The Complete Blueprint: Deploying Production Microsoft Foundry with One Command

Over the first nine parts of this series, we explored every piece of the modern Microsoft Foundry platform: the unified Responses API, the Model Router, Hosted Agents, MCP Toolboxes, Foundry IQ, Multi-Agent Workflows, OpenTelemetry Evaluation Gates, Private Networks, and AI Gateways.

Now it is time to put all the puzzle pieces together on one page.

If a CTO, a client, or an engineering lead asks you tomorrow: "How do we deploy a production-ready Microsoft Foundry architecture from scratch without clicking around in the Azure Portal for three days?" — this article is your blueprint.

The End-to-End Production Architecture

Here is how all the components fit together in an enterprise Landing Zone:

================================================================================
                        1. CHANNELS & INGRESS LAYER
   [ Microsoft Teams / M365 Copilot ]        [ Custom Web & Mobile Apps ]
================================================================================
                                     |
                                     v
================================================================================
                        2. TRAFFIC & SECURITY GATEWAY
          [ Azure API Management (AI Gateway) + Private DNS ]
          - Token Rate Limiting (TPM)   - Semantic Caching
          - Multi-Region Failover       - Entra ID Token Validation
================================================================================
                                     |
                                     v
================================================================================
                 3. MICROSOFT FOUNDRY RESOURCE & PROJECT (VNet Isolated)
   +------------------------------------------------------------------------+
   |  Foundry Control Plane (Entra Agent ID, Guardrails, OTel Tracing)      |
   +------------------------------------------------------------------------+
   |  Foundry Agent Service                                                 |
   |  - Prompt Agents (Declarative)                                         |
   |  - Voice Agents (Voice Live WebSocket)                                 |
   |  - Hosted Agents (Python 3.13 / .NET 10 via ZIP or Container)          |
   +------------------------------------------------------------------------+
   |  Managed MCP Toolboxes (Tool Search, Browser Automation, Custom APIs)  |
   +------------------------------------------------------------------------+
================================================================================
           |                                 |                         |
           v                                 v                         v
==============================   =========================   ===================
4. PRIVATE CUSTOMER DATA STATE   5. ENTERPRISE KNOWLEDGE     6. FOUNDRY MODELS
- Azure Cosmos DB (Threads &     - Foundry IQ (AI Search)    - Model Router
  Long-Term Memory Stores)       - Fabric IQ (OneLake)       - GPT-5 / Claude
- Azure Blob Storage (Files)     - Work IQ (M365 Graph)      - Provisioned PTUs
==============================   =========================   ===================

Provisioning the Foundry Resource and Project with Bicep

In production, nobody clicks buttons in the Azure portal to create resources. You define your Microsoft Foundry account (Microsoft.CognitiveServices/accounts of kind AIServices), your child Project, and your Model Deployment in Bicep so it can be versioned in Git.

main.bicep: Unified Foundry Resource, Project, and Model Deployment

param location string = resourceGroup().location
param foundryAccountName string = 'foundry-prod-${uniqueString(resourceGroup().id)}'
param projectName string = 'enterprise-agents-proj'

// 1. Create the unified Microsoft Foundry Account (Kind: AIServices)
resource foundryAccount 'Microsoft.CognitiveServices/accounts@2025-06-01' = {
  name: foundryAccountName
  location: location
  kind: 'AIServices'
  sku: {
    name: 'S0'
  }
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    customSubDomainName: foundryAccountName
    disableLocalAuth: true // Enforce keyless Microsoft Entra ID authentication
    publicNetworkAccess: 'Enabled' // Set to 'Disabled' when attaching Private Endpoints
    allowProjectManagement: true
  }
}

// 2. Create the child Microsoft Foundry Project
resource foundryProject 'Microsoft.CognitiveServices/accounts/projects@2025-06-01' = {
  parent: foundryAccount
  name: projectName
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    description: 'Production workspace for enterprise agents and MCP toolboxes'
  }
}

// 3. Deploy a default model inside the Foundry Account
resource modelDeployment 'Microsoft.CognitiveServices/accounts/deployments@2025-06-01' = {
  parent: foundryAccount
  name: 'gpt-5-mini'
  sku: {
    name: 'GlobalStandard'
    capacity: 100
  }
  properties: {
    model: {
      format: 'OpenAI'
      name: 'gpt-5-mini'
      version: '2025-09-01'
    }
  }
}

output projectEndpoint string = 'https://${foundryAccount.properties.customSubDomainName}.services.ai.azure.com/api/projects/${foundryProject.name}'