Azure-AI_Foundry

Module 2: Projects & Hubs — Deep Dive

Overview

This module takes a deeper look at AI Foundry’s organizational model: Hubs and Projects. You’ll learn enterprise patterns for structuring resources, configuring RBAC, managing networking, and applying governance policies at scale.

📖 Official docs: AI Foundry hubs and projects

---

Why Resource Organization Matters

As AI adoption scales across an enterprise, proper resource organization becomes critical for:

• Security — Isolating workloads and controlling access
• Cost management — Tracking spend by team, project, or environment
• Governance — Enforcing policies and compliance requirements
• Collaboration — Sharing models, data, and infrastructure efficiently

---

Hub vs. Project: A Decision Framework

┌─────────────────────────────────────────────────────────┐
│  Hub = Governance + Infrastructure                      │
│  ├── Shared connections (OpenAI, AI Search, Storage)    │
│  ├── Networking (VNet, private endpoints)               │
│  ├── Identity (managed identity, RBAC)                  │
│  └── Policies (content filters, quotas)                 │
│                                                         │
│  Project = Workspace + Isolation                        │
│  ├── Models and deployments                             │
│  ├── Data and evaluations                               │
│  ├── Prompt flows and agents                            │
│  └── Project-specific RBAC                              │
└─────────────────────────────────────────────────────────┘

Think of it like an office building:

• Hub = The building (shared utilities, security, network)
• Project = An office suite (team’s workspace within the building)

Enterprise Patterns

Pattern	Structure	Use Case
Single-hub, multi-project	1 hub → N projects	Small org, shared infrastructure
Hub-per-environment	dev hub, staging hub, prod hub	Environment isolation
Hub-per-business-unit	marketing hub, engineering hub	Departmental separation
Hub-per-region	eastus hub, westeurope hub	Data residency compliance

---

RBAC Roles for AI Foundry

AI Foundry defines specific roles that map to hub and project operations:

Role	Scope	Permissions
Azure AI Developer	Project	Deploy models, run evaluations, create flows
Azure AI Inference Deployment Operator	Project	Manage model deployments only
Contributor	Hub/Project	Full management (except RBAC)
Reader	Hub/Project	View resources only
Owner	Hub	Full control including RBAC

# Assign AI Developer role to a user on a project
from azure.mgmt.authorization import AuthorizationManagementClient
from azure.identity import DefaultAzureCredential
import uuid

auth_client = AuthorizationManagementClient(
    credential=DefaultAzureCredential(),
    subscription_id="<subscription-id>"
)

# Azure AI Developer role definition ID
role_id = "/providers/Microsoft.Authorization/roleDefinitions/64702f94-c441-49e6-a78b-ef80e0188fee"

auth_client.role_assignments.create(
    scope="/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.MachineLearningServices/workspaces/<project>",
    role_assignment_name=str(uuid.uuid4()),
    parameters={
        "role_definition_id": role_id,
        "principal_id": "<user-object-id>",
        "principal_type": "User"
    }
)

📖 Official docs: RBAC for AI Foundry

---

What You’ll Learn in This Module

Lesson	Topic
Lesson 1	Creating and configuring hubs — Portal, CLI, Bicep, SDK, Terraform
Lesson 2	Project management, RBAC, sharing, quotas
Lesson 3	Private endpoints, managed VNet, Key Vault, diagnostics
Knowledge Check	15 scenario-based review questions

---

Prerequisites

• Completed Module 1: Introduction to Azure AI Foundry
• Azure subscription with Contributor access
• Azure CLI installed with ml extension

---

Key Links

Resource	URL
Hub and project overview	https://learn.microsoft.com/en-us/azure/ai-studio/concepts/ai-resources
RBAC roles	https://learn.microsoft.com/en-us/azure/ai-studio/concepts/rbac-ai-studio
Manage hubs	https://learn.microsoft.com/en-us/azure/ai-studio/how-to/create-azure-ai-resource
Networking	https://learn.microsoft.com/en-us/azure/ai-studio/how-to/configure-private-link
Managed network	https://learn.microsoft.com/en-us/azure/ai-studio/how-to/configure-managed-network

---

Next: Lesson 1 — Hub Management →