How to setup Azure AI Foundry / Microsoft Foundry
Azure AI Foundry Setup Guide
With the Azure AI Foundry provider, you connect your own Azure deployments, and Bsure uses your endpoint and key to send questions to your models and return the answer inside the app. The models run in your Azure subscription, under your billing and your contract with Microsoft. See AI Chat for the bring-your-own-key model that applies to both providers.
Azure AI Foundry was previously called Azure AI Foundry / Azure OpenAI. GPT-5.4 and GPT-5.4 mini are part of the OpenAI family of "Models sold by Azure" in the catalog. Because these are Azure-direct models, you do not need an Azure Marketplace subscription to deploy them, unlike partner models such as Claude or Llama.
Before you start
In addition to the common prerequisites, you will need:
An Azure subscription with a valid payment method.
Permission in Azure to create resources and deploy models. For deployment this is the Cognitive Services Contributor role, or equivalent permissions on the Foundry resource.
Confirm the model you want is available in your chosen Azure region. Availability and tokens-per-minute quota are assigned per region and per model. See "Region availability for Foundry Models" in the Azure docs if exact quota matters.
Part 1: Deploy your models in Azure AI Foundry
You deploy two models so AI Chat can use a capable model for answers and a smaller, cheaper one for lightweight internal steps. For example, deploy gpt-5.5 for higher-quality tasks and gpt-5.4-mini for faster classification. Both live under the same Foundry resource and share one endpoint.
Create a Foundry resource and project
Go to the Foundry portal at ai.azure.com and sign in with your Azure account.
Make sure the New Foundry toggle is on, so you are using the current portal rather than the classic one.
Create a new project. When the project is provisioned, a Foundry resource is created and connected to it automatically. This resource hosts your model deployments and gives you a single inference endpoint.
If you prefer to start from the Azure portal, search for the Foundry (or Azure OpenAI) resource type, select Create, fill in the Basics tab (subscription, resource group, region, name, pricing tier), then open the resource in the Foundry portal to deploy models.
Find the model in the catalog
From the Foundry portal homepage, select Discover in the top navigation, then Models in the left pane.
Search for
gpt-5.5, then for your mini model, for examplegpt-5.4-mini.Select a model to open its model card, where you can review capabilities, context window, region availability, and pricing.
Deploy the model
On the model card, select Deploy. Choose Deploy with default settings, or Deploy with custom settings to customize.
Choose a deployment type. Each type offers different data residency or throughput guarantees. Global Standard is the typical serverless option, and the simplest, most cost-effective starting point for most workloads.
Set the deployment name. By default it matches the model name. Keep it the same as the model name (for example,
gpt-5.4-mini) so your configuration stays readable. This deployment name is what you enter in Bsure, not the raw model identifier.Confirm your project and resource are in a region that supports the model, then select Deploy.
Wait until the status shows Succeeded. You then land in the Foundry Playground, where you can test the model interactively.
Repeat this step for your second model, so you have both an expert deployment and a mini deployment ready.
Get your endpoint and key
In the Foundry portal, open Models + endpoints (or the resource Overview) to find the endpoint URL and credentials. Each Foundry resource has a single inference endpoint, and the same endpoint serves every deployment under that resource.
The endpoint looks like https://<resource>.services.ai.azure.com/. Copy the endpoint and one of the keys. You will paste both into Bsure in Part 2.
Part 2: Configure AI Chat in Bsure
In Bsure, open System Settings → System and select the AI Chat tab.
Provider: select Azure AI Foundry.
Endpoint URL: paste your Foundry resource endpoint, for example
https://<resource>.services.ai.azure.com/. Bsure handles the inference route from there.Deployment (Expert): enter your deployment name for the capable model, for example
gpt-5.5. This is the deployment name from Part 1, step 3, not the catalog model identifier.Mini deployment (Classifier): enter the deployment name for the smaller model, for example
gpt-5.4-mini.API key: paste a key from your Foundry resource.
Click Validate. Bsure makes a test call to your endpoint with the key and deployment names. On success the field shows ✓ Confirmed with a short fingerprint of the key. The fingerprint confirms which key is stored without displaying the secret.
Click Save.
AI Chat is now active on Azure AI Foundry. The key is masked from now on, and only the fingerprint is shown.
Azure requires the deployment name in the model parameter, not the raw model name. If Validate fails on an otherwise correct endpoint and key, the most common cause is a deployment name that does not exactly match what you set in Azure.
Rotating or replacing the key
To rotate the key, on a schedule or after staff changes, regenerate a key on the Foundry resource (each resource has two keys, so you can rotate one while the other stays live), paste the new key into API key, Validate, and Save.
Data sharing
This section covers what data leaves your environment, where it goes, and how to put the right contract in place. It is written for a data protection officer or security lead as much as for an administrator.
Who is the processor
Because AI Chat uses your own Azure resource and Azure subscription, Microsoft processes the data under your organization's agreement with Microsoft, not under Bsure's. In data protection terms:
You (the customer) are the controller of your Microsoft 365 and Entra data.
Microsoft acts as a processor for the data sent to your Azure deployments, under your Microsoft Product Terms and Data Protection Addendum.
Bsure transmits your question and the supporting context to your endpoint using the key you provided, and returns the answer. Bsure does not hold a separate Azure contract on your behalf.
What data is sent to Azure
When you ask a question in AI Chat, the following is sent to your Azure endpoint:
The question text you type.
The context Bsure assembles to answer it, which may include governance data drawn from your tenant: for example, user and group attributes, role and permission assignments, license information, and sign-in and audit signals relevant to the question.
Data not sent to Azure:
Your API key, which authenticates the call and is not part of the prompt content.
Credentials, secrets, and Bsure's own configuration.
Answers can include personal data about users in your tenant. Treat AI Chat prompts as personal-data processing and document them in your records of processing, with a DPIA if your risk assessment calls for one.
How Azure handles your data
The points below reflect Microsoft's published policy for Azure OpenAI in Foundry Models. Verify the current terms against the linked Azure documentation before relying on them.
No training on your data. Your prompts and completions are not used to train Microsoft, OpenAI, or third-party models.
Data stays in your resource. Inputs and outputs are processed within your Azure resource and are not shared with OpenAI.
Abuse-monitoring retention. By default, prompts and completions may be stored for up to 30 days for abuse and misuse monitoring, then deleted. Eligible customers can apply for modified abuse monitoring to disable this storage.
Regional processing. Choosing a deployment type such as a regional or data-zone deployment lets you control where data is processed for residency requirements.
Recommended controls
Prefer Entra ID authentication (managed identity with
DefaultAzureCredential) over a static key for any long-lived integration, so keys do not leak into config or CI. Use the key path for a quick start, then move to Entra ID.Review the content filter settings on each deployment. The default thresholds are a reasonable baseline, but production chatbots usually want them tightened.
Set quota and budget alerts on the Azure resource to cap cost and contain abuse of a leaked key.
Record AI Chat in your processing inventory and assess the need for a DPIA.
Troubleshooting
Validate fails immediately
Wrong key, key regenerated, or pasted with extra spaces
Re-copy a current key from the Foundry resource and paste again
Validate fails on a correct endpoint and key
Deployment name does not match the name set in Azure
Use the exact deployment name from Azure, not the catalog model id
Validate fails with an endpoint error
Wrong endpoint, or the resource is in a region without quota
Re-copy the endpoint from Models + endpoints, confirm region and quota
Validate succeeds but chat returns errors
Deployment not yet Succeeded, or out of quota
Confirm the deployment status, then check tokens-per-minute quota for the model
Chat works, then stops
Key regenerated, or quota exhausted
Paste a current key and revalidate, then review the resource quota
Sources and further reading
Last updated
Was this helpful?