RVAP, Real Value Acceleration Program

RVAS · Microsoft AI governance

Build the control. Grow the capability.

Customer engineers learn AI governance by implementing controls in a sandbox or nonproduction tenant. The people who will operate them make the decisions, run the check, and keep the files.

Browse the sessions Compare routes
14
Sessions
53
Working hours
3
Phases

Session catalog

Browse all 14 sessions.

Use a focused route, a service filter, or text search. The selected route or service stays in the URL, so you can share the filtered view.

Times cover hands-on work in a sandbox or non-production tenant. They exclude production rollout, approvals, procurement, and customer-specific integration.

Architecture-specific extensions stay outside this filter and the 14-session count.

Filter by focused route

Choose the control path you need. Agent 365 routes can start with an existing approved agent.

Compare routes

Filter by tool

Choose one tool. Counts show matching numbered sessions.

View service map
14 sessions shown
1–5Governed foundation5 sessions
1 Governed foundation Microsoft Foundry platform baseline, inventory, and landing-zone guardrails Deploy an owned Microsoft Foundry baseline with workspace-based Application Insights, then stage resource-group guardrails before approved enforcement.
5 hours in a non-production POC 2 Governed foundation Private networking, DNS, and controlled egress Connect the existing Foundry account and four customer-provided dependencies through private endpoints, then disable public access after private DNS and TCP 443 checks succeed from the approved nonproduction execution host.
3 hours in a non-production POC 3 Governed foundation Model governance, data residency, quota, and lifecycle Record each approved model, deploy its exact serverless API version through version-controlled profiles and Bicep, then assign the built-in Foundry model-deployment policies from the same approval register.
5.5 hours in a non-production POC 4 Governed foundation Governed Microsoft Foundry agent baseline Create and pin a versioned prompt agent. Its unique Entra Agent Identity identifies the agent and secures the endpoint. The Foundry project managed identity authorizes the approved read-only OpenAPI tool. Keep write operations out of the tool definition, apply the RAI policy, and enable server-side tracing.
2.5 hours in a non-production POC 5 Governed foundation Microsoft Agent 365 secure rollout and data controls Configure a scoped Microsoft Purview DLP policy. After it is enabled and propagated, install one approved nonproduction Agent Registry agent for its test group, check included and excluded access, and query payload-free Agent 365 audit activity.
4.5 hours in a non-production POC
6–12Control live AI traffic7 sessions
6 Runtime assurance Azure API Management AI gateway design and implementation Record the gateway design, deploy one controlled Azure API Management route for the pinned Foundry agent, and confirm that APIM rejects an invalid bearer identity before it calls Content Safety or Foundry.
4.5 hours in a non-production POC 7 Runtime assurance Azure API Center and the AI/MCP inventory Add three selected assets to API Center: deploy the Session 04 agent API, synchronize the Session 06 APIM API, and register an approved remote MCP server. Record owner, lifecycle, classification, risk, review, and runtime-location metadata for each.
3 hours in a non-production POC 8 Runtime assurance MCP and tool security Configure an MCP path that exposes only get_policy, validates the candidate agent at APIM, uses APIM's read-only managed identity for the backend, and emits payload-free telemetry. Keep the prior version active until the release owner sees both checks.
3.5 hours in a non-production POC 9 Runtime assurance Foundry evaluations and release quality gates Run `release-gate.py` for fixed agent versions with repeatable evaluation results from a recorded Foundry evaluation definition.
4 hours in a non-production POC 10 Runtime assurance Red teaming, prompt injection, and Defender Compare authorized adversarial results for the baseline and fixed version remediated before the session, then confirm the Defender-to-SOC route.
4 hours in a non-production POC 11 Runtime assurance Observability, cost, and operational controls Deploy privacy-safe operating controls for one governed service. Correlate supported runtime spans, route alerts, notify owners at budget thresholds, and follow incident paths with named owners.
3.5 hours in a non-production POC 12 Runtime assurance CI/CD, policy as code, and controlled promotion Promote one immutable, gate-passing release through protected nonproduction and production environments. Tie approval, deployment, routing, and restore to the same commit SHA.
4 hours in a non-production POC
13–14Operate at scale2 sessions
13 Operate at scale Regional failover rehearsal for a governed AI service Rehearse failover for one governed AI service. Preview and approve one selector move to the deployed secondary path. Check it, then restore and check the primary path.
3 hours in a non-production POC 14 Operate at scale Foundry estate and lifecycle operations Deploy an Azure Workbook and run an estate report that reads every Azure AI account across the approved management groups, checks each in-scope deployment against the live Models API, and reports estate, model lifecycle, Service Health, and Azure Advisor retirement findings.
3 hours in a non-production POC

Choose the implementation path you need.

Full-platform routes start at Session 01. Agent 365 routes can enter with an approved Foundry, Copilot Studio, or Agent Builder agent.

Complete build · 53 working hours

Run all 14 sessions, from the platform baseline through fleet estate and lifecycle operations.

  1. 1–5 Governed foundation
  2. 6–12 Live AI traffic controls
  3. 13–14 Operate at scale
Browse all sessions

Focused routes

FoundationLive trafficOperations
Governed pilotSessions 01–04 A versioned Foundry agent with its platform, identity, networking, and model controls in place. Session 01Session 04 4 sessions16 hoursShow this route Secure private platformSessions 01–04 + 06 The governed agent runs through API Management with identity, limits, and content safety applied at the gateway. Session 01Session 06 5 sessions20.5 hoursShow this route API and MCP governanceSessions 01–04 + 06–08 API and MCP inventory, authorization, tool scope, and runtime telemetry are connected around the governed agent. Session 01Session 08 7 sessions27 hoursShow this route Data and complianceSessions 01–05 The governed runtime adds Purview data controls and an owned handoff for Agent 365 and Foundry coverage. Session 01Session 05 5 sessions20.5 hoursShow this route Security operationsSessions 01–04 + 06–11 Evaluation, red-team, telemetry, cost, alerting, and incident controls are operating around the service. Session 01Session 11 10 sessions38.5 hoursShow this route LLMOps and release operationsSessions 01–04 + 06–13 The governed service moves through evaluation, operations, and protected promotion as one managed release path. Session 01Session 14 13 sessions48.5 hoursShow this route Foundry + Agent 365Sessions 01–05 Build a governed Foundry agent, register it with Agent 365, then apply the shared Purview data-control path. Session 01Session 05 5 sessions20.5 hoursShow this route Copilot Studio + Agent 365Sessions 05–05 Start with an approved published Copilot Studio agent, register its access boundary, then apply Agent 365 data controls. Session 05Session 05 1 sessions4.5 hoursShow this route Agent Builder + Agent 365Sessions 05–05 Start with an approved published Agent Builder agent, register its access boundary, then apply Agent 365 data controls. Session 05Session 05 1 sessions4.5 hoursShow this route

Sessions 12–13 define substitute baselines for teams that enter the series without every earlier session.

Architecture-specific extensions

Add architecture-specific work when you need it.

Optional module Azure API Center registry discovery for approved MCP servers Configure Microsoft Entra-protected Azure API Center MCP registry discovery for MCP servers at the approved `Production` lifecycle stage and check that the registry returns only approved server names.
2.5h Optional module External agent inventory in Microsoft Agent 365 Onboard an existing external agent into Microsoft Agent 365 through one supported integration route, record the route, credential, owner, and retirement decisions, then review the live Agent Registry record.
2.5h Optional module API Center private tool catalog to Foundry Toolbox Connect an approved remote MCP server in Azure API Center to a dedicated versioned Toolbox in Microsoft Foundry, then compare the catalog record, project connection, allowed tool, and live Toolbox tool list.
3h Optional module Delegated API access with OAuth on-behalf-of A trusted middle tier preserves signed-in user authority through an OBO exchange, while the downstream API still authorizes each user.
4.5h