Question

Your team is deploying an Azure AI Foundry hub and project for a regulated financial workload. Security policy requires that no data traverses the public internet: both inbound access to the hub and the hub's outbound connections to its dependent Azure resources (Storage, Key Vault, Container Registry) must stay on the Microsoft backbone. You need to configure the Foundry hub's networking so these requirements are met with the least ongoing management overhead. Which configuration should you choose?

Accepted Answer

Configure the hub with a managed virtual network in 'Allow Only Approved Outbound' mode, add private endpoints for inbound access, and create private endpoint outbound rules to the dependent resources.

Answer

Enable a managed virtual network on the hub in 'Allow Internet Outbound' mode and add a private endpoint only for inbound access.

Answer

Leave the hub on public network access, but restrict access using a resource firewall with IP allow-lists for the corporate network ranges.

Answer

Deploy the hub into a customer-managed virtual network and rely on network security group (NSG) rules to block all outbound public traffic.