What's changed: Added per-section figures (cert-figure-retrofit). New AI-300 Chapter 3 (Domain 3 "GenAIOps infrastructure": Foundry environments = project/RBAC/managed identities/private networking/Bicep-CLI; foundation model deployment = serverless API endpoints vs managed compute/use-case model selection/versioning-deployment strategies/PTU; prompt versioning = design-develop/variant comparison/Git)
3.1Foundry environments and platform configuration
Understand creating and configuring Microsoft Foundry resources and project environments, identity and access management with managed identities and RBAC, network security and private networking, and deploying infrastructure with Bicep templates and the Azure CLI.
Operationalizing generative AI (GenAIOps) extends MLOps thinking to generative AI. The foundation is Microsoft Foundry (formerly Azure AI Foundry/Studio), which unifies selecting/deploying models and building, evaluating, and monitoring apps/agents. This section covers its infrastructure configuration.
3.1.1Foundry resources and project environments
Foundry organizes work by project to isolate and structure it. Create resources and project environments to centralize the model catalog, deployment, evaluation, and monitoring. Assign least-privilege access with RBAC, and use managed identities for Foundry/apps to access other resources (Storage, Key Vault, Azure OpenAI) without secrets. The same "least privilege + secretless" principle from MLOps applies to GenAIOps.
3.1.2Network security and IaC
Protect Foundry infrastructure with private networking (private endpoints / managed virtual networks) to limit public exposure and secure access to models and data. Deploy environments as code with Bicep templates and the Azure CLI for reproducibility and auditability, enabling fast, consistent GenAIOps foundations from dev to production.
| Goal | Means | Key point |
|---|---|---|
| Isolate/organize work | Foundry project | Centralize model/deploy/eval/monitor |
| Least-privilege access | RBAC | Built-in/specific roles |
| Secretless auth | Managed identity | Securely reach other resources |
| Limit public exposure | Private endpoints / managed VNet | Protect models/data |
| Codify environments | Bicep / Azure CLI | Reproducible, auditable |
Map requirement → means: "isolate work by project" = Foundry project; "grant least privilege" = RBAC; "reach Storage/Key Vault without secrets" = managed identity; "don’t expose Foundry publicly" = private endpoints; "reproduce environments as code" = Bicep/Azure CLI.
3.1.3Section summary
- GenAIOps foundation = Microsoft Foundry; organize work by project
- Least-privilege RBAC; secretless managed identities
- Protect with private networking; codify with Bicep/Azure CLI
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which platform is the GenAIOps foundation that unifies model selection, deployment, building, evaluation, and monitoring?
Q2. Which Foundry unit isolates/organizes work and centralizes model/deploy/eval/monitor?
Q3. Which lets Foundry or apps authenticate to Storage or Key Vault without secrets?
Q4. How do you protect Foundry infrastructure from public exposure and secure access to models/data?
Q5. Which deploys Foundry resources and environments reproducibly as code?
Q6. Which principle applies to GenAIOps infrastructure configuration?