Microsoft Foundry allows you to deploy models with different deployment types. Each deployment type determines where and how your model deployment will run. Global Standard processes data across multiple regions, while Datazone Standard and Standard keep data in-region. Many organizations, at least here in the EU, have a requirement that only allows processing of data within the EU. In this case, you would want to restrict the deployment types to only allow Datazone Standard and Standard, as Global Standard is not allowed. More details on the different deployment types can be found in the Deployment Type comparison.
Restricting deployment types
One way to restrict the deployment types is by using Azure Policy. Azure Policy allows you to create policies that can be assigned to different scopes, such as subscriptions, resource groups or management groups. In this case we will create a policy that restricts the deployment types for Foundry models.
This can be done using an Azure Policy definition that looks like this:
{
"name": "foundry-deployment-types-allowlist",
"properties": {
"displayName": "Allowed Microsoft Foundry deployment types",
"policyType": "Custom",
"mode": "All",
"description": "Allows only configured deployment types for Microsoft.CognitiveServices/accounts/deployments resources.",
"metadata": {
"category": "Cognitive Services",
"version": "1.0.0"
},
"parameters": {
"allowedDeploymentTypes": {
"type": "Array",
"metadata": {
"displayName": "Allowed deployment type names",
"description": "The Microsoft Foundry deployment type names that are allowed. Deployments using any other deployment type are denied or audited depending on the effect."
},
"defaultValue": [
"DataZoneStandard",
"Regional"
]
},
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable deny enforcement, audit-only reporting, or disable the policy."
},
"allowedValues": [
"Audit",
"Deny",
"Disabled"
],
"defaultValue": "Deny"
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.CognitiveServices/accounts/deployments"
},
{
"not": {
"field": "Microsoft.CognitiveServices/accounts/deployments/sku.name",
"in": "[parameters('allowedDeploymentTypes')]"
}
}
]
},
"then": {
"effect": "[parameters('effect')]"
}
}
}
}
Testing the policy
Once the policy is created, we can assign it to a scope; preferably at the Management Group or subscription level. After the policy is assigned, we can test it by trying to deploy a Foundry model with a deployment type that is not allowed. In this case, we will try to deploy a text-embedding-3-large model with the Global Standard deployment type, which is not allowed by our assigned policy. When we try to deploy the model in Global Standard, we will receive an error message indicating that the deployment type is not allowed:
Failed to create deploymentResource 'text-embedding-3-large' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Allowed Microsoft Foundry deployment types","id":"/providers/Microsoft.Authorization/policyAssignments/14705b77b53247618f6291bf"},"policyDefinition":{"name":"AAllowed Microsoft Foundry deployment types","id":"/providers/Microsoft.Authorization/policyDefinitions/foundry-deployment-types-allowlist","version":"1.0.0"}}]'.
When we deploy the same model with a Datazone Standard deployment type, which is allowed by our policy assignment, the deployment will succeed without any issues. This shows that our policy is working as expected and is restricting the deployment types for Foundry models.
Conclusion
With this policy we have an easy way to keep our Foundry model deployments in check. By restricting the deployment types we can ensure that our users are only able to deploy models that are compliant with our organization policies. It allows us to maintain compliance and at the same time still provide our users with the ability to deploy models that are allowed.