FAI Azure AI Foundry Setup

Provisions an Azure AI Foundry Hub and Project using Infrastructure as Code, with correct RBAC, private networking, and connected resource topology. Prevents the most common setup mistakes: missing role assignments that cause silent access failures, public endpoints left open after networking is locked down, and disconnected AI Services that break Prompt Flow.

When to Invoke

Workflow

Step 1 — Bicep Template (Hub + Project)

// infra/ai-foundry.bicep
param location string = resourceGroup().location
param hubName string
param projectName string
param keyVaultId string
param storageAccountId string
param aiServicesId string

// AI Foundry Hub
resource hub 'Microsoft.MachineLearningServices/workspaces@2024-04-01' = {
  name: hubName
  location: location
  kind: 'Hub'
  identity: { type: 'SystemAssigned' }
  sku: { name: 'Basic', tier: 'Basic' }
  properties: {
    friendlyName: hubName
    keyVault: keyVaultId
    storageAccount: storageAccountId
    publicNetworkAccess: 'Disabled'
    managedNetwork: { isolationMode: 'AllowOnlyApprovedOutbound' }
  }
}

// AI Foundry Project (child of Hub)
resource project 'Microsoft.MachineLearningServices/workspaces@2024-04-01' = {
  name: projectName
  location: location
  kind: 'Project'
  identity: { type: 'SystemAssigned' }
  sku: { name: 'Basic', tier: 'Basic' }
  properties: {
    hubResourceId: hub.id
    friendlyName: projectName
  }
}

// Connected AI Services resource (Managed Identity auth -- no API key stored)
resource connection 'Microsoft.MachineLearningServices/workspaces/connections@2024-04-01' = {
  parent: hub
  name: 'azure-ai-services'
  properties: {
    category: 'AzureOpenAI'
    authType: 'ManagedIdentity'
    target: reference(aiServicesId, '2023-05-01').properties.endpoint
  }
}

output hubPrincipalId string = hub.identity.principalId
output projectName string = project.name

Step 2 — RBAC Role Assignments

// Role assignments -- Hub MSI needs access to connected resources
var cogServiceUserRoleId     = 'a97b65f3-24c7-4dca-a6f8-7efbf3d41ef0'
var storageBlobContribRoleId = 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
var kvSecretsUserRoleId      = '4633458b-17de-408a-b874-0445c86b69e0'

resource hubKeyVaultRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(keyVaultId, hub.id, kvSecretsUserRoleId)
  scope: resourceGroup()
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', kvSecretsUserRoleId)
    principalId: hub.identity.principalId
    principalType: 'ServicePrincipal'
  }
}

resource hubAiServicesRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(aiServicesId, hub.id, cogServiceUserRoleId)
  scope: resourceGroup()
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', cogServiceUserRoleId)
    principalId: hub.identity.principalId
    principalType: 'ServicePrincipal'
  }
}

resource hubStorageRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(storageAccountId, hub.id, storageBlobContribRoleId)
  scope: resourceGroup()
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', storageBlobContribRoleId)
    principalId: hub.identity.principalId
    principalType: 'ServicePrincipal'
  }
}

Step 3 — Private Endpoint Configuration

// Private endpoint for Hub workspace
resource hubPrivateEndpoint 'Microsoft.Network/privateEndpoints@2023-04-01' = {
  name: '${hubName}-pe'
  location: location
  properties: {
    subnet: { id: privateSubnetId }
    privateLinkServiceConnections: [{
      name: '${hubName}-plsc'
      properties: {
        privateLinkServiceId: hub.id
        groupIds: ['amlworkspace']
      }
    }]
  }
}

Step 4 — Verify Setup with Python SDK

from azure.ai.ml import MLClient
from azure.identity import DefaultAzureCredential

client = MLClient(
    credential=DefaultAzureCredential(),
    subscription_id=SUBSCRIPTION_ID,
    resource_group_name=RESOURCE_GROUP,
    workspace_name=PROJECT_NAME,
)

# Verify workspace access
ws = client.workspaces.get(PROJECT_NAME)
print(f"Workspace: {ws.name}, Hub: {ws.hub_resource_id}")

# List available model deployments via connections
connections = list(client.connections.list())
for conn in connections:
    print(f"  {conn.name}: {conn.type} -> {conn.target}")

Step 5 — Initialize Prompt Flow Environment

# Install Prompt Flow CLI
pip install promptflow promptflow-azure

# Connect to the project
pf config set connection.provider=azureml://subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.MachineLearningServices/workspaces/${PROJECT_NAME}

# List available connections
pf connection list

# Run a quick end-to-end test
pf flow run --flow ./flows/chat-basic --data ./flows/test-data.jsonl

RBAC Reference

WAF Alignment

Compatible Solution Plays

• Play 01 — Enterprise RAG (AI Search + OpenAI connections)
• Play 13 — Fine-Tuning Workflow (compute + dataset management)
• Play 02 — AI Landing Zone (Hub inside spoke network)

Notes

• Hub must be created before Project -- kind: 'Hub' vs kind: 'Project'
• managedNetwork.isolationMode: 'AllowOnlyApprovedOutbound' is required for HIPAA/PCI compliance
• Wait ~5 minutes after Bicep deploy for Managed Network provisioning to complete before creating connections
• Private endpoint DNS zone *.api.azureml.ms must be linked to the Hub's VNet