Pre-Order Your Operationalizing Machine Learning and Generative AI Solutions (beta) AI-300

Microsoft ' s Azure AI Foundry documentation defines built-in roles scoped to the resource hierarchy. The Azure AI Administrator role grants permissions to manage the Azure AI Hub resource itself — including network settings, shared connections, quota, and governance configuration — which is appropriate for platform engineers who configure resource-level settings. The Azure AI Developer role grants permissions to create, update, and manage project-level assets such as deployments, prompt flows, fine-tuning jobs, and evaluations, without access to resource-level configuration. This precisely matches the developer requirement and enforces least privilege. Disabling Entra ID authentication (option B) violates security policy and removes the identity-based access control that makes RBAC possible. Sharing a single API key (option D) violates the least-privilege principle — all users would have identical, undifferentiated access with no audit trail.

Microsoft Learn Reference Topic: Manage access to Azure AI Foundry – Built-in roles: Azure AI Administrator and Azure AI Developer

Azure Private Endpoints are network interfaces that connect your Azure ML workspace to your Virtual Network using a private IP address from the VNet ' s address space. Once a private endpoint is created and DNS is configured, all traffic to the workspace — including the Studio UI, REST API, and SDK calls — travels entirely over Microsoft ' s private backbone rather than the public internet. The workspace ' s public endpoint can then be completely disabled. Azure Firewall (option A) filters traffic at the network layer but still requires the workspace to have a public IP. Network Security Groups (option C) control traffic within VNets but cannot block the public endpoint of a PaaS service. Service endpoints (option D) keep traffic on the Azure backbone but the workspace still has a public-facing address. Private endpoints are the only option that fully removes the public network presence.

Microsoft Learn Reference Topic: Configure a private endpoint for Azure Machine Learning workspace

Data Zone Standard deployment routes requests to multiple datacenters within a defined geographic zone such as the US data zone, providing lower latency by using zone-level load balancing while maintaining data within a broad compliance boundary. This makes it suitable for enterprise internal applications where multiple business units need low-latency access without strict single-region data residency requirements. Developer deployment (option A) is a low-quota, unguaranteed tier designed for prototype testing, not production workloads serving multiple business units. Data Zone Batch (option B) is designed for high-volume asynchronous batch processing, not interactive low-latency real-time requests. Global Batch (option D) is optimized for scheduled bulk inference across all global regions but adds latency and is inappropriate for synchronous interactive use cases.

Microsoft Learn Reference Topic: Foundation model deployment types in Microsoft Foundry – Data Zone Standard for low-latency internal use