Managed or self-host Proprietary

Azure AI Foundry Cloud platform

Name: Azure AI Foundry
Author: Microsoft

Azure AI Foundry is a cloud AI platform: an OpenAI-compatible API in front of ~10,000 models. You pay for inference itself rather than a routing fee. It can be self-hosted or used as a managed service. Zero data retention, a HIPAA BAA and SOC 2 are published. Beyond chat it also serves embeddings, image generation and batch jobs. It handles load balancing, guardrails and request logging.

Last verified August 29, 2026 · 35 of 113 fields dated · 52 sources

Built by Microsoft · US company · EU region available

Compare with others Estimate cost Visit site ↗

Access at a glance

Whether this product can work for you at all, before features matter: who pays the model bill, where it can run, and which of your existing API calls keep working. Every value is the vendor’s own claim, linked to the page it came from.

Microsoft calls it "Microsoft Foundry Models", "your one-stop destination for discovering, evaluating, and deploying powerful AI models" and "the hub for discovering and using a wide range of models to build generative AI applications" (Foundry Models overview, 2026-07-28). It is a cloud model platform with a catalog split between models Azure sells and hosts and partner/community models; a model-router model exists inside it but the product is not a third-party routing proxy (Foundry Models sold by Azure, 2026-08-26).

Who pays the model bill

Not applicable

It is the model provider, so inference is billed by the platform itself rather than resold.

Foundry is the model host, authenticated with Azure resource credentials rather than upstream provider keys (How to use the Foundry Models inference endpoints, 2025-06-26; Azure OpenAI reference, 2026-06-24).

Merchant of record: Microsoft/Azure for models sold by Azure, billed as "First Party Consumption Services" via Azure meters; for partner and community models the provider "set[s] the price for use of their models using Azure Marketplace", so charges flow through Azure Marketplace (and Student, Visual Studio Enterprise and Free-credit subscriptions cannot purchase Marketplace SaaS offers) (Foundry Models overview, 2026-07-28; Foundry Models from partners and community). Serverless usage is billed on inputs/outputs (typically tokens) and managed compute on VM core hours (Foundry Models overview).

Key handling: Two authentication methods: API keys sent in the api-key HTTP header ("all API requests must include the API Key in the api-key HTTP header") and Microsoft Entra ID bearer tokens in the Authorization header (Azure OpenAI reference, 2026-06-24); the models inference SDKs use AzureKeyCredential / AZURE_INFERENCE_CREDENTIAL (How to use the Foundry Models inference endpoints, 2025-06-26). Keys are scoped to the Foundry/Azure OpenAI resource, and there are no upstream third-party secrets to vault since Microsoft hosts the models (Foundry Models overview, 2026-07-28). Request traffic can be confined to a private endpoint with public network access disabled on the hub (propagation up to five minutes), with the caveat that Azure OpenAI On Your Data is unavailable for serverless deployments in private hubs (Foundry Models overview). Customer-managed KMS specifics: n.a.

Where it can run

1 of 5 shapes documented

Vendor-hosted
Self-host
Your VPC
On-premise
Air-gapped

Dimmed shapes are not documented by the vendor, which is not the same as unsupported.

hosted cloud service in three shapes: serverless deployments where "Microsoft hosts the models in a managed Azure infrastructure"; managed compute, where weights are deployed to "dedicated virtual machines with managed compute" billed by "virtual machine core hours"; and "instant access (preview)" with "no deployment required" (Foundry Models overview, 2026-07-28). Private networking is supported (disable public network access on the hub and use "a private endpoint for the hub"), but the page "does not describe this as hybrid, VPC, on-premises, or air-gapped deployment" (Foundry Models overview). Local execution exists for at least one model via Foundry Local (gpt-oss-20b "available via managed compute and Foundry Local") (Foundry Models sold by Azure, 2026-08-26).

Serverless deployment types are Global/Data Zone/Regional Standard, Provisioned and Batch variants plus Developer (Foundry Models overview, 2026-07-28). Gating is by subscription, quota and region rather than SKU tier: pay-per-token requires the billing account's country to be one where the provider makes the offer available and a project resource in the model's region; some models need quota requests (Tier 5/6 have quota by default) or registration (computer-use-preview, grok-code-fast-1, grok-4), and partner/community models "require Azure Marketplace" (Foundry Models overview; Foundry Models sold by Azure, 2026-08-26; Foundry Models from partners and community). Managed compute deploys to "Azure Machine Learning managed compute for real-time inference" (Foundry Models overview).

API surfaces your code can keep using

5 of 7 documented

OpenAI chatPOST /v1/chat/completionsYes *
Yes, two paths: the unified models inference endpoint POST https://<resource>.services.ai.azure.com/models/chat/completions?api-version=... and the Azure OpenAI form POST https://<resource>.services.ai.azure.com/openai/deployments/<deployment>/chat/completions?api-version=2024-10-21 (How to use the Foundry Models inference endpoints, 2025-06-26).
Anthropic messagesPOST /v1/messagesNot documented *
n.a. Claude models are offered as partner models but no Anthropic Messages endpoint is documented on the pages fetched (Foundry Models from partners and community; How to use the Foundry Models inference endpoints, 2025-06-26).
OpenAI ResponsesPOST /v1/responsesNot documented
The /v1/responses path is not mentioned on the pages fetched, though the Azure OpenAI v1 APIs are referenced generally (Azure OpenAI reference, last updated 2026-06-24; Foundry Models from partners and community).
EmbeddingsPOST /v1/embeddingsYes
The models inference endpoint "supports the following modalities: Text embeddings… Image embeddings… Chat completions" (How to use the Foundry Models inference endpoints, 2025-06-26); embeddings are also used for RAG over custom data (Foundry Models overview, 2026-07-28).
ImagesPOST /v1/images/generationsYes
.../openai/deployments/{deployment-id}/images/generations and .../images/edits (documented for FLUX models), plus DALL·E deployments (Azure OpenAI reference, 2026-06-24).
AudioPOST /v1/audio/*Yes *
Yes, STT documented: audio transcription ("Transcribes audio into the input language") and translation ("Transcribes and translates input audio into English text") as multipart/form-data requests with file, prompt, response_format, temperature, language, returning json, text, srt, verbose_json or vtt (Azure OpenAI reference, 2026-06-24). TTS specifically: n.a. on the pages fetched (audio generation appears only as a catalog filter) (Foundry Models overview, 2026-07-28).
Batch jobsPOST /v1/batchesYes *
Yes at deployment level: Global Batch and Data Zone Batch deployment types exist and the Azure OpenAI API "supports additional features like assistants, threads, files, and batch inference"; no separate batch endpoint path is documented (Foundry Models overview, 2026-07-28; How to use the Foundry Models inference endpoints, 2025-06-26).

An asterisk marks a qualified verdict: support that is indirect (SDK compatibility or provider passthrough rather than a native endpoint), or a gap that is narrower or wider than the label suggests. Read the note before porting.

Two coexisting surfaces: a single Azure-schema models inference endpoint ("usually with the form https://<resource-name>.services.ai.azure.com/models") that "allows customers to use a single endpoint with the same authentication and schema" across deployed models, and the Azure OpenAI API which "exposes the full capabilities of OpenAI models" while "non-OpenAI models can also be used for compatible functionalities" (How to use the Foundry Models inference endpoints, 2025-06-26). It is not a plain OpenAI base-URL swap: routing is by deployment name (case-insensitive) matched to the request's model/name field, each Azure OpenAI deployment has its own URL (/deployments/<deployment-name>), and requests carry an api-version query parameter (How to use the Foundry Models inference endpoints). SDKs: azure-ai-inference (Python/JS/C#/Java) for the models endpoint and openai / Azure.AI.OpenAI for the Azure OpenAI surface (How to use the Foundry Models inference endpoints).

How much it reaches

Models~10,000

Upstream providersNot published

"over 10,000 models" in the catalog, with roughly "50 new models" published per month (Foundry Models overview, 2026-07-28); the partner page describes itself as listing only "a selection of Foundry Models from partners and community" (Foundry Models from partners and community).

First-party platform plus partner marketplace, so no routed-provider total is published; named providers include Azure OpenAI, Microsoft, Anthropic, Mistral, Meta, Cohere, NVIDIA, DeepSeek and Hugging Face (Foundry Models overview, 2026-07-28).

Whose models: Explicit two-way split. "Foundry Models sold by Azure" are hosted and sold by Microsoft under Microsoft Product Terms and billed as "First Party Consumption Services" via Azure meters — "Models sold by Azure are also hosted by Azure and operated by Azure as part of the Foundry Models service", covering all Azure OpenAI models plus selected models from top providers. "Foundry Models from partners and community" come from third-party organizations, partners, research labs and community contributors (including Anthropic's Claude family and Hugging Face open models), "require Azure Marketplace", and their providers "define the license terms and set the price for use of their models using Azure Marketplace" (Foundry Models overview, 2026-07-28; Foundry Models sold by Azure, 2026-08-26; Foundry Models from partners and community).

Your own endpoints: Partly: customers can deploy model weights themselves onto managed compute VMs inside their Foundry resource, which then exposes a REST inference API (Foundry Models overview, 2026-07-28). Registering an external customer-hosted endpoint (vLLM, Ollama, private URL) with the Foundry inference endpoint: n.a. on the pages fetched.

How it behaves in production

What happens when an upstream model is slow, wrong, or down — and what you can see and stop while it happens. Reliability features are recorded as where you configure them, not whether the vendor lists them, because almost every product here lists all of them.

1 of 6 reachable from code3 of 4 can block4 documented destinations

When something goes wrong

Each row says where the knob is, not whether the feature is on the marketing page. A control you can only reach by hand in someone else’s dashboard cannot be reviewed or version-controlled.

Request timeoutNot documented
The vendor does not document this, so any behaviour you observe today is unversioned and may change.
not_documented on the fetched Foundry pages (Azure OpenAI performance and latency).
RetriesNot documented
not_documented as a platform setting; default count and backoff: n.a. Microsoft's own gateway guidance tells you to build it yourself and to honor the Retry-After header from Azure OpenAI responses (Azure gateway for multiple Azure OpenAI deployments).
Fallback to another modelPer request
Your application decides per call, so one noisy endpoint can have its own timeout without a redeploy.
Also available:Dashboard only
per_request and dashboard_only, as a SINGLE-ALTERNATIVE spillover: deployment property spilloverDeploymentName, or per-request header x-ms-spillover-deployment, targeting one corresponding standard deployment in the same Azure OpenAI resource. If both are set, the deployment property wins. Triggers: 429 (PTUs exhausted), 400 (long-context request), 500, 503. If the spillover request also fails, the original PTU response is returned and x-ms-spillover-error carries the spillover status code. Not available for the Responses API (Azure spillover traffic management, Azure provisioned throughput).
Load balancingFixed, cannot change
The behaviour is fixed by the vendor. Predictable, but you cannot tune it for your workload.
not_configurable natively; no weights. Global Provisioned routes across regions automatically with no exposed policy (Azure provisioned throughput); spillover only prioritizes the provisioned deployment before overflowing to standard (Azure spillover traffic management). Multi-backend round-robin is a gateway pattern you build, and Microsoft warns endpoints in a pool must serve "the same model at the same version" (Azure gateway for multiple Azure OpenAI deployments).
Upstream health trackingFixed, cannot change
not_configurable / not provided by the platform. Microsoft states plainly that Azure OpenAI "doesn't provide any sort of health check endpoint to preemptively know whether it's available to handle requests", and recommends that your gateway circuit-break on 429/500/503, honor Retry-After, and remove faulted backends from the pool — with Azure API Management offering "built-in circuit breaker functionality" (Azure gateway for multiple Azure OpenAI deployments).
Cross-region failoverFixed, cannot change
not_configurable at the deployment level: the vendor runs the regions. Global Provisioned traffic is "Routed across Azure regions globally", Data Zone Provisioned "Stays within a geographic zone (US or EU)", Regional Provisioned "Stays in the deployment's specific Azure region" (Azure provisioned throughput). Spillover itself cannot cross resources — both deployments must be in the same Azure OpenAI resource with matching data-processing level (Azure spillover traffic management). Cross-region active-passive failover is described only as a gateway pattern you implement (Azure gateway for multiple Azure OpenAI deployments).

Fallback chain: Single alternate — One documented alternate target rather than a chain.

Foundry's built-in reliability is deployment-type selection plus single-target spillover; anything resembling a gateway (retry policy, circuit breaking, multi-backend balancing, active-passive regional failover) is documented as something you build in front of it, typically with API Management (Azure gateway for multiple Azure OpenAI deployments).

How fast the hop is

Cloud provider API

Not a gateway you deploy: routing is a feature of the cloud API itself, so overhead is whatever the cloud adds and is not separately measurable.

Managed Azure service; deployment types are selected via sku-name (GlobalProvisionedManaged, ProvisionedManaged), and no runtime is disclosed (Azure provisioned throughput).

You can run the request path yourselfNo

StreamingYes

no for the Foundry inference plane. Managed compute and serverless API endpoints are documented as Azure-hosted deployment options (Azure AI Foundry deployments overview).

Streaming caveats: Supported via stream: true; tokens return "as soon as they're available", which "doesn't change the time to get all the tokens" but "reduces the time for first response". Documented caveat: "Many clients and intermediary layers have timeouts on individual calls" and "Long generation calls might be canceled due to client-side time outs" — streaming is recommended partly to keep those connections alive (Azure OpenAI performance and latency). Model router forwards a standard chat-completions response but drops several parameters for o-series reasoning models (Temperature, Top_P, stop, presence_penalty, frequency_penalty, logit_bias, logprobs) and does not support reasoning_effort (Azure model router).

This vendor publishes no latency or throughput figure for the routing layer. That is the most common case here, and it is why the architecture class above carries the comparison instead of a number.

All figures are vendor (Microsoft) capacity-planning examples, not measured benchmarks and not third-party (Azure OpenAI performance and latency).

What it will stop

3 of 4 can block

Two separate questions per control: can it stop a request at all, and what does it do before you change any settings? A control that inspects and forwards is a logging feature, however it is named.

Personal data in promptsInspects but lets it through
Out of the box: Only logs until you change it
The content-filtering system includes a PII filter applied to model output; the docs describe detection and annotation and do not state that Foundry redacts the text (Content filtering, Foundry Models content filter)
Prompt injection and jailbreaksCan block the request
Out of the box: Blocks out of the box
Prompt Shields "detects and blocks" user prompt attacks and indirect (cross-domain) prompt injections; optional binary classifier models flag jailbreak risk, and indirect-attack detection requires document delimiters in the prompt (Prompt Shields / jailbreak detection, Foundry Models content filter)
Harmful contentCan block the request
Out of the box: Blocks out of the box
Azure AI Content Safety runs an ensemble of classification models over prompt and completion "synchronously as the service processes prompts to generate content", filtering hate, sexual, violence, and self-harm at configured severity thresholds; audio models such as Whisper are excluded (Content filtering, Data privacy, Foundry Models content filter)
Your own policiesCan block the request
Out of the box: You pick the action when configuring
Customer-defined policy takes the form of configurable severity thresholds per category and custom blocklists; separate protected-material and code classifiers can be enabled (Content filtering, Foundry Models content filter)

Where checks runOn the vendor's servers

If the guardrail itself failsNot documented

Almost no vendor in this catalogue documents what happens when the guardrail service itself times out. If the control matters to you, this is a question worth asking before you sign.

not_documented — no fail-open/fail-closed statement for the filtering service (Content filtering)

Anything typed into the Completions or Chat playground "generates metrics and log data for your Azure OpenAI resource", which surprises teams who assume the playground is ephemeral (Monitor Azure OpenAI). Human reviewers only reach flagged data, via point-wise request-ID queries from Secure Access Workstations under JIT approval (Data privacy).

What you can see

Exports to a few places

What gets loggedMetadata only

Token counts, latency and model names are stored, but not the text itself.

You can turn bodies offYes

Do not create (or scope down) diagnostic settings and platform metrics still flow; abuse-monitoring storage and human review can be removed via approved modified abuse monitoring (Monitor Azure OpenAI, Data privacy)

TracesOpenTelemetry

OpenTelemetry natively, using the OTel GenAI semantic conventions, with multi-agent spans surfaced in Azure Monitor Application Insights (Agent tracing concepts)

Platform metrics and activity logs are collected automatically, but resource logs "aren't collected and stored until you create a diagnostic setting"; prompts and completions are not stored by the content classifiers ("No prompts or generated content are stored in the content classifier models"). Abuse monitoring may retain a sample of prompts and completions for human review in a per-resource, per-geography store unless modified abuse monitoring is approved (Monitor Azure OpenAI, Data privacy)

Where telemetry can go

Azure Monitor
Log Analytics
Event Hubs
Azure Storage

Via diagnostic settings: Azure Monitor Logs / Log Analytics, Azure Storage, Azure Event Hubs (the route to non-Azure partner systems), and certain Microsoft monitoring partners; all metrics are exportable with diagnostic settings, plus Log Analytics workspace data export (Monitor Azure OpenAI); Application Insights for traces (Agent tracing concepts)

Records user feedbackNo

Scores live trafficNo

n.a. — no feedback/score endpoint documented on the fetched pages (Agent tracing concepts)

n.a. from the fetched pages (Agent tracing concepts)

Retention: Determined by the destination (Log Analytics workspace, Storage, Event Hubs) rather than by Foundry; no service-side default stated (Monitor Azure OpenAI)

Whether it fits how you work

How much work stands between you and a first call, how different that is from running it in production, and whether it slots into the stack you already have. Recorded as the shape of the work rather than a number of minutes — how long it takes you depends on which accounts and quota you already hold, which no comparison can know.

to try: cloud console setupto run: cloud console setupfits 3 of 10 common stacks

Getting to a first call

54 numbered steps

Shape of the workSet it up in a cloud console

You cannot start from an empty editor. An account, a project or a deployed resource has to exist first, and that step is done by hand.

Read off: the vendor’s own quickstart — 54 numbered steps.

Why the count is not the work: 54 numbered items interleave several language tracks and portal tracks rather than forming one linear procedure, and the final item concerns managing files on a vector store rather than making a first call. Treat this as "not one procedure", not as 54 steps of work.

Before step one

Your own provider keyNot needed
You can make a first call with only this product’s key. No upstream provider account needed.
. Authentication uses DefaultAzureCredential (Quickstart: Get started with Azure AI Foundry)
Payment methodNo card needed to start
Not stated; only "Create one for free." / "create a free account if needed" (Manage and increase quotas for resources, Quickstart: Get started with Azure AI Foundry)
Gate before models answerDeployment and quota first
You deploy a model and hold quota for it before any call works, and quota increases are a request.
Yes, in the form of deployment plus quota: you must deploy gpt-4o-mini before calling it, and rate limits/quota apply ("Rate limit is exceeded… you want to get more quota") (Quickstart: Get started with Azure AI Foundry). Quota mechanics: "If instant model requests are throttled, you can request a global quota increase or create a deployment with reserved capacity"; "Use the shared quota only for creating temporary test endpoints, not production endpoints"; "Some model and region combinations might not support quota increases"; requesting an increase is a 7-step procedure ending "Select the Request quota button in the upper-right corner" (Manage and increase quotas for resources)

Everything you need first: An Azure subscription ("create a free account if needed"); a hub-based project or a Foundry project; for a Foundry project, subscription Owner access. Credit card, billing enablement, cluster and provider key are not mentioned (Quickstart: Get started with Azure AI Foundry)

Running it in production

The same scale applied to the path the vendor recommends for production traffic. Kept separate from the quickstart because for several products here the two are barely related pieces of work.

Shape of the workSet it up in a cloud console

You cannot start from an empty editor. An account, a project or a deployed resource has to exist first, and that step is done by hand.

What production needs: RBAC and quota administration: Cognitive Services Usages Reader at subscription level to view quota; Owner or Contributor on the subscription to request increases; Cognitive Services Contributor + Usages Reader to edit quota allocations; an Azure subscription and a Foundry project (Manage and increase quotas for resources)

Can you run it yourself

Install command publishedNo self-hosting

This runs on the vendor’s infrastructure only.

How it fits your stack

3 of 10

Each row is a thing you might already run. “With a caveat” means it works but not the way the vendor’s marketing implies — read the reason, because that is usually where the surprise lives.

FitsThe OpenAI SDKDrop-in once set up — but first-call work is cloud console setup.
With a caveatThe Vercel AI SDKCommunity provider package
NoCloudflare WorkersNo Workers guidance published.
With a caveatKubernetesHelm is supported but no chart is named.
With a caveatTerraform or OpenTofuResources in the cloud’s provider
With a caveatAn existing API gatewayDocumented by Kong, not this vendor.
FitsCloud IAM I already runReuses IAM roles, workload identity or managed identities.
FitsLangChain or LlamaIndexLangChain, LangGraph, LlamaIndex
With a caveatMCP servers to governMCP tools in the API — governs nothing on your side.
NoNothing — plain Node or PythonA cloud console or resource has to exist before your first call.

Reading this the other way round — pick what you already run and see every product scored against it.

The integration surfaces behind those answers

Vercel AI SDKCommunity provider package
A package exists but nobody with a support obligation publishes it. Check its commit history before you depend on it.
Named: @quail-ai/azure-ai-provider
Documented by:a community publisher (@quail-ai)
A community Vercel AI SDK provider is documented as @quail-ai/azure-ai-provider, created with createAzure. This is an unofficial/community integration, not Microsoft vendor documentation. (Community Azure AI provider for Vercel AI SDK)
Cloudflare WorkersNot documented
No Workers guidance either way. If you are edge-first, verify fetch-only compatibility yourself.
n.a. (not documented)
KubernetesHelm supported, chart not named
Helm is referenced but no chart or repository is named, so you cannot inspect it in advance or pin a version.
Named: Foundry Local ships as an Azure Arc Kubernetes extension (Microsoft.Foundry / inference-operator) on Arc clusters 1.29+; no chart name or repo is stated
Foundry Local can be deployed as an Azure Arc Kubernetes extension with extension type Microsoft.Foundry, extension name inference-operator, and release namespace foundry-local-operator; Helm is also supported, but no chart name or repository is stated. The deployment requires an Azure Arc-enabled Kubernetes cluster running version 1.29 or later. (Deploy Foundry Local with the Azure Arc extension)
TerraformResources in the cloud’s provider
Managed through the hyperscaler’s own provider rather than a dedicated one. Coverage follows the cloud’s resource model, not the product’s features.
Named: AzAPI and AzureRM; azurerm_ai_foundry exists, though newer guidance points to azurerm_cognitive_account
Terraform support is documented through the Terraform AzAPI Provider and AzureRM Provider for managing Microsoft Foundry resources, deployments, projects, connections, and capability hosts. The Terraform Registry documents provider hashicorp/azurerm and resource azurerm_ai_foundry; the newer Foundry guidance recommends provisioning the new resource with azurerm_cognitive_account rather than legacy hub-based projects. (Create a Microsoft Foundry resource with Terraform)
Existing API gatewayThe gateway vendor documents it
The integration is documented by the gateway vendor rather than this one. A working recipe, without a support commitment from this product’s vendor.
Documented by:Kong
Yes (documented by Kong): the Kong ai-proxy-advanced plugin has an Azure AI Foundry / Azure OpenAI chat-route example with global, service, route, consumer and consumer-group scoped configuration. (Kong ai-proxy-advanced Azure chat route example)
Cloud identityReuses your cloud identity
Authenticate with the identity you already run — IAM roles, workload identity or managed identities. No long-lived key to rotate.
Microsoft Entra ID authentication is supported through DefaultAzureCredential, bearer tokens, managed identities, and Azure RBAC/resource role assignments; the documented token scope is https://ai.azure.com/.default. Foundry Local also documents Entra authentication with an app registration using entraAuth.tenantId and entraAuth.clientId. (Microsoft Foundry model endpoints)
MCPMCP tools in the API
The completion API accepts MCP tool definitions, so the model can call MCP tools. A model capability, not an MCP control plane.
Microsoft Foundry supports remote MCP servers through the Responses API using an mcp tool with fields including server_label, server_url, optional require_approval, and custom headers; approval uses mcp_approval_request and mcp_approval_response. Foundry Agent Service also supports MCP tool invocation and approval workflows, while Foundry Toolbox can expose managed tools and skills through a single MCP endpoint. (Use the Responses API with Microsoft Foundry)

Python frameworks

LangChain
LangGraph
LlamaIndex

Microsoft Foundry documents LangChain and LangGraph through langchain-azure-ai, including AzureAIOpenAIApiChatModel and AzureAIDocumentIntelligenceTool; vector-store packages include langchain-azure-cosmosdb. Foundry classic documents LlamaIndex through llama-index-llms-azure-inference and llama-index-embeddings-azure-inference, with AzureAICompletionsModel and AzureAIEmbeddingsModel. (Microsoft Foundry LangChain integration)

First-party client libraries

Python
JavaScript
.NET
Java

Official client libraries include Python openai, azure-ai-projects, and azure-identity; JavaScript openai, @azure/ai-projects, and @azure/identity; .NET OpenAI, Azure.AI.Projects, and Azure.Identity; and Java OpenAI and Azure Identity packages including com.openai:openai-java and com.azure:azure-identity. The Foundry SDK documents classes such as AIProjectClient, ProjectsClient, ProjectsClientBuilder, and ChatCompletionsClient; Foundry Local additionally documents C#, JavaScript, Python, and Rust SDKs. (Microsoft Foundry SDK overview)

Agent features: The documented agent features include stateful multi-turn sessions with previous_response_id, manual chaining, parallel multi-agent orchestration, function/tool calling, remote MCP tools, Code Interpreter, image generation, background tasks, streaming, response compaction, hosted agents with session-level state, and Foundry Agent Service threads, messages, and runs. A2A is not documented in the supplied evidence. (Microsoft Foundry Responses API)

Installs differ by language: pip install azure-ai-projects azure-ai-inference azure-identity, pip install openai azure-ai-projects azure-identity, dotnet add package Azure.Identity|Azure.AI.Projects|Azure.AI.Agents.Persistent|Azure.AI.Inference, or npm install. REST access tokens expire in 60–90 minutes. Quota changes "allow up to 15 minutes for changes to propagate," and "If the issue persists after 24 hours, contact Azure support." (Quickstart: Get started with Azure AI Foundry, Manage and increase quotas for resources)

Microsoft Foundry generally requires an Azure subscription, a Foundry resource or project, and deployed models or other Azure resources; deployments are Azure resources subject to Azure policies. Foundry projects expose https://<resource-name>.services.ai.azure.com/api/projects/<project-name> and an OpenAI-compatible /openai/v1 endpoint, while hosted agents run on Foundry-managed isolated Micro VMs with automatic scaling, a dedicated Microsoft Entra agent identity, session-level state, and observability. Foundry Local is a separate self-contained SDK deployment for Windows, macOS, and Linux that does not require the Foundry Local CLI on end-user machines. (Microsoft Foundry SDK overview)

Silence in the docs: 1 of the integration questions on this card have no published answer either way. That is recorded as undocumented, not as a no — but it does mean you would be verifying it yourself.

What it does well

Largest published catalog of the three hyperscalers at 11,000+ models, with a built-in Model Router
Fine-grained residency control through Global, Data Zone, single-region and Azure Government deployment types
Modified abuse monitoring gives approved customers an effective zero-retention path
Azure OpenAI clients are thin wrappers on the official OpenAI SDKs, so migration is mostly a base-URL change
Platform surface is free; you pay only for deployed models and compute

Where it falls short

No cross-cloud routing: you can only reach models Microsoft hosts, so multi-cloud failover needs a separate gateway
Heavy Azure coupling — resources, quotas, deployments and PTU commitments are all Azure-specific
Constant renaming (Azure AI Studio to Azure AI Foundry to Microsoft Foundry) makes docs and portal naming inconsistent
Compliance attestations are documented at the Azure service level, not specifically under the Foundry brand, so scope needs verification per service

Choose it when

Microsoft-centric enterprises that want first-party OpenAI models plus a very large partner catalog under Azure governance.

Look elsewhere when

You need vendor-neutral routing across clouds, or you want a single flat token price without capacity planning around PTUs and deployment types.

Cloud platform: A hyperscaler surface offering several vendors models under one contract, one bill, and one identity system. Strong compliance story, limited to that cloud.

How hard is it to leave?

Derived from six published facts, not from an opinion. The weights are fixed and the same for every product — see the arithmetic.

80/80Some work to leave

Portability score breakdown for Azure AI Foundry
What helps you leave	Points	Source
Works with standard OpenAI codeSwitching away is a base-URL change rather than a rewrite of every call site.	22/22	vendor page
No vendor-specific SDK requiredA proprietary client library spreads through your codebase and has to be torn out again.	10/10	vendor page
Can use your own provider accountsYour keys and billing relationship stay yours, so removing the gateway does not cut off model access.	not published	—
Can be self-hostedYou can run it yourself instead of accepting a pricing or policy change.	20/20	vendor page
Configuration lives in version controlRouting and budget rules are a file you keep, not dashboard state you would have to rebuild.	16/16	vendor page
Your request history can be exportedYou leave with your own logs instead of abandoning them.	12/12	vendor page

1 of the 6 inputs is not published, so the highest reachable score here is 80 rather than 100. That is a gap in the public documentation, not a mark against the product — no points are deducted, they simply cannot be claimed. This measures technical switching cost only. It does not price the engineering time to re-test prompts against a different routing stack.

Full specification

Every field we track. Blank fields say "Not published" rather than "No" — we do not infer an absence from silence. Switch to Technical in the header for the precise field names and the low-level details.

Overview

What kind of product Category: Cloud platform Not verified; Marketplaces resell many providers behind one key. Gateways add governance on top. Open-source projects you run yourself. Cloud platforms are hyperscaler surfaces. Inference providers host models on their own hardware.
Who runs it Deployment model: Managed or self-host Verified 3 days ago; Managed means the vendor operates it. Self-host means you run it on your own infrastructure. Both means you can choose.
Licence Licence: Proprietary Not verified; Proprietary products cannot be inspected or forked. Open licences such as MIT and Apache-2.0 let you audit, modify, and run the code without permission.
Company Company: Microsoft Verified 3 days ago; The organisation that maintains the product.
Who you would be signing with Vendor status: Large cloud vendor product Not verified; Whether the product is still an independent company, has been acquired, is a large cloud vendor’s product line, is run by a software foundation, or has been put into maintenance mode. Maintenance mode means bug fixes and security patches only — no new features.
Last shipped an update Latest release: 2026-08-13 Not verified
Microsoft publishes no per-release dates, so this is when the “What's new in Microsoft Foundry” page was last updated.; The date of the most recent release or version tag. A product that has not shipped in a year is a different risk from one that shipped last week, regardless of what its marketing site says.
GitHub stars GitHub stars: Not published Not verified; A rough proxy for community size on open-source projects. Not a quality measure.

Cost

Markup on model prices Token markup: Not published Not verified; How much the product adds on top of what the underlying model provider charges. Zero means you pay the same per-token price you would pay the model provider directly.
Fee to add funds Credit purchase fee: Not published Not verified; A percentage charged when you top up your balance, separate from token prices. It is easy to miss because it does not appear on the per-token price list.
Monthly cost per person Seat fee: None Verified 3 days ago; A recurring per-user platform charge that applies regardless of how much you use the models.
Can use your own provider accounts BYOK supported: Not published Not verified; Bring Your Own Key: you keep direct contracts with OpenAI, Anthropic and others, and the gateway only routes traffic. This preserves negotiated rates and committed-spend discounts.
Cost of using your own accounts BYOK terms: Not published Not verified; What the product charges to route traffic through your own provider keys.
Free tier Free tier: Azure free account gives $200 credit valid 30 days; the Foundry platform itself is free to use and you pay only for the models and compute you deploy. Verified 3 days ago; What you can do without paying, useful for evaluation.
Enterprise plan from Enterprise plan from: Not published Not verified; Annual entry price for the enterprise tier, where one is published or credibly reported.
Cost to run it yourself Self-host cost: Mostly managed, with Foundry Local for on-device execution. Microsoft sets its own per-token prices rather than marking up a third party; Global Batch and Data Zone Batch deployments are 50% below the standard rate with a 24-hour completion target, and DeveloperTier deployments are cheap but capped at 24 hours with no SLA and no data-residency guarantee. Verified 3 days ago; What self-hosting actually costs once you account for infrastructure and any paid tier.
How the vendor makes money Pricing model: Bundled — inference is the product Not verified; The shape of the vendor’s bill: does the routing layer charge a percentage on top of tokens, a flat monthly fee, both, neither (because inference is the product), or nothing at all (open source with no paid tier).
How pricing works, briefly Pricing model detail: Pay-for-own-inference with an explicitly free platform layer. 'The Foundry platform is free to use and explore'; individual features billed at their normal rates. The gateway/routing layer is $0; models are billed separately. Not verified; A one-paragraph description that covers the caveats a pricing category cannot: introductory rates, per-feature meters, tier gating, and pricing that resets on a specific date.
Minimum commitment Minimum commitment: None required. Microsoft Agent pre-purchase plan is a 1-year metered plan buying Agent Commit Units at tiered discounts — 20,000 ACUs = 5%, 100,000 = 10%, 500,000 = 15% (dollar prices shown as '$-'). Not verified; Whether the vendor requires a minimum contract term, a minimum spend, or a provisioned-capacity purchase to get its published rate.
Charges that fire after you go over an allowance Overage terms: None stated on either pricing page. Not verified; The line items that scale with usage after an included allowance is exhausted — log storage, extra requests, per-feature meters, data export — which is where cost estimates usually go wrong.
Prompt cache offered Cache mechanism: Prefix cache Not verified; Whether the gateway offers its own response cache, what kind of match it does (exact request, prefix, semantic), or simply passes provider caching through unchanged.
Discount on cached input Cache-read discount: Not published Not verified; How much cheaper cached tokens are than fresh input, when the vendor publishes a single figure. Bundled-inference clouds usually price this per model instead of as one number.
Premium on cache writes Cache-write premium: None Not verified; How much more the first write of a cached prefix costs versus a plain input token. A high write premium and a low hit rate can leave you paying more than you save, so this matters as much as the read discount.
Who captures the cache saving Cache economics: Exact-prefix prompt caching, enabled by default, no opt-out. The first 1,024 tokens must be identical; a single character difference in the first 1,024 tokens = miss. Hits extend every 128 identical tokens. Caches clear within 5–10 minutes of inactivity and always within an hour, and are not shared across subscriptions. Discount: Standard cached-token discount is not published as a number; Provisioned deployments get up to 100% discount on input tokens. No cache-write charge documented. On Provisioned capacity, cached input can be effectively free. Not verified; Whether the customer keeps the full saving from caching or the vendor captures part of it — and any conditions attached (write premium, storage fees, best-effort hits).
What you can split spend by Cost attribution: Not stated on the pricing pages. Not verified; The dimensions the vendor documents for splitting spend — per key, per user, per team, per tag, per customer. Matters if you need to chargeback internally or bill an end customer.
How you get cost data out Cost export: Not stated on the pricing pages. Not verified; The mechanisms the vendor publishes for exporting cost and usage data: CSV, an API, webhooks, S3, a data warehouse, or nothing at all. Any per-unit price is included.
Who pays the model bill BYOK mode: Not applicable Not verified; Whether you bring your own provider accounts (BYOK), buy inference from this vendor, or can do either. This is the single biggest commercial difference between these products: it decides who holds the contract with the model provider and who carries the spend.

Spend governance in detail

Seven signals matter when a bill starts to hurt: who can spend, how much, on what, and who gets paged when it goes wrong. Everything below is drawn from the vendor’s own pricing and docs pages — how we read these.

Virtual or scoped keysNot published
Keys that carry their own budget and rate-limit policy, so an intern experiment cannot spend against a production budget.
Not stated on the pricing pages fetched.
Budget caps per keyNot published
A dollar or token ceiling attached to an individual key. Where enforcement is soft, one over-limit request still completes before the block kicks in.
Not stated on the pricing pages fetched.
Budget caps per team or workspaceNot published
A ceiling applied at a higher scope than one key — a team, a workspace, a customer, or an entire environment.
Not stated on the pricing pages fetched.
Rate limiting as a cost controlNot published
Configurable request-per-time-window caps. Platform-set rate limits do not count as spend controls; user-configurable ones do.
Not stated as a cost control.
Model allowlistsNot published
A policy that constrains which models a key or team can call, keeping expensive frontier models out of the wrong hands.
Not stated on the pricing pages fetched.
Spend alertsNot published
Alerts fired as spend approaches a threshold. Alerts that only fire after the meter has rolled over are marked as such.
Not stated on the pricing pages fetched.
Webhook notificationsNot published
Programmatic notifications on spend events, so budget breaches can page an on-call or open a ticket.
Not stated on the pricing pages fetched.

Enforcement:Enforcement point not stated

Catalog

Models available Models available: ~10,000 Verified 3 days ago; How many models you can call, shown as a range because several vendors publish different totals on different pages. Vendor-reported either way, so counts are not directly comparable — some count every provider variant of the same model separately.
Model providers reachable Upstream providers: Not published Not verified; How many distinct model providers or labs you can reach, shown as a range where the vendor’s own pages disagree. More providers usually means better redundancy when one has an outage.
Works with standard OpenAI code OpenAI-compatible API: Yes Verified 3 days ago; If yes, you can usually switch to it by changing one base URL, and switch away just as easily. This is the main defence against lock-in.
OpenAI chat endpoint POST /v1/chat/completions: Yes Not verified; The endpoint almost every application ports first. "Not documented" means the vendor never states it, which is different from a documented no.
Anthropic messages endpoint POST /v1/messages: Not documented Not verified; Whether Anthropic-shaped calls work without rewriting them. Several products support this only as SDK compatibility or provider passthrough rather than a native endpoint — the detail page says which.
OpenAI Responses endpoint POST /v1/responses: Not documented Not verified; The newer stateful OpenAI surface. Support is much thinner across this market than chat completions.
Embeddings endpoint POST /v1/embeddings: Yes Not verified; Whether you can generate vectors through the same gateway, or need a second integration for retrieval workloads.
Image generation endpoint POST /v1/images/generations: Yes Not verified; Whether image models are reachable through the same surface as text.
Audio endpoints POST /v1/audio/*: Yes Not verified; Speech-to-text and text-to-speech. Frequently the first gap in an otherwise complete gateway.
Batch jobs endpoint POST /v1/batches: Yes Not verified; Asynchronous bulk processing, usually at a discount. Commonly undocumented, and commonly the reason a migration stalls late.
Needs the vendor’s own code library Requires a vendor-specific SDK: No Verified 3 days ago; A proprietary client library spreads through your codebase and has to be torn out again if you leave. “No” is the better answer here, and it means the standard OpenAI client works.
You can export your request history Logs / usage data export: Yes Verified 3 days ago; Whether you can get your own request logs, traces, or usage records back out — through an API, a bulk export, or a download. Decides whether you leave with your history or abandon it.
Settings can live in version control Declarative config-as-code: Yes Verified 3 days ago; Whether routing, fallback, and budget rules can be declared in a file you keep in Git, rather than existing only as settings clicked into a hosted dashboard.
Embeddings Embeddings: Yes Verified 3 days ago; Text-to-vector models, needed for search and retrieval features.
Image generation Image generation: Yes Verified 3 days ago; Whether image models are reachable through the same interface.
Speech and audio Speech and audio: Not published Not verified; Text-to-speech or transcription models through the same interface.
Video generation Video generation: Not published Not verified; Whether video models are reachable through the same interface.
Batch processing Batch processing: Yes Verified 3 days ago; Submitting large jobs for cheaper, slower processing. Often 50% off for work that is not time-sensitive.

Routing & reliability

Uptime it promises in writing Contractual SLA uptime: 99.9% Not verified; The uptime percentage in a published, contractual service level agreement. A public status page is not an SLA — it reports what happened, it does not promise anything or pay you back when it breaks.
Automatic failover Automatic failover: Not published Not verified; When a model provider goes down or rate-limits you, traffic moves to a backup automatically instead of returning errors to your users.
Load balancing Load balancing: Yes Verified 3 days ago; Spreads requests across several providers or keys to raise your effective rate limit.
Rule-based routing Conditional routing: Yes Verified 3 days ago; Send different requests to different models based on rules — for example a cheap model for free users and a strong model for paying ones.
Response caching Response caching: Not published Not verified; Reuses the answer when the exact same request comes in again, which cuts both cost and latency.
Similar-question caching Semantic cache: Not published Not verified; Reuses an answer when a new question means roughly the same thing as an earlier one. Saves far more than exact-match caching but can return subtly wrong answers if tuned loosely.
Where you set the timeout Request timeout surface: Not documented Not verified
`not_documented` on the fetched Foundry pages ([Azure OpenAI performance and latency](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/latency)).; Where a request timeout can be set: per request, in a config file, in the vendor dashboard, or nowhere. Nine of the twenty products documented here do not describe a request timeout at all, so the worst case of a hung upstream call is unknowable from the docs.
Where you set retries Retry policy surface: Not documented Not verified
`not_documented` as a platform setting; default count and backoff: `n.a.` Microsoft's own gateway guidance tells you to build it yourself and to honor the `Retry-After` header from Azure OpenAI responses ([Azure gateway for multiple Azure OpenAI deployments](https://learn.microsoft.com/en-us/azure/architecture/ai-ml/guide/azure-openai-gateway-multi-backend)).; Where retry count and backoff are configured. Worth knowing alongside billing: a retried streaming call can be charged more than once.
Where you set fallbacks Fallback surface: Per request Not verified
`per_request` and `dashboard_only`, as a SINGLE-ALTERNATIVE spillover: deployment property `spilloverDeploymentName`, or per-request header `x-ms-spillover-deployment`, targeting one corresponding standard deployment in the same Azure OpenAI resource. If both are set, the deployment property wins. Triggers: `429` (PTUs exhausted), `400` (long-context request), `500`, `503`. If the spillover request also fails, the original PTU response is returned and `x-ms-spillover-error` carries the spillover status code. Not available for the Responses API ([Azure spillover traffic management](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/spillover-traffic-management), [Azure provisioned throughput](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/concepts/provisioned-throughput)).; Where the fallback chain is defined. Almost every product claims fallback; the useful question is whether you can change it from code or only by hand in a dashboard.
Shape of the fallback chain Fallback shape: Single alternate Not verified; An ordered list tries targets in sequence; a weighted split sends a percentage of traffic to each, which is what you need to trial a new model on 5% of requests. Weighted splits are much rarer than the marketing implies.
Upstream health tracking Health checks / circuit breaking: Fixed, cannot change Not verified
`not_configurable` / not provided by the platform. Microsoft states plainly that Azure OpenAI "doesn't provide any sort of health check endpoint to preemptively know whether it's available to handle requests", and recommends that your gateway circuit-break on `429`/`500`/`503`, honor `Retry-After`, and remove faulted backends from the pool — with Azure API Management offering "built-in circuit breaker functionality" ([Azure gateway for multiple Azure OpenAI deployments](https://learn.microsoft.com/en-us/azure/architecture/ai-ml/guide/azure-openai-gateway-multi-backend)).; Whether the product notices a failing upstream and stops sending traffic to it, and whether you can tune the thresholds. This is what turns a provider outage into a blip rather than a sustained error rate, and only four of the twenty expose it.
Cross-region failover you control Multi-region failover surface: Fixed, cannot change Not verified
`not_configurable` at the deployment level: the vendor runs the regions. Global Provisioned traffic is "Routed across Azure regions globally", Data Zone Provisioned "Stays within a geographic zone (US or EU)", Regional Provisioned "Stays in the deployment's specific Azure region" ([Azure provisioned throughput](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/concepts/provisioned-throughput)). Spillover itself cannot cross resources — both deployments must be in the same Azure OpenAI resource with matching data-processing level ([Azure spillover traffic management](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/spillover-traffic-management)). Cross-region active-passive failover is described only as a gateway pattern you implement ([Azure gateway for multiple Azure OpenAI deployments](https://learn.microsoft.com/en-us/azure/architecture/ai-ml/guide/azure-openai-gateway-multi-backend)).; Whether you can define what happens when a region degrades. A vendor running many regions is not the same as a vendor letting you configure failover between them; only three document a user-controlled mechanism.
Where you set load balancing Load balancing surface: Fixed, cannot change Not verified
`not_configurable` natively; no weights. Global Provisioned routes across regions automatically with no exposed policy ([Azure provisioned throughput](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/concepts/provisioned-throughput)); spillover only prioritizes the provisioned deployment before overflowing to standard ([Azure spillover traffic management](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/spillover-traffic-management)). Multi-backend round-robin is a gateway pattern you build, and Microsoft warns endpoints in a pool must serve "the same model at the same version" ([Azure gateway for multiple Azure OpenAI deployments](https://learn.microsoft.com/en-us/azure/architecture/ai-ml/guide/azure-openai-gateway-multi-backend)).; Where traffic distribution across upstreams or keys is configured.

Operations

Usage dashboards and logs Observability: Yes Verified 3 days ago; Built-in visibility into what was sent, what came back, what it cost, and how long it took.
Spending limits Budget controls: Not published Not verified; Hard caps that stop spend before it becomes a surprise invoice. The single most valuable control for a small team.
Rate limits Rate limits: Not published Not verified; Caps on request volume per key or per user, useful for protecting against abuse and runaway loops.
Separate keys per team or app Virtual keys: Not published Not verified; Issue scoped keys with their own budgets and permissions so you can attribute cost and revoke access without rotating everything.
Prompt versioning Prompt management: Not published Not verified; Store and version prompts outside your code so they can be changed without a deploy.
Quality testing Evals: Yes Verified 3 days ago; Built-in tooling to score model output against test cases, so you can tell whether a model swap made things better or worse.
MCP support MCP support: Not published Not verified; Native support for the Model Context Protocol, the emerging standard for connecting models to external tools.
What gets logged Logged content: Metadata only Not verified
Platform metrics and activity logs are collected automatically, but resource logs "aren't collected and stored until you create a diagnostic setting"; prompts and completions are not stored by the content classifiers ("No prompts or generated content are stored in the content classifier models"). Abuse monitoring may retain a sample of prompts and completions for human review in a per-resource, per-geography store unless modified abuse monitoring is approved ([Monitor Azure OpenAI](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/monitor-openai), [Data privacy](https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacy)); Whether full prompts and responses are stored, only metadata, or nothing. Full-body logging is the most useful debugging feature here and the one most likely to need a conversation with your compliance team.
You can turn logging off Body-logging opt-out: Yes Not verified
Do not create (or scope down) diagnostic settings and platform metrics still flow; abuse-monitoring storage and human review can be removed via approved modified abuse monitoring ([Monitor Azure OpenAI](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/monitor-openai), [Data privacy](https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacy)); Whether prompt and response bodies can be suppressed while still keeping usage metrics. Nineteen of the twenty document a way to do this; the mechanisms range from a per-request header to an organisation-wide setting.
Traces you can take elsewhere Distributed tracing: OpenTelemetry Not verified
OpenTelemetry natively, using the OTel GenAI semantic conventions, with multi-agent spans surfaced in Azure Monitor Application Insights ([Agent tracing concepts](https://learn.microsoft.com/en-us/azure/foundry/observability/concepts/trace-agent-concept)); Whether the product emits OpenTelemetry, a proprietary format, or nothing. OpenTelemetry means the traces land in the tooling you already run instead of only in the vendor’s dashboard.
Where telemetry can go Export destinations: Azure Monitor, Log Analytics, Event Hubs, Azure Storage Not verified
Via diagnostic settings: Azure Monitor Logs / Log Analytics, Azure Storage, Azure Event Hubs (the route to non-Azure partner systems), and certain Microsoft monitoring partners; all metrics are exportable with diagnostic settings, plus Log Analytics workspace data export ([Monitor Azure OpenAI](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/monitor-openai)); Application Insights for traces ([Agent tracing concepts](https://learn.microsoft.com/en-us/azure/foundry/observability/concepts/trace-agent-concept)); Documented sinks for logs and metrics. This is a good proxy for how replaceable the vendor’s own dashboard is: around twenty destinations means you never have to depend on it, while a CSV download means you do.
Can record user feedback Feedback capture API: No Not verified
`n.a.` — no feedback/score endpoint documented on the fetched pages ([Agent tracing concepts](https://learn.microsoft.com/en-us/azure/foundry/observability/concepts/trace-agent-concept)); Whether there is an API to attach a rating or score to a logged request, which is what lets production traffic feed quality work later.
Scores live traffic Online eval hooks: No Not verified
`n.a.` from the fetched pages ([Agent tracing concepts](https://learn.microsoft.com/en-us/azure/foundry/observability/concepts/trace-agent-concept)); Whether automated scorers can run against real production requests, rather than only against a test set you assemble yourself.

Performance

Delay it adds Proxy overhead: Not published Not verified; Extra time the product itself adds to each request, on top of however long the model takes. Usually irrelevant next to multi-second model latency, but it matters for high-volume or streaming-sensitive workloads.
Requests per second ceiling Throughput: Not published Not verified; Published sustained request rate before the product becomes the bottleneck. Only relevant at genuinely high volume.
What the request path runs on Architecture class: Cloud provider API Not verified
Managed Azure service; deployment types are selected via `sku-name` (`GlobalProvisionedManaged`, `ProvisionedManaged`), and no runtime is disclosed ([Azure provisioned throughput](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/concepts/provisioned-throughput)).; The comparable way to talk about latency here. An edge worker, a compiled Go or Rust binary, and a Python proxy have different overhead floors no matter which figures each vendor publishes. Products that never disclose their runtime are recorded as undisclosed rather than assumed.
You can run the request path yourself Self-hostable data plane: No Not verified
`no` for the Foundry inference plane. Managed compute and serverless API endpoints are documented as Azure-hosted deployment options ([Azure AI Foundry deployments overview](https://learn.microsoft.com/en-us/azure/ai-foundry/concepts/deployments-overview)).; Whether the component that actually carries your prompts can run on your own infrastructure. Distinct from a vendor offering a self-hosted control plane while still proxying traffic through their network.
Streaming responses Streaming support: Yes Not verified
Supported via `stream: true`; tokens return "as soon as they're available", which "doesn't change the time to get all the tokens" but "reduces the time for first response". Documented caveat: "Many clients and intermediary layers have timeouts on individual calls" and "Long generation calls might be canceled due to client-side time outs" — streaming is recommended partly to keep those connections alive ([Azure OpenAI performance and latency](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/latency)). Model router forwards a standard chat-completions response but drops several parameters for o-series reasoning models (`Temperature`, `Top_P`, `stop`, `presence_penalty`, `frequency_penalty`, `logit_bias`, `logprobs`) and does not support `reasoning_effort` ([Azure model router](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/model-router)).; Whether token-by-token streaming is documented. The caveats matter more than the yes: some products cannot cancel a stream without still being billed, and several timeout and fallback mechanisms stop applying once the first token has been sent.

Security & compliance

Does your prompt reach their servers Prompt transits vendor: Yes Not verified
Microsoft hosts the models it sells inside its own Azure environment, and those models do not interact with services operated by the model's original provider.; Whether the text you send passes through this company’s own infrastructure. If it does, every other promise on this page is a policy commitment rather than a physical impossibility. Self-hosted products can answer no outright.
What they keep if you change nothing Logging default: Nothing stored by default Not verified
Models are stateless and prompts are not stored by the system for automated review. Abuse monitoring is the exception: flagged content goes to a store logically separated per customer resource, reachable only by authorised Microsoft staff through secure workstations with just-in-time approval.; Defaults matter more than options. A product that stores full prompts and replies unless you find the right header will have stored them by the time you read the docs.
How long they keep it Default content retention (days): Not published Not verified
No day count is published on the current page. It states where flagged content is stored and who may see it, but not for how long — do not assume the 30-day figure that appeared in older versions.; Default retention for request content, in days. Zero means nothing is kept. Read the note: several products keep nothing as a rule but make timed exceptions for abuse review or specific models.
Could they train on your prompts Training on customer data: No Not verified
Prompts, completions, embeddings and training data are not used to train generative foundation models, or to improve Microsoft or third-party products, without your explicit permission or instruction.; Whether the vendor may use your prompts and outputs to train models. “Not published” means we could not find any position, which is not the same as a no — ask for it in writing.
Where it runs, and what you can pin Region and residency control: Processing stays in your specified geography — with a significant exception. Any deployment type labelled Global may process prompts and responses in any geography, and DataZone widens the boundary too. Not verified; Which regions are offered and whether you can force processing to stay in one. A global endpoint that silently picks a region is a different compliance story from an endpoint you pin yourself.
Where safety filters run Guardrail execution location: In the vendor’s cloud Not verified
Content Safety models run inside Microsoft's Azure infrastructure. Data stays in Azure and in the region you chose, and is not stored or human-reviewed — but the filtering happens on Microsoft's side.; A filter that strips personal data only helps if it runs before the data leaves your boundary. If guardrails execute in the vendor’s cloud, the vendor has already received whatever you wanted redacted.
Who else touches the data Subprocessor list: https://www.microsoft.com/en-us/trust-center/privacy/data-access Not verified; The published list of third parties the vendor passes your data to. No list means you cannot know the full chain, which most data-protection agreements require you to.
SOC 2 audited SOC 2 audited: Yes Verified 3 days ago; An independent audit of security controls. Enterprise buyers and their procurement teams routinely require it.
Will sign a HIPAA agreement HIPAA BAA: Yes Verified 3 days ago; Required before you may send protected health information through the service. Without a signed BAA, healthcare data is off limits.
GDPR commitments GDPR commitments: Not published Not verified; Published data processing terms for handling personal data of people in the EU and UK.
Can keep data in the EU EU data residency: Yes Verified 3 days ago; Requests can be processed inside the EU rather than routed to US infrastructure. Often the deciding constraint for European customers.
Does not retain your data Zero data retention: Yes Verified 3 days ago; Prompts and responses are not stored after the request completes. Sometimes a paid add-on rather than the default.
Strips personal data PII redaction: Yes Verified 3 days ago; Detects and removes identifiers such as names, emails, and card numbers before the request reaches the model provider.
Content guardrails Content guardrails: Yes Verified 3 days ago; Policy checks on inputs and outputs — blocking unsafe content, enforcing formats, or catching prompt-injection attempts.
Runs fully disconnected Air-gapped deployment: Not published Not verified; Can be deployed in a network with no internet access, which some regulated and defence environments require.
Blocks personal data in prompts PII / DLP enforcement: Inspects but lets it through Not verified
The content-filtering system includes a PII filter applied to model output; the docs describe detection and annotation and do not state that Foundry redacts the text ([Content filtering](https://learn.microsoft.com/en-us/azure/ai-foundry/concepts/content-filtering), [Foundry Models content filter](https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/concepts/content-filter)); Whether personal data detection sits on the request path and can stop the call, merely inspects and forwards it, or is not documented. A control that only reports is a logging feature, not a policy control.
Blocks prompt injection Injection / jailbreak enforcement: Can block the request Not verified
Prompt Shields "detects and blocks" user prompt attacks and indirect (cross-domain) prompt injections; optional binary classifier models flag jailbreak risk, and indirect-attack detection requires document delimiters in the prompt ([Prompt Shields / jailbreak detection](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/jailbreak-detection), [Foundry Models content filter](https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/concepts/content-filter)); Whether injection and jailbreak detection can stop a request. Most products offering this call a partner classifier rather than shipping their own.
Blocks harmful content Toxicity / moderation enforcement: Can block the request Not verified
Azure AI Content Safety runs an ensemble of classification models over prompt and completion "synchronously as the service processes prompts to generate content", filtering hate, sexual, violence, and self-harm at configured severity thresholds; audio models such as Whisper are excluded ([Content filtering](https://learn.microsoft.com/en-us/azure/ai-foundry/concepts/content-filtering), [Data privacy](https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacy), [Foundry Models content filter](https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/concepts/content-filter)); Whether hate, violence, sexual and self-harm categories are checked inline and can stop a request, in either direction.
Your own policy rules Custom policy hooks: Can block the request Not verified
Customer-defined policy takes the form of configurable severity thresholds per category and custom blocklists; separate protected-material and code classifiers can be enabled ([Content filtering](https://learn.microsoft.com/en-us/azure/ai-foundry/concepts/content-filtering), [Foundry Models content filter](https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/concepts/content-filter)); Whether you can add your own rule — a regex, a webhook, or your own classifier — rather than choosing from the vendor library.
Where guardrails run Guardrail execution location: On the vendor's servers Not verified; Whether guardrail evaluation happens inside your infrastructure or on the vendor’s servers. This decides whether the prompt you are trying to protect leaves your network in order to be checked.
If the guardrail itself fails Guardrail failure mode: Not documented Not verified
`not_documented` — no fail-open/fail-closed statement for the filtering service ([Content filtering](https://learn.microsoft.com/en-us/azure/ai-foundry/concepts/content-filtering)); What happens when the guardrail service times out or errors: does the request proceed unchecked, or is it blocked? This is the worst-documented field in the entire catalogue — only two vendors state it plainly, which means most teams are running a control whose failure behaviour they cannot know.
Third-party guardrail vendors Guardrail integrations: Not published Not verified; Named external guardrail services the product can call. A long list means the product is a router for policy engines rather than a policy engine itself — which also means another vendor bill and another hop.

Compliance evidence

Graded by how strong the evidence is, not whether the word appears on the vendor’s website. An audited report and a marketing claim are different things, and only one of them will satisfy your own auditor.

SOC 2 Not published the Azure SOC offering page did not load during research
ISO 27001 Certified audited certification
GDPR DPA Certified Microsoft Data Protection Addendum
HIPAA BAA Not published the HIPAA page carried no BAA statement
FedRAMP Certified High P-ATO issued by the JAB for Azure and Azure Government
ITAR Not published

Vendor source

Fit & integration

Work to try it Evaluation work shape: Set it up in a cloud console Not verified; The shape of the work on the vendor’s own quickstart, from swapping one base URL through to deploying infrastructure. An ordinal class rather than a duration, because elapsed time depends on accounts and quota we cannot see.
Work to run it Production work shape: Set it up in a cloud console Not verified; The same scale applied to the vendor’s recommended production path. For several products this is much heavier than the quickstart, which is exactly why both are recorded.
Steps on the quickstart Numbered quickstart steps: 54 Not verified
54 numbered items interleave several language tracks and portal tracks rather than forming one linear procedure, and the final item concerns managing files on a vector store rather than making a first call. Treat this as "not one procedure", not as 54 steps of work.; A literal count of numbered steps on the vendor’s quickstart, recorded as evidence beside the work shape. Zero means the page publishes no numbered procedure at all. Large counts usually mean interleaved language tracks rather than more work.
Can you self-host it today Self-host install documentation: No self-hosting Not verified; Whether an install command is actually published. Several products advertise self-hosting while publishing no command to start from, which a plain yes/no would hide.
Works with the OpenAI SDK OpenAI SDK drop-in: Yes Not verified
Yes. Microsoft Foundry documents OpenAI SDK compatibility using `base_url`/`baseURL`, with the exact base URL `https://<resource>.openai.azure.com/openai/v1/`; the deployment name is passed in the `model` field and authentication can use `api_key`. Foundry project endpoints also expose an OpenAI-compatible `/openai/v1` endpoint. ([Microsoft Foundry model endpoints](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/endpoints)); Whether an existing OpenAI-compatible client can be pointed at it by changing the base URL and key.
Vercel AI SDK support AI SDK provider package: Community provider package Not verified
A community Vercel AI SDK provider is documented as `@quail-ai/azure-ai-provider`, created with `createAzure`. This is an unofficial/community integration, not Microsoft vendor documentation. ([Community Azure AI provider for Vercel AI SDK](https://ai-sdk.dev/providers/community-providers/azure-ai)); Whether a first-party AI SDK provider package exists, or only a community package, a documented workaround, or the generic OpenAI provider pointed at a custom base URL.
Python framework integrations Documented Python frameworks: LangChain, LangGraph, LlamaIndex Not verified
Microsoft Foundry documents LangChain and LangGraph through `langchain-azure-ai`, including `AzureAIOpenAIApiChatModel` and `AzureAIDocumentIntelligenceTool`; vector-store packages include `langchain-azure-cosmosdb`. Foundry classic documents LlamaIndex through `llama-index-llms-azure-inference` and `llama-index-embeddings-azure-inference`, with `AzureAICompletionsModel` and `AzureAIEmbeddingsModel`. ([Microsoft Foundry LangChain integration](https://learn.microsoft.com/en-us/azure/foundry/how-to/develop/langchain)); LangChain, LangGraph, LlamaIndex and similar orchestration frameworks with a documented integration.
Callable from Cloudflare Workers Cloudflare Workers support: Not documented Not verified
n.a. (not documented); Whether the docs show calling this product from your own Worker. Deliberately separated from the several products whose own gateway runs on Workers, which is a fact about their infrastructure and not about your edge compatibility.
Kubernetes install Helm chart availability: Helm supported, chart not named Not verified
Foundry Local can be deployed as an Azure Arc Kubernetes extension with extension type `Microsoft.Foundry`, extension name `inference-operator`, and release namespace `foundry-local-operator`; Helm is also supported, but no chart name or repository is stated. The deployment requires an Azure Arc-enabled Kubernetes cluster running version 1.29 or later. ([Deploy Foundry Local with the Azure Arc extension](https://learn.microsoft.com/en-us/azure/azure-sovereign-clouds/private/foundry-local/deploy-foundry-local-arc-extension)); Whether a named, published Helm chart exists, versus Helm being referenced with no chart named, versus generic cluster documentation that has nothing to do with this product.
Terraform support Terraform provider or modules: Resources in the cloud’s provider Not verified
Terraform support is documented through the Terraform AzAPI Provider and AzureRM Provider for managing Microsoft Foundry resources, deployments, projects, connections, and capability hosts. The Terraform Registry documents provider `hashicorp/azurerm` and resource `azurerm_ai_foundry`; the newer Foundry guidance recommends provisioning the new resource with `azurerm_cognitive_account` rather than legacy hub-based projects. ([Create a Microsoft Foundry resource with Terraform](https://learn.microsoft.com/en-us/azure/ai-foundry/how-to/create-resource-terraform)); Whether you can declare this in code: an official provider, official modules, resources inside a hyperscaler’s provider, a community provider, or only Terraform code shipped in a repo.
Reuses your cloud identity Cloud IAM reuse: Reuses your cloud identity Not verified
Microsoft Entra ID authentication is supported through `DefaultAzureCredential`, bearer tokens, managed identities, and Azure RBAC/resource role assignments; the documented token scope is `https://ai.azure.com/.default`. Foundry Local also documents Entra authentication with an app registration using `entraAuth.tenantId` and `entraAuth.clientId`. ([Microsoft Foundry model endpoints](https://learn.microsoft.com/en-us/azure/foundry-models/concepts/endpoints)); Whether you can authenticate with IAM roles, workload identity or managed identities instead of another long-lived API key. Distinguished from products that only accept static upstream provider credentials.
Fits behind your API gateway API gateway integration: The gateway vendor documents it Not verified
Yes (documented by Kong): the Kong `ai-proxy-advanced` plugin has an Azure AI Foundry / Azure OpenAI chat-route example with global, service, route, consumer and consumer-group scoped configuration. ([Kong ai-proxy-advanced Azure chat route example](https://developer.konghq.com/plugins/ai-proxy-advanced/examples/azure-chat-route/)); Whether AI traffic can go through a gateway you already run, and who documented that — the product’s vendor or the gateway’s.
MCP support MCP surface shape: MCP tools in the API Not verified
Microsoft Foundry supports remote MCP servers through the Responses API using an `mcp` tool with fields including `server_label`, `server_url`, optional `require_approval`, and custom `headers`; approval uses `mcp_approval_request` and `mcp_approval_response`. Foundry Agent Service also supports MCP tool invocation and approval workflows, while Foundry Toolbox can expose managed tools and skills through a single MCP endpoint. ([Use the Responses API with Microsoft Foundry](https://learn.microsoft.com/en-us/azure/foundry/openai/how-to/responses)); Which kind of MCP support this is: a gateway that governs many MCP servers, a hosted MCP server you connect to, MCP tools accepted inside the completion API, or client tooling. These are different products behind one acronym.
Needs your own provider key Upstream provider key required: Not needed Not verified
No. Authentication uses `DefaultAzureCredential` ([Quickstart: Get started with Azure AI Foundry](https://learn.microsoft.com/en-us/azure/ai-foundry/quickstarts/get-started-code)); Whether an upstream provider account and key must exist before your first call works. A prerequisite rather than a step, and it can differ between the hosted and self-hosted forms of the same product.
Gate before models work Model access gate: Deployment and quota first Not verified
Yes, in the form of deployment plus quota: you must deploy `gpt-4o-mini` before calling it, and rate limits/quota apply ("Rate limit is exceeded… you want to get more quota") ([Quickstart: Get started with Azure AI Foundry](https://learn.microsoft.com/en-us/azure/ai-foundry/quickstarts/get-started-code)). Quota mechanics: "If instant model requests are throttled, you can request a global quota increase or create a deployment with reserved capacity"; "Use the shared quota only for creating temporary test endpoints, not production endpoints"; "Some model and region combinations might not support quota increases"; requesting an increase is a 7-step procedure ending "Select the Request quota button in the upper-right corner" ([Manage and increase quotas for resources](https://learn.microsoft.com/en-us/azure/foundry/how-to/quota)); Whether an enablement click, a quota grant, a paid tier or an approval form stands between a valid key and a working model call.
Official client languages First-party client SDK languages: Python, JavaScript, .NET, Java Not verified
Official client libraries include Python `openai`, `azure-ai-projects`, and `azure-identity`; JavaScript `openai`, `@azure/ai-projects`, and `@azure/identity`; .NET `OpenAI`, `Azure.AI.Projects`, and `Azure.Identity`; and Java OpenAI and Azure Identity packages including `com.openai:openai-java` and `com.azure:azure-identity`. The Foundry SDK documents classes such as `AIProjectClient`, `ProjectsClient`, `ProjectsClientBuilder`, and `ChatCompletionsClient`; Foundry Local additionally documents C#, JavaScript, Python, and Rust SDKs. ([Microsoft Foundry SDK overview](https://learn.microsoft.com/en-us/azure/foundry/how-to/develop/sdk-overview)); Languages with a first-party client library. An empty list can still mean the product is usable from any language via an OpenAI-compatible SDK.

Additional charges

These are the fees that do not appear on a per-token price list, and they are where estimates usually go wrong.

Region-pinned Managed Compute GPU deployments Billed per GPU-hour (A100, H100, H200, MI300 SKUs)
Provisioned throughput (PTU) Reserved capacity billed per PTU rather than per token

How pricing actually works

Mostly managed, with Foundry Local for on-device execution. Microsoft sets its own per-token prices rather than marking up a third party; Global Batch and Data Zone Batch deployments are 50% below the standard rate with a 24-hour completion target, and DeveloperTier deployments are cheap but capped at 24 hours with no SLA and no data-residency guarantee.

Common questions

Answered from the fields above, so these move when the catalog moves. Every figure quoted here appears in the specification with its source.

Does Azure AI Foundry charge a markup on model prices?

Azure AI Foundry does not resell other providers' models with a fee on top: inference is the product, so you pay its own published per-token rates. There is no separate routing charge to add to them.

Can Azure AI Foundry be self-hosted?

Yes. Azure AI Foundry can be run on your own infrastructure or used as a managed service. The licence is Proprietary.

Is Azure AI Foundry SOC 2 audited, and will it sign a HIPAA BAA?

A SOC 2 report is available for Azure AI Foundry and it will sign a HIPAA business associate agreement. It offers EU data residency. Each of these is linked to the vendor's own page in the compliance section below.

Does Azure AI Foundry retain your prompts?

Azure AI Foundry publishes a zero-data-retention position. Only metadata is logged — not prompt or response bodies. Logging can be turned off. It states that it does not train on customer data.

Can you use your own provider keys with Azure AI Foundry?

Azure AI Foundry does not publish whether you can supply your own upstream provider keys.

How many models does Azure AI Foundry support?

Azure AI Foundry states ~10,000 models. Vendor states "11K+ Foundry Models" / "over 11,000+ models", spanning Azure OpenAI, Microsoft, and partner catalogs. The figure on this page is dated and carries its source.

Official links

Independent coverage

Third-party analysis, walkthroughs and operator threads. We link criticism as readily as praise. Nothing here is written or published by the vendor, by a competitor listed on this site, or by an SEO content farm — how we vet these.

Written reviews and analysis 2

New vs Old Azure AI Foundry: How it affects your code blog.chiffers.com · Jun 2026 Practitioner maps the breaking changes between old and new Foundry projects at the code level (azure-ai-projects 2.x, AIProjectClient, Responses vs Assistants API).
Azure AI Foundry Agent Service GA Introduces Multi-Agent Workflows InfoQ · May 2025 InfoQ's Steef-Jan Wiggers details what GA changed in Foundry's agent service - connected agents, SDK surface, A2A support - rather than restating Microsoft's messaging.

Video 1

Azure AI Foundry Overview YouTube - John Savill's Technical Training · Mar 2025 Independent Azure trainer walks the Foundry portal, model catalog, playground, evaluations and agents, flagging where the abstraction leaks.

Practitioner discussion 2

Azure AI Foundry: GPT-4o to GPT-5.1 migration changed our RAG agent's response style Reddit - r/AZURE · Aug 2026 13-comment migration thread with concrete constraints: datazone-standard deployments lacking GPT-5.1, and quota/capacity negotiations through account managers.
Azure AI Foundry is awful Reddit - r/ArtificialInteligence · Sep 2025 12-comment complaint thread with specifics: an agent silently losing its AI Search tool connection and 800k-token context configuration problems.

What has changed here

Aug 29, 2026 catalog entry catalog entry Not published Added to the catalog source ↗

See this in the full changelog Back to top ↑

Read the head-to-head

These pairs have a written verdict, not just a table.

Azure AI Foundry vs Amazon Bedrock Read the verdict →

Usually weighed against

Azure AI Foundry vs Amazon Bedrock Compare → Azure AI Foundry vs Cloudflare AI Gateway Compare → Azure AI Foundry vs Google Vertex AI Compare →