[ ABORT TO HUD ]
SEQ. 1
SEQ. 2
Networking & Data Protection
Securing the Network
Network Security Options
| Option | Security Level | Use Case |
|---|---|---|
| Public Access | Low | Development, POCs |
| IP Allowlisting | Medium | Known client IPs |
| Private Endpoints | High | Production, compliance |
| Managed VNet | Highest | Full network isolation |
🆕 NEW (2026): Microsoft-managed VNET isolation is now Generally Available. This provides full network isolation managed entirely by Microsoft, removing the need for customers to configure and maintain their own VNet infrastructure for Foundry resources.
Data Encryption
- At rest - AES-256 encryption (Microsoft-managed or Customer-Managed Keys)
- In transit - TLS 1.2+ for all API communications
- Customer-Managed Keys (CMK) - Store your own keys in Azure Key Vault
Governance at Scale
Use Azure Policy to enforce organization-wide standards:
- Restrict allowed regions for data residency
- Enforce private endpoints on all Foundry resources
- Require specific content filter configurations
- Block deployment of unapproved models
💡 Key Insight: Deploy using Infrastructure as Code (Bicep or Terraform) to ensure consistent, auditable security configurations across all environments.
⌨ HANDS-ON LABConfigure Private Endpoint and Disable Public Access
⭐ +200 XPLock down Microsoft Foundry Hub by disabling public network access and validating private endpoint DNS.
1Disable public network access on the Foundry cognitive services account.
OBJECTIVE 1 / 1 — type "hint" if stuck
FOUNDRY VERIFICATION
QUERY 1 // 1
What provides the highest level of network security for Foundry resources?
Public access with strong passwords
IP allowlisting
Managed VNet with private endpoints
VPN without encryption