This module begins the hands-on part of the course. According to Microsoft, Microsoft Foundry (Foundry for short) brings agents, models and tools together under one common management, with permissions, network rules and policies in one place. The working surface for it is the Foundry portal. In this lesson you create a project in your head, deploy a model and try it out in the playground. All later lessons of the module build on this.

Everything that follows describes what Microsoft Learn shows. It was not run against Azure; this is how Microsoft Learn shows it. If you want to click along yourself, you will find a voluntary try-it step at the end.

The running case is the made-up Nordlicht Reisen GmbH. In three months it starts a pilot project: small AI helpers for customer service, not a replacement for advisors. For that it needs a Foundry resource foundry-nordlicht, a project nordlicht-ki and a chat model with the deployment name reise-chat. The names apply only in this course.

Resource and project

Two levels matter, and the exam asks about them:

  • The Foundry resource is, according to Learn, the top level. It forms the boundary for management, security and monitoring of a Foundry environment. It is an ordinary Azure resource and sits in a resource group like any other (see "AZ-900 compact").
  • The Foundry project sits below it. It organizes the work and controls access to Foundry interfaces, tools and development workflows. Learn calls it a folder that bundles things that belong together, such as agents, files and tools.

When you create it, you choose a project name in the portal and, under "Advanced options", the resource group and the location. Learn recommends using a new resource group: then the project can be managed together with everything that goes with it and later deleted together.

In the portal there is a switch called New Foundry. The current Learn guide requires it to be on; its steps apply to "Foundry (new)". An older interface, the "Foundry (classic)" portal, still exists. This course follows the new one. How long the switch stays is open: Learn says nothing about it.

Who may do what: roles

Without a suitable role nobody gets to the project, not even the person who created it. Learn names these roles (roles in general: "AZ-900 compact", lesson 2.6):

Role What for
Foundry User minimum role for building and testing: read access to the project and the resource and the data actions to work with models and agents
Foundry Project Manager manage projects and hand on the Foundry User role
Foundry Account Owner create and manage resources and projects (for example, create a Foundry project for yourself)
Foundry Owner like Account Owner, plus building and developing in projects
Foundry Agent Consumer only talk to agents through their endpoints

Important: The roles used to be called Azure AI User, Azure AI Owner, Azure AI Account Owner and Azure AI Project Manager. Learn writes that you may still see the old names in some places while the renaming is under way. Role IDs and permissions stayed the same.

For Nordlicht this means: Whoever creates a project needs Foundry Account Owner or Foundry Owner. The developers of the pilot get Foundry User on the project. To assign it to many people, Learn recommends an Entra security group.

Deploying a model

A model can be addressed only once it is deployed. The result is a deployment with a name. The steps in the portal according to Learn:

  1. Open Build, then Catalog, then Model Catalog.
  2. Search for the model. Learn takes gpt-5-mini as its example.
  3. Choose Deploy, then Default settings.
  4. Note the name of the deployment. The team needs it later in code.

With Custom settings you can check settings such as the deployment type. What the types "Global Standard" and "Data Zone Standard" mean for the data location is covered in lesson 1.3 and in the AI track (T10.1, "Foundry projects and deployments"); it is not repeated here.

For customer data, Nordlicht chooses the EU if possible. The suitable model gets the deployment name reise-chat. The model behind it is, for example, gpt-5-mini, as Microsoft's quickstart names it. Whether this model is available in the chosen region is open: Learn points to the region list and to checking in the portal or by command.

Trying it out in the playground

After deploying, according to Learn you land directly in the model's playground. That is a chat interface for trying things out, without code and without programs of your own. According to Learn it offers, among other things:

  • a system prompt (lesson 2.2) and the parameters temperature, top_p and max_tokens (lesson 1.3)
  • comparing up to three models side by side with the same prompt
  • the model's protection rules (guardrails)
  • a Code tab with examples in several languages
  • Save as agent, to turn the model into an agent (lesson 2.4)

Remember: The model playground is for trying things out. Building and running happen later in code or with an agent.

Instant access to models (preview)

Besides the deployment, Learn describes instant access (preview): A supported model is simply addressed by its name, without a deployment. According to Learn, in the preview:

  • The project must be in the West US 3 region (currently the only location there).
  • There are no protection rules of your own per model, and fine-tuned models do not work.
  • The list of models changes often; the Model Catalog shows it.

When a deployment remains the right way, Learn itself says: with reserved capacity, your own content filters, your own guardrails and with data location in a specific region. Instant access is meant for getting started, for prototypes and for experiments.

For Nordlicht the choice is clear: The company wants to process customer data in the EU if possible, and Learn names the data location as a reason for a deployment. So: a deployment with the name reise-chat. Instant access would make sense only for a first attempt with made-up data.

Try it yourself (optional)

Only if you want to, and have an Azure subscription (see "AZ-900 compact", lesson 2.2):

  1. Sign in to the portal and check that New Foundry is turned on.
  2. Create a project, for example nordlicht-ki, with a new resource group. For this you need Foundry Account Owner or Foundry Owner, or Contributor or Owner on the resource group.
  3. Deploy a model as described above and ask a question in the playground.
  4. If you are not working alone: assign the Foundry User role under Manage, Project details, Users.

Costs: A Foundry project and the model calls cost per use; the course names no amount. Cleaning up: Afterwards delete the resource group in the Azure portal, and everything in it disappears. Your own account bears the costs.

Summary table

Term Meaning
Foundry resource top level, boundary for management, security and monitoring
Foundry project organizes work and access within the resource
Deployment deployed model with its own name
Playground chat interface for trying things out without code
Foundry User minimum role for building and testing
Instant access (preview) model without a deployment, only in West US 3

Exercise 1

Match each Nordlicht task to the right term or role:

  1. The developer Mia is supposed to try out models and build agents in the project, but not create any resources.
  2. The project is supposed to get a resource group of its own, so that it can later be deleted in one step.
  3. A colleague just wants to see how a model answers a sample question, without writing code.
  4. An app is supposed to address a model with a fixed name, and the customer data is supposed to stay in a specific region.

Solution 1
  1. Foundry User on the project. That is the minimum role for building and testing. With it she would not be allowed to create resources.
  2. When creating the project in the portal, choose a new resource group under "Advanced options". Deleting the group removes the project along with everything that goes with it.
  3. The model's playground: a chat interface for trying things out without code.
  4. A deployment with its own name. The fixed name goes in the code, and according to Learn the data location is a reason for a deployment instead of instant access.

Further reading