Product and intended use
Define the configuration, people, information and tasks being assessed.
Models sold by Azure versus partner catalogue
Not confirmed
This profile covers Models sold by Azure in Microsoft Foundry, including Azure OpenAI models hosted in Microsoft's Azure environment (they do not call OpenAI ChatGPT or the OpenAI API). Partner/community/Hugging Face catalogue models have separate terms. Previews use supplemental Azure preview terms and may differ on abuse monitoring. Fine-tuning, Assistants, Responses, Batch and 'on your data' are optional features.
Ask: Confirm the model names, that they are 'sold by Azure' not marketplace-hosted, and which of Assistants/Responses/Batch/fine-tune/on-your-data are on.
Global versus Data Zone versus geography
Public claim only
At rest, data stays in the designated Azure geography for all types. Inference: Global may process in any Azure region where the model is deployed; Data Zone processes inside the Microsoft-specified zone (US, EU or APAC); geography/standard types process in the customer-specified geography (with possible movement between regions inside that geography). Microsoft recommends starting with Global Standard (lowest price, widest coverage).
Ask: What is the deployment type on our production resource, and is it geography-Australia rather than Global or Data Zone APAC?
Stateless chat plus optional stateful APIs
Public claim only
Default inferencing is stateless. Optional: Files API uploads, vector store, fine-tuning, Assistants threads/messages/runs, Responses API history, stored completions, batch, and prompt augmentation from a configured store or a URL in the prompt. Guardrails (content filters) evaluate prompts and completions in real time.
Ask: Are Assistants, Responses, stored completions, fine-tune or URL augmentation enabled in production?
Geography at rest; inference follows deployment type
Public claim only
DPA governs processing. Global inference can leave Australia even if the resource is in Australia. Data Zone in an EU resource stays in the EU; a US Data Zone stays in the US; APAC Data Zone is a Microsoft-defined zone, not necessarily Australia-only. Standard geography deployments keep inference in-geo. Abuse-monitoring store is in the resource geography.
Ask: Name the Azure geography of the resource and the deployment type for every production model.
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Customer app discloses whatever it sends
Not confirmed
Prompts are Customer Data under the DPA and are not available to other customers or to OpenAI. Abuse-monitoring human review (unless modified) can let authorised Microsoft employees see flagged prompts/completions. URL augmentation and on-your-data retrieval expand the corpus.
Ask: What client-matter content is sent as prompts, and is modified abuse monitoring approved?
Hosted by Microsoft, not by OpenAI.com
Public claim only
Models sold by Azure are hosted in Microsoft's Azure environment and do not interact with services operated by the model providers (for example OpenAI ChatGPT or the OpenAI API). Prompts are not available to OpenAI or other providers of Models sold by Azure. Partner-sold catalogue models are outside this statement.
Ask: Confirm production IDs are Models sold by Azure, not partner-hosted endpoints.
Azure DPA subprocessors; not OpenAI Inc.
Public claim only
The Microsoft Products and Services DPA governs. Providers of Models sold by Azure do not receive customer prompts. Microsoft personnel may review abuse-flagged content. No separate public Foundry subprocessor page was scraped; use the Azure Online Services list.
Ask: Provide the Azure subprocessors for our Foundry resource geography.
No training of base models without permission
Public claim only
Prompts, completions, embeddings and training data are not used to train any generative AI foundation models without the customer's permission or instruction; not used to improve Microsoft or third-party products without explicit permission; not available to OpenAI or other model providers. Fine-tuned models are exclusive to the customer. Abuse-monitoring automated review does not store prompts or use them to train models.
Ask: Confirm we have not instructed fine-tune or 'improve the service' on this resource.
Abuse monitoring, not product-feedback training
Public claim only
Default abuse monitoring may sample prompts/completions for automated and, if needed, human review. Automated review does not store or train. Human-review store is in-geo, logically separated by resource. Modified abuse monitoring (application required) turns off that store; ContentLogging false verifies it. Previews may differ.
Ask: Is modified abuse monitoring approved, and does ContentLogging show false on the production resource?
Stateless by default; optional stores; abuse store
Public claim only
Base inferencing does not store prompts in the model. Optional Assistants/Responses/stored completions persist history as configured. Uploaded files and abuse-monitoring data (if on) rest in the designated geography. No numbered default day count for abuse-store retention was extracted here (see the linked abuse-monitoring article).
Ask: Are stateful APIs on, and what is the abuse-monitoring retention period if ContentLogging is not false?
Customer deletes resources; DPA offboarding
Not confirmed
The customer deletes deployments, files, threads and stores in Azure. Subscription offboarding follows the DPA. This review did not extract a Foundry-specific certified-deletion period for abuse-monitoring copies.
Ask: On resource deletion, when are files, threads, embeddings and abuse-monitoring copies gone, with what evidence?
Abuse-monitoring reviewers; support via Azure
Public claim only
Authorised Microsoft employees can access abuse-flagged prompts/completions via point-wise queries and Secure Access when default human review is on. Modified abuse monitoring removes that human-review store. Azure support access follows the Azure support plan and Lockbox if purchased.
Ask: Is modified abuse monitoring on, and is Azure Lockbox in our support SKU?
Azure RBAC on the Foundry resource
Public claim only
Access is the customer's Azure RBAC, network rules and API keys/Entra. The service does not add a Copilot-style Graph permission model. Mis-scoped keys are the usual failure mode.
Ask: Who can invoke the production deployment, and are keys rotated and network-restricted?
Azure platform encryption; not restated on the privacy article
Not confirmed
The Models-sold-by-Azure privacy article focuses on training, location and abuse monitoring rather than naming TLS/AES. Azure platform encryption and optional CMK apply as for other Azure services; confirm Copilot-style claims are not assumed.
Ask: Confirm TLS 1.2+ and AES-256 at rest, including the abuse-monitoring store, and whether CMK covers it.
Azure compliance offerings; Foundry is an Azure service
Public claim only
The privacy article points to Azure compliance offerings and the DPA. Specific SOC/ISO reports covering Models sold by Azure / Azure OpenAI should be pulled from the Service Trust Portal for the relevant geography. Previews may be out of scope.
Ask: Provide current SOC 2 / ISO 27001 / ISO 42001 scope for Azure OpenAI / Foundry Models sold by Azure in our geography.
DPA plus Product Terms; preview supplemental terms
Public claim only
Microsoft Products and Services DPA governs data processing. Product Terms include Responsible Use of Microsoft AI Services (access limits if severe abuse is detected). Azure Preview supplemental terms apply to preview models. Customer Copyright Commitment is a separate Microsoft commitment for some Copilot products — do not assume it covers a custom Foundry app without checking.
Ask: Confirm Models sold by Azure are on our DPA and whether preview terms apply to any production model.
Global inference is worldwide; Data Zone and geography differ
Public claim only
Global: prompts/responses may be processed in any geography where that model is deployed. Data Zone: inside the specified zone (US, EU or APAC). Geography: inside the resource geography. At-rest including abuse store stays in the designated geography. Azure DPA transfer commitments still apply.
Ask: If we need Australia-only inference, is a geography-Australia deployment actually provisioned (not Global Standard)?
Azure DPA incident process
Not confirmed
Security incidents follow the Microsoft DPA for Azure. No Foundry-specific hour count was extracted. Abuse-monitoring detections can also throttle or suspend the subscription under Product Terms.
Ask: Within how many hours are we notified of a Foundry incident, and who owns throttle/suspend notices?
Model launch order; retirements
Public claim only
New deployment types arrive Global, then Data Zone, then geography. Geography types have no guaranteed date. Model retirements and launch order are documented separately. Changing Global to geography is a customer configuration change with price and availability effects.
Ask: What is our model-retirement watch, and who approves switching deployment type?
Delete the Azure resource
Not confirmed
The customer exports application data themselves. Deleting the Foundry resource removes deployments; DPA covers remaining Customer Data. Abuse-monitoring copies and stateful stores need explicit confirmation.
Ask: On subscription exit, when are files, threads, embeddings and abuse-monitoring data deleted, with what certificate?
On-your-data and URL augmentation
Not confirmed
Optional retrieval from a configured data store or from a URL included in the prompt augments the prompt. That is a connector into whatever the URL or store holds. Batch and Files API are additional upload paths.
Ask: Which data stores and URL-augmentation features are enabled, and how do we disable them?
Only if the app puts a URL in the prompt
Public claim only
The model service does not document a built-in Bing toggle like Copilot Chat. Prompts may be augmented with data retrieved from a source included in the prompt itself, such as a URL. If the customer app calls Bing or the open web, that is the app's connector, not Foundry's default.
Ask: Does our application add URLs or Bing results to prompts?
API is dumb; the app takes actions
Not confirmed
Foundry returns completions, images or embeddings. Tool-calling/agents in the customer app can take actions. Assistants/Responses can persist tool state. Guardrails filter content but do not approve legal filings.
Ask: Which tools can the production agent call, and what is the kill-switch in our app?
Customer-designed; Microsoft only for abuse flags
Not confirmed
Microsoft human review is limited to abuse-monitoring samples unless modified monitoring is on. Legal quality review is entirely the customer's process. Guardrails are not a substitute for a lawyer.
Ask: What named human review sits on production outputs used in advice or client documents?
