Chapter 4 of 6
Decisions and stop conditions#
Estate scope#
Choose management groups, not a list of subscriptions. A subscription list goes stale the moment someone creates a subscription, which is the case this session exists to catch.
Stop if the accountable governance team does not own every listed management group, or if a management group is listed that the operator cannot read.
In-scope account kinds#
inScopeAccountKinds starts with AIServices and OpenAI. Those are the account kinds behind Microsoft Foundry and Azure OpenAI. Every other Cognitive Services kind lands in the adjacent list.
Do not widen this list to silence the adjacent report. Widening it says those accounts are part of the governed AI estate and must carry the required tags.
Stop if a kind is added without an owner accepting the tag and region requirements for those accounts.
Required tags#
Use the exact tag keys set by the platform baseline. The owner tag and the cost tag must both appear in requiredTagKeys; preflight rejects a record where they do not, because the report depends on both.
Stop if the tag keys differ from the platform-baseline policy, since the report would then disagree with the guardrail assignment.
Lifecycle review#
Set lifecycleOwner to the role that can start a model replacement or service-retirement response. Set modelRetirementWarningDays to the minimum lead time needed to evaluate and deploy a replacement. The default is 90 days.
The Models API is authoritative for a deployed model's catalog lifecycle and retirement data. Service Health announces affected-service retirement advisories. Azure Advisor can identify affected resources. These are live signals, not approval records.
Stop the review when a deployment is absent from the regional Models API response, is deprecated or retired, or retires inside the warning period. Also stop when the report returns a matching Service Health advisory or Advisor recommendation. The lifecycle owner records the replacement, retirement, or accepted exception through the customer change process.
Exceptions#
A recorded exception needs an account name, a reason, a named owner, and an expiry date. It stops one account from producing a finding. It does not remove the account from the report.
Stop if an exception has no expiry, or if the exception list is growing faster than the findings list is shrinking. That pattern means the scope record is wrong, not the estate.
What a finding means#
A finding is an account that needs a human decision: tag it, move it, bring it into the approved path, or record an exception. The report exits with a failure while any finding is open.
Stop the review, rather than the report, when a finding has no owner. An unowned Azure AI account is the finding.