Securing the Network
Network Security Options
| Option | Security Level | Use Case |
|---|
| Public Access | Low | Development, POCs |
| IP Allowlisting | Medium | Known client IPs |
| Private Endpoints | High | Production, compliance |
| Managed VNet | Highest | Full network isolation |
🆕 NEW (2026): Microsoft-managed VNET isolation is now Generally Available. This provides full network isolation managed entirely by Microsoft, removing the need for customers to configure and maintain their own VNet infrastructure for Foundry resources.
Data Encryption
- At rest — AES-256 encryption (Microsoft-managed or Customer-Managed Keys)
- In transit — TLS 1.2+ for all API communications
- Customer-Managed Keys (CMK) — Store your own keys in Azure Key Vault
Governance at Scale
Use Azure Policy to enforce organization-wide standards:
- Restrict allowed regions for data residency
- Enforce private endpoints on all Foundry resources
- Require specific content filter configurations
- Block deployment of unapproved models
💡 Key Insight: Deploy using Infrastructure as Code (Bicep or Terraform) to ensure consistent, auditable security configurations across all environments.