accessible only through Azure Private Link
Resources communicate over the Azure backbone
Requires VNet configuration

3. Managed Virtual Network

Azure manages the VNet on your behalf
Outbound rules control what the hub can access
Simplest path to network isolation

# Example: Check hub networking configuration via SDK
from azure.ai.ml import MLClient
from azure.identity import DefaultAzureCredential

ml_client = MLClient(
    credential=DefaultAzureCredential(),
    subscription_id="<subscription-id>",
    resource_group_name="<resource-group>",
    workspace_name="<hub-name>"
)

hub = ml_client.workspaces.get("<hub-name>")
print(f"Network isolation mode: {hub.managed_network}")

📖 Official docs: Configure private link

Connections Concept

Connections are how AI Foundry links to external resources. They store credentials securely in Key Vault and make services available to all projects within a hub.

Connection Types

Connection Type	Examples
Azure OpenAI	GPT-4o, GPT-4o-mini, DALL-E, Whisper
AI Search	Vector search for RAG scenarios
Storage	Blob storage for documents and data
Serverless Model	Llama, Mistral, Cohere via MaaS
Custom	Any REST API with API key or token auth

# List connections in a project
from azure.ai.projects import AIProjectClient
from azure.identity import DefaultAzureCredential

project = AIProjectClient(
    credential=DefaultAzureCredential(),
    endpoint="https://<your-hub>.services.ai.azure.com/api",
    project_name="<project-name>"
)

connections = project.connections.list()
for conn in connections:
    print(f"{conn.name} ({conn.connection_type})")

Regions and Availability

Azure AI Foundry is available in most Azure regions, but model availability varies:

Region	GPT-4o	GPT-4o-mini	Llama 3.1	Mistral Large
East US	✅	✅	✅	✅
East US 2	✅	✅	✅	✅
West US 3	✅	✅	❌	✅
Sweden Central	✅	✅	✅	✅
UK South	✅	✅	❌	❌

⚠️ Note: Model availability changes frequently. Always check the model availability matrix for the latest information.

💡 Tips: Best Practices

Naming conventions: Use a consistent pattern like hub-{org}-{env} and proj-{team}-{app}
Resource group organization: Keep the hub and its dependent resources in the same resource group
Tag everything: Apply tags for cost tracking, environment, and ownership
Start with managed networking: It’s easier to set up and maintain than custom VNets
Plan for multi-region: Deploy hubs in regions closest to your users and data

# Recommended naming pattern
hub-contoso-dev          # Development hub
hub-contoso-prod         # Production hub
proj-search-chatbot      # Search chatbot project
proj-docs-assistant      # Documentation assistant project

Summary

Concept	Key Takeaway
Hub	Governance boundary with shared infrastructure
Project	Development workspace for a specific workload
Resources	Storage, Key Vault, AI Services auto-provisioned
Networking	Public, private endpoints, or managed VNet
Connections	Secure links to external services

Additional Resources

*← Overview

Lesson 2 — Getting Started →*