Question

Your team is deploying an Azure AI Foundry project that processes confidential legal documents. Compliance requires that all traffic to the deployed model endpoint and the associated Azure AI Search resource never traverse the public internet, and that no data leaves the corporate virtual network. Which infrastructure design should you implement for the Foundry hub and its dependent resources?

Accepted Answer

Configure private endpoints for the Foundry hub, model endpoints, and Azure AI Search, disable public network access, and route traffic through the corporate VNet with private DNS zones

Answer

Enable keyless authentication with managed identity and restrict access using IP firewall allowlists on each resource

Answer

Deploy the model to a public endpoint but enforce TLS 1.2 and rotate access keys every 30 days

Answer

Place all resources in the same Azure region and rely on service tags in a network security group to block outbound internet traffic