Chapter 1 of 6
Module scope#
What we will do#
Objective. Deploy one staged Azure Policy initiative for Microsoft Foundry and Azure AI services resources.
The module creates a custom deployment-SKU policy, groups it with verified built-ins, assigns the initiative to the approved scope in DoNotEnforce, and checks policy states by reference ID. After owner review, the same assignment can move selected references to Deny or DeployIfNotExists.
Why it matters#
Problem. Teams can harden one resource and still miss the next one. Policy drift also hides when local keys, open network settings, weak content filters, or missing diagnostics return after a manual change.
Solution. One version-controlled assignment gives the platform owner a shared view before enforcement. The first pass audits. The promotion pass changes only the approved references.
EU AI Act. For high-risk AI systems, this module supports Article 9 (risk management) with content-filter minimums, Article 12 (record-keeping) with diagnostic logs, and Article 15 (cybersecurity) with the authentication and network guardrails. This is an engineering mapping, not legal advice.
Boundaries#
This module sits outside the numbered session sequence.
It changes Azure Policy definitions and one assignment for the approved Foundry and Azure AI services scope. Azure Policy remains the source of live compliance state. The repository owns the policy definitions, parameters, and decision record.
It does not replace landing-zone tags and locations from Session 01, private networking from Session 02, model approval from Session 03, or policy promotion flow from Session 12.
Module preparation
Who should join
- AI platform engineers
- Azure Policy and landing-zone engineers
- Security, compliance, and operations owners for Microsoft Foundry resources
- Release owners who promote policy assignments from audit to enforcement
What you need
- The approved subscription scope for Microsoft Foundry and Azure AI services resources is recorded.
- The deployment operator can run subscription-scope Bicep what-if and has time-bound Resource Policy Contributor on the approved policy deployment scope.
- A Log Analytics workspace exists for diagnostic logs, and the owner can approve the assignment identity's required workspace access before remediation.
- The platform policy owner, compliance review owner, data-residency owner, and promotion authority can review current Azure Policy states together.
- Sessions 01, 02, 03, and 12 decisions are available so this module does not replace landing-zone, networking, model-approval, or promotion controls.