> For the complete documentation index, see [llms.txt](https://docs.bsure.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bsure.io/user-guides/settings/system/ai-chat/how-to-setup-azure-ai-foundry-microsoft-foundry.md).

# How to setup Azure AI Foundry / Microsoft Foundry

## Azure AI Foundry Setup Guide

With the **Azure AI Foundry** provider, you connect your own Azure deployments, and Bsure uses your endpoint and key to send questions to your models and return the answer inside the app. The models run in **your** Azure subscription, under **your** billing and **your** contract with Microsoft. See [AI Chat](broken://pages/a64e66d68ec14793a3f534153050ef5d2d279963) for the bring-your-own-key model that applies to both providers.

{% hint style="info" %}
Azure AI Foundry was previously called Azure AI Foundry / Azure OpenAI. GPT-5.4 and GPT-5.4 mini are part of the OpenAI family of "Models sold by Azure" in the catalog. Because these are Azure-direct models, you do **not** need an Azure Marketplace subscription to deploy them, unlike partner models such as Claude or Llama.
{% endhint %}

***

### Before you start

In addition to the [common prerequisites](broken://pages/a64e66d68ec14793a3f534153050ef5d2d279963), you will need:

* **An Azure subscription** with a valid payment method.
* **Permission in Azure** to create resources and deploy models. For deployment this is the **Cognitive Services Contributor** role, or equivalent permissions on the Foundry resource.

{% hint style="warning" %}
Confirm the model you want is available in your chosen Azure **region**. Availability and tokens-per-minute quota are assigned per region and per model. See "Region availability for Foundry Models" in the Azure docs if exact quota matters.
{% endhint %}

***

### Part 1: Deploy your models in Azure AI Foundry

You deploy two models so AI Chat can use a capable model for answers and a smaller, cheaper one for lightweight internal steps. For example, deploy `gpt-5.5` for higher-quality tasks and `gpt-5.4-mini` for faster classification. Both live under the same Foundry resource and share one endpoint.

{% stepper %}
{% step %}

#### Create a Foundry resource and project

1. Go to the Foundry portal at [ai.azure.com](https://ai.azure.com/) and sign in with your Azure account.
2. Make sure the **New Foundry** toggle is on, so you are using the current portal rather than the classic one.
3. Create a new **project**. When the project is provisioned, a Foundry resource is created and connected to it automatically. This resource hosts your model deployments and gives you a single inference endpoint.

If you prefer to start from the Azure portal, search for the Foundry (or Azure OpenAI) resource type, select **Create**, fill in the **Basics** tab (subscription, resource group, region, name, pricing tier), then open the resource in the Foundry portal to deploy models.
{% endstep %}

{% step %}

#### Find the model in the catalog

1. From the Foundry portal homepage, select **Discover** in the top navigation, then **Models** in the left pane.
2. Search for `gpt-5.5`, then for your mini model, for example `gpt-5.4-mini`.
3. Select a model to open its **model card**, where you can review capabilities, context window, region availability, and pricing.
   {% endstep %}

{% step %}

#### Deploy the model

1. On the model card, select **Deploy**. Choose **Deploy with default settings**, or **Deploy with custom settings** to customize.
2. Choose a **deployment type**. Each type offers different data residency or throughput guarantees. **Global Standard** is the typical serverless option, and the simplest, most cost-effective starting point for most workloads.
3. Set the **deployment name**. By default it matches the model name. Keep it the same as the model name (for example, `gpt-5.4-mini`) so your configuration stays readable. **This deployment name is what you enter in Bsure**, not the raw model identifier.
4. Confirm your project and resource are in a region that supports the model, then select **Deploy**.
5. Wait until the status shows **Succeeded**. You then land in the Foundry Playground, where you can test the model interactively.

Repeat this step for your second model, so you have both an expert deployment and a mini deployment ready.
{% endstep %}

{% step %}

#### Get your endpoint and key

In the Foundry portal, open **Models + endpoints** (or the resource **Overview**) to find the endpoint URL and credentials. Each Foundry resource has a **single** inference endpoint, and the same endpoint serves every deployment under that resource.

The endpoint looks like `https://<resource>.services.ai.azure.com/`. Copy the endpoint and one of the keys. You will paste both into Bsure in Part 2.
{% endstep %}
{% endstepper %}

***

### Part 2: Configure AI Chat in Bsure

1. In Bsure, open **System Settings → System** and select the **AI Chat** tab.
2. **Provider**: select **Azure AI Foundry**.
3. **Endpoint URL**: paste your Foundry resource endpoint, for example `https://<resource>.services.ai.azure.com/`. Bsure handles the inference route from there.
4. **Deployment (Expert)**: enter your **deployment name** for the capable model, for example `gpt-5.5`. This is the deployment name from Part 1, step 3, not the catalog model identifier.
5. **Mini deployment (Classifier)**: enter the deployment name for the smaller model, for example `gpt-5.4-mini`.
6. **API key**: paste a key from your Foundry resource.
7. Click **Validate**. Bsure makes a test call to your endpoint with the key and deployment names. On success the field shows **✓ Confirmed** with a short fingerprint of the key. The fingerprint confirms which key is stored without displaying the secret.
8. Click **Save**.

AI Chat is now active on Azure AI Foundry. The key is masked from now on, and only the fingerprint is shown.

{% hint style="danger" %}
Azure requires the **deployment name** in the model parameter, not the raw model name. If Validate fails on an otherwise correct endpoint and key, the most common cause is a deployment name that does not exactly match what you set in Azure.
{% endhint %}

#### Rotating or replacing the key

To rotate the key, on a schedule or after staff changes, regenerate a key on the Foundry resource (each resource has two keys, so you can rotate one while the other stays live), paste the new key into **API key**, **Validate**, and **Save**.

***

### Data sharing

This section covers what data leaves your environment, where it goes, and how to put the right contract in place. It is written for a data protection officer or security lead as much as for an administrator.

#### Who is the processor

Because AI Chat uses **your own Azure resource and Azure subscription**, Microsoft processes the data under **your organization's agreement with Microsoft**, not under Bsure's. In data protection terms:

* **You** (the customer) are the **controller** of your Microsoft 365 and Entra data.
* **Microsoft** acts as a **processor** for the data sent to your Azure deployments, under your Microsoft Product Terms and Data Protection Addendum.
* **Bsure** transmits your question and the supporting context to your endpoint using the key you provided, and returns the answer. Bsure does not hold a separate Azure contract on your behalf.

#### What data is sent to Azure

When you ask a question in AI Chat, the following is sent to your Azure endpoint:

* The **question text** you type.
* The **context Bsure assembles** to answer it, which may include governance data drawn from your tenant: for example, user and group attributes, role and permission assignments, license information, and sign-in and audit signals relevant to the question.

Data **not** sent to Azure:

* Your API key, which authenticates the call and is not part of the prompt content.
* Credentials, secrets, and Bsure's own configuration.

Answers can include personal data about users in your tenant. Treat AI Chat prompts as personal-data processing and document them in your records of processing, with a DPIA if your risk assessment calls for one.

#### How Azure handles your data

The points below reflect Microsoft's published policy for **Azure OpenAI in Foundry Models**. Verify the current terms against the linked Azure documentation before relying on them.

* **No training on your data.** Your prompts and completions are not used to train Microsoft, OpenAI, or third-party models.
* **Data stays in your resource.** Inputs and outputs are processed within your Azure resource and are not shared with OpenAI.
* **Abuse-monitoring retention.** By default, prompts and completions may be stored for up to 30 days for abuse and misuse monitoring, then deleted. Eligible customers can apply for **modified abuse monitoring** to disable this storage.
* **Regional processing.** Choosing a deployment type such as a regional or data-zone deployment lets you control where data is processed for residency requirements.

#### Recommended controls

* Prefer **Entra ID** authentication (managed identity with `DefaultAzureCredential`) over a static key for any long-lived integration, so keys do not leak into config or CI. Use the key path for a quick start, then move to Entra ID.
* Review the **content filter** settings on each deployment. The default thresholds are a reasonable baseline, but production chatbots usually want them tightened.
* Set **quota and budget alerts** on the Azure resource to cap cost and contain abuse of a leaked key.
* Record AI Chat in your **processing inventory** and assess the need for a **DPIA**.

***

### Troubleshooting

| Symptom                                      | Likely cause                                                 | Fix                                                                             |
| -------------------------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------------------------- |
| **Validate** fails immediately               | Wrong key, key regenerated, or pasted with extra spaces      | Re-copy a current key from the Foundry resource and paste again                 |
| Validate fails on a correct endpoint and key | Deployment name does not match the name set in Azure         | Use the exact **deployment name** from Azure, not the catalog model id          |
| Validate fails with an endpoint error        | Wrong endpoint, or the resource is in a region without quota | Re-copy the endpoint from **Models + endpoints**, confirm region and quota      |
| Validate succeeds but chat returns errors    | Deployment not yet **Succeeded**, or out of quota            | Confirm the deployment status, then check tokens-per-minute quota for the model |
| Chat works, then stops                       | Key regenerated, or quota exhausted                          | Paste a current key and revalidate, then review the resource quota              |

***

### Sources and further reading

* [Azure AI Foundry documentation](https://learn.microsoft.com/azure/ai-foundry/)
* [Deploy models in Azure AI Foundry](https://learn.microsoft.com/azure/ai-foundry/how-to/deploy-models-openai)
* [Data, privacy, and security for Azure OpenAI](https://learn.microsoft.com/azure/ai-foundry/responsible-ai/openai/data-privacy)
* [Region availability for Foundry Models](https://learn.microsoft.com/azure/ai-foundry/foundry-models/concepts/models)
* [Authenticate with Entra ID and DefaultAzureCredential](https://learn.microsoft.com/azure/ai-services/authentication)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bsure.io/user-guides/settings/system/ai-chat/how-to-setup-azure-ai-foundry-microsoft-foundry.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.