Azure-AI_Foundry

Lesson 1: Hub Management

Create and configure AI Foundry hubs — the shared infrastructure layer for your AI projects.

What is a Hub?

An Azure AI Foundry hub is a top-level resource (Microsoft.MachineLearningServices/workspaces with kind: hub) that provides shared infrastructure for one or more projects. When you create a hub, Azure automatically provisions:

Azure Storage Account — for data, models, and artifacts
Azure Key Vault — for secrets and connection strings
Azure AI Services — multi-service cognitive resource
Azure Container Registry (optional) — for custom containers

📖 Docs: Create an AI Foundry Hub

Creating a Hub

Method 1: Azure Portal

Go to ai.azure.com
Click + New project → New hub
Configure name, subscription, resource group, region
Review and create

Method 2: Azure CLI

# Create resource group
az group create --name rg-ai-foundry --location eastus2

# Create hub (uses az ml workspace create with kind hub)
az ml workspace create \
  --name my-ai-hub \
  --resource-group rg-ai-foundry \
  --kind hub \
  --location eastus2

Method 3: Bicep

resource hub 'Microsoft.MachineLearningServices/workspaces@2024-10-01' = {
  name: hubName
  location: location
  kind: 'hub'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    friendlyName: hubName
    storageAccount: storageAccount.id
    keyVault: keyVault.id
    containerRegistry: containerRegistry.id
  }
}

See infra/ai-foundry-hub.bicep for a complete template.

Method 4: Python SDK

from azure.ai.ml import MLClient
from azure.ai.ml.entities import Hub
from azure.identity import DefaultAzureCredential

ml_client = MLClient(
    credential=DefaultAzureCredential(),
    subscription_id="<subscription-id>",
    resource_group_name="rg-ai-foundry"
)

hub = Hub(name="my-ai-hub", location="eastus2")
ml_client.workspaces.begin_create_or_update(hub).result()

Managing Connections

Connections link your hub to external services. Common connection types:

Connection Type	Purpose	Example
Azure OpenAI	Access GPT models	Your Azure OpenAI resource
Azure AI Search	RAG grounding	Search index for your documents
Azure Blob Storage	Data storage	Training data, documents
Custom	External APIs	Third-party services

from azure.ai.ml.entities import AzureOpenAIConnection

connection = AzureOpenAIConnection(
    name="my-aoai",
    azure_endpoint="https://my-openai.openai.azure.com/",
    api_key="<key>"  # Or use managed identity
)
ml_client.connections.create_or_update(connection)

💡 Tip: Use managed identity connections instead of API key connections whenever possible. This eliminates the need to manage and rotate keys.

Hub Settings

Identity

System-assigned managed identity (recommended) — Azure manages the identity lifecycle
User-assigned managed identity — you manage the identity, useful for pre-existing policies

Compute

Hub-level compute is shared across all projects
Used for Prompt Flow runtime, evaluation jobs, and custom code

Multi-Hub Enterprise Topologies

Pattern 1: Environment Separation

Hub-Dev     → Project-App1-Dev, Project-App2-Dev
Hub-Staging → Project-App1-Staging, Project-App2-Staging
Hub-Prod    → Project-App1-Prod, Project-App2-Prod

Pattern 2: Team Separation

Hub-TeamA → Project-CustomerBot, Project-InternalTool
Hub-TeamB → Project-DataPipeline, Project-Analytics

Pattern 3: Region Separation

Hub-EastUS2  → Primary production workloads
Hub-WestUS2  → DR/failover workloads
Hub-WestEU   → EU data residency requirements

💡 Tip: Start with environment separation (dev/staging/prod) as your default pattern. Add team or region separation as needed.