Securing the Network
Network Security Options
| Option | Security Level | Use Case |
|---|
| Public Access | Low | Development, POCs |
| IP Allowlisting | Medium | Known client IPs |
| Private Endpoints | High | Production, compliance |
| Managed VNet | Highest | Full network isolation |
Data Encryption
- At rest — AES-256 encryption (Microsoft-managed or Customer-Managed Keys)
- In transit — TLS 1.2+ for all API communications
- Customer-Managed Keys (CMK) — Store your own keys in Azure Key Vault
Governance at Scale
Use Azure Policy to enforce organization-wide standards:
- Restrict allowed regions for data residency
- Enforce private endpoints on all Foundry resources
- Require specific content filter configurations
- Block deployment of unapproved models
💡 Key Insight: Deploy using Infrastructure as Code (Bicep or Terraform) to ensure consistent, auditable security configurations across all environments.