---
title: "Azure-hosted models in Microsoft Foundry (Models sold by Azure / Azure OpenAI) (Microsoft)"
url: "https://ailawframework.com/software/azure-models"
type: "software_profile"
site: "AI Law Framework"
id: "azure-models"
vendor: "Microsoft"
category: "General-purpose"
segment: "General-purpose assistants"
confidence: "high"
last_reviewed: "2026-09-21"
---

# Azure-hosted models in Microsoft Foundry (Models sold by Azure / Azure OpenAI) (Microsoft)

> Azure API for deploying foundation models in the customer's subscription. Data residency and abuse-monitoring storage depend on deployment type; Global Standard may infer anywhere.

Canonical page: https://ailawframework.com/software/azure-models  
Last reviewed: 2026-09-21

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Models sold by Azure in Microsoft Foundry, including Azure OpenAI, on a chosen Global, Data Zone or geography deployment. Marketplace/partner-hosted models, Hugging Face, previews and fine-tuning need separate review.

## Capabilities

- Document summarisation
- Knowledge search
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia, United States, European Union / EEA, Another named location, Worldwide or dynamically routed |
| Australian region | On request |
| Model providers | Microsoft (Azure-hosted OpenAI and other models sold by Azure) |
| Assurance | ISO 27001, GDPR |
| Training on customer content | No |
| Retention | Base models are stateless: prompts and completions are not stored in the model and are not used to train, retrain or improve base models. Optional stateful APIs (Assistants, Responses, stored completions) persist message history in the customer-designated geography. Abuse-monitoring may store flagged prompts/completions in-geo unless modified abuse monitoring is approved (ContentLogging false). At-rest data stays in the designated Azure geography even for Global/Data Zone inference. |
| Integrations | Azure OpenAI API, Assistants API, Responses API, Files API, Azure OpenAI on your data |
| Legal content coverage | The model has no licensed Australian primary law. Grounding is only whatever the customer retrieves into the prompt (including optional URL augmentation). |
| Pricing | Pay-per-token (and provisioned/batch SKUs). Microsoft tells customers to start with Global Standard as the lowest price and broadest coverage, then move to Data Zone or geography deployments for residency. Exact rates are on Azure pricing for the chosen model. |
| Australian presence | Yes. Azure has Australian geographies. Geography-based deployments process inference inside the specified geography (with in-geo regional movement). Data Zone APAC and Global types can process outside Australia. Confirm the actual deployment type on the Foundry resource. |
| Website | https://learn.microsoft.com/en-us/azure/foundry/concepts/foundry-models-overview |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Models sold by Azure versus partner catalogue | Not confirmed | This profile covers Models sold by Azure in Microsoft Foundry, including Azure OpenAI models hosted in Microsoft's Azure environment (they do not call OpenAI ChatGPT or the OpenAI API). Partner/community/Hugging Face catalogue models have separate terms. Previews use supplemental Azure preview terms and may differ on abuse monitoring. Fine-tuning, Assistants, Responses, Batch and 'on your data' are optional features. | Confirm the model names, that they are 'sold by Azure' not marketplace-hosted, and which of Assistants/Responses/Batch/fine-tune/on-your-data are on. | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy); [Microsoft Foundry Models overview](https://learn.microsoft.com/en-us/azure/foundry/concepts/foundry-models-overview) |
| Global versus Data Zone versus geography | Public claim only | At rest, data stays in the designated Azure geography for all types. Inference: Global may process in any Azure region where the model is deployed; Data Zone processes inside the Microsoft-specified zone (US, EU or APAC); geography/standard types process in the customer-specified geography (with possible movement between regions inside that geography). Microsoft recommends starting with Global Standard (lowest price, widest coverage). | What is the deployment type on our production resource, and is it geography-Australia rather than Global or Data Zone APAC? | [Deployment types in Microsoft Foundry Models](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/deployment-types); [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Stateless chat plus optional stateful APIs | Public claim only | Default inferencing is stateless. Optional: Files API uploads, vector store, fine-tuning, Assistants threads/messages/runs, Responses API history, stored completions, batch, and prompt augmentation from a configured store or a URL in the prompt. Guardrails (content filters) evaluate prompts and completions in real time. | Are Assistants, Responses, stored completions, fine-tune or URL augmentation enabled in production? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Geography at rest; inference follows deployment type | Public claim only | DPA governs processing. Global inference can leave Australia even if the resource is in Australia. Data Zone in an EU resource stays in the EU; a US Data Zone stays in the US; APAC Data Zone is a Microsoft-defined zone, not necessarily Australia-only. Standard geography deployments keep inference in-geo. Abuse-monitoring store is in the resource geography. | Name the Azure geography of the resource and the deployment type for every production model. | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy); [Deployment types in Microsoft Foundry Models](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/deployment-types) |
| Azure consumption; Global Standard cheapest | Public claim only | Pay-per-token, provisioned throughput and batch SKUs. Global Standard is documented as lowest price and first to get new models. Geography deployments arrive last and have no guaranteed availability date. Rates are model-specific on Azure pricing. | Quote token rates, provisioned units and whether we pay a Global premium-avoidance premium for an AU geography deployment. | [Deployment types in Microsoft Foundry Models](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/deployment-types) |
| Customer application; on-your-data retrieval | Public claim only | The firm builds the application. Optional Azure OpenAI on-your-data retrieves from a configured store and augments the prompt. URL-in-prompt augmentation can pull external content. Network isolation, private endpoints and Key Vault are Azure platform controls, not automatic. | What retrieval store, private endpoints and identity does the production app use? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Azure support plan | Not confirmed | Support is the firm's Azure support SKU. Not inspected here. | What severity times apply to a Foundry/OpenAI outage on our Azure agreement? | [Microsoft Foundry Models overview](https://learn.microsoft.com/en-us/azure/foundry/concepts/foundry-models-overview) |
| Customer must evaluate outputs | Not confirmed | Microsoft provides Guardrails/content filters and abuse monitoring. Output quality for legal tasks is the customer's engineering burden. No independent Australian-law benchmark for Azure OpenAI was found on these pages. | What evaluation set and human-review loop sit in front of production completions? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Building block, not a legal product | Not confirmed | Fit as the model layer under a firm-controlled app with retrieval, permissions, logging and human review. Unfit as an out-of-the-box legal assistant. Grounding exists only if the app supplies it. Preview models may have different privacy practices. | Which production tasks call this resource, and is any preview model in that path? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy); [Microsoft Foundry Models overview](https://learn.microsoft.com/en-us/azure/foundry/concepts/foundry-models-overview) |
| Customer app discloses whatever it sends | Not confirmed | Prompts are Customer Data under the DPA and are not available to other customers or to OpenAI. Abuse-monitoring human review (unless modified) can let authorised Microsoft employees see flagged prompts/completions. URL augmentation and on-your-data retrieval expand the corpus. | What client-matter content is sent as prompts, and is modified abuse monitoring approved? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Hosted by Microsoft, not by OpenAI.com | Public claim only | Models sold by Azure are hosted in Microsoft's Azure environment and do not interact with services operated by the model providers (for example OpenAI ChatGPT or the OpenAI API). Prompts are not available to OpenAI or other providers of Models sold by Azure. Partner-sold catalogue models are outside this statement. | Confirm production IDs are Models sold by Azure, not partner-hosted endpoints. | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Azure DPA subprocessors; not OpenAI Inc. | Public claim only | The Microsoft Products and Services DPA governs. Providers of Models sold by Azure do not receive customer prompts. Microsoft personnel may review abuse-flagged content. No separate public Foundry subprocessor page was scraped; use the Azure Online Services list. | Provide the Azure subprocessors for our Foundry resource geography. | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| No training of base models without permission | Public claim only | Prompts, completions, embeddings and training data are not used to train any generative AI foundation models without the customer's permission or instruction; not used to improve Microsoft or third-party products without explicit permission; not available to OpenAI or other model providers. Fine-tuned models are exclusive to the customer. Abuse-monitoring automated review does not store prompts or use them to train models. | Confirm we have not instructed fine-tune or 'improve the service' on this resource. | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Abuse monitoring, not product-feedback training | Public claim only | Default abuse monitoring may sample prompts/completions for automated and, if needed, human review. Automated review does not store or train. Human-review store is in-geo, logically separated by resource. Modified abuse monitoring (application required) turns off that store; ContentLogging false verifies it. Previews may differ. | Is modified abuse monitoring approved, and does ContentLogging show false on the production resource? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Stateless by default; optional stores; abuse store | Public claim only | Base inferencing does not store prompts in the model. Optional Assistants/Responses/stored completions persist history as configured. Uploaded files and abuse-monitoring data (if on) rest in the designated geography. No numbered default day count for abuse-store retention was extracted here (see the linked abuse-monitoring article). | Are stateful APIs on, and what is the abuse-monitoring retention period if ContentLogging is not false? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Customer deletes resources; DPA offboarding | Not confirmed | The customer deletes deployments, files, threads and stores in Azure. Subscription offboarding follows the DPA. This review did not extract a Foundry-specific certified-deletion period for abuse-monitoring copies. | On resource deletion, when are files, threads, embeddings and abuse-monitoring copies gone, with what evidence? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Abuse-monitoring reviewers; support via Azure | Public claim only | Authorised Microsoft employees can access abuse-flagged prompts/completions via point-wise queries and Secure Access when default human review is on. Modified abuse monitoring removes that human-review store. Azure support access follows the Azure support plan and Lockbox if purchased. | Is modified abuse monitoring on, and is Azure Lockbox in our support SKU? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Azure RBAC on the Foundry resource | Public claim only | Access is the customer's Azure RBAC, network rules and API keys/Entra. The service does not add a Copilot-style Graph permission model. Mis-scoped keys are the usual failure mode. | Who can invoke the production deployment, and are keys rotated and network-restricted? | [Microsoft Foundry Models overview](https://learn.microsoft.com/en-us/azure/foundry/concepts/foundry-models-overview) |
| Azure platform encryption; not restated on the privacy article | Not confirmed | The Models-sold-by-Azure privacy article focuses on training, location and abuse monitoring rather than naming TLS/AES. Azure platform encryption and optional CMK apply as for other Azure services; confirm Copilot-style claims are not assumed. | Confirm TLS 1.2+ and AES-256 at rest, including the abuse-monitoring store, and whether CMK covers it. | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Azure compliance offerings; Foundry is an Azure service | Public claim only | The privacy article points to Azure compliance offerings and the DPA. Specific SOC/ISO reports covering Models sold by Azure / Azure OpenAI should be pulled from the Service Trust Portal for the relevant geography. Previews may be out of scope. | Provide current SOC 2 / ISO 27001 / ISO 42001 scope for Azure OpenAI / Foundry Models sold by Azure in our geography. | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| DPA plus Product Terms; preview supplemental terms | Public claim only | Microsoft Products and Services DPA governs data processing. Product Terms include Responsible Use of Microsoft AI Services (access limits if severe abuse is detected). Azure Preview supplemental terms apply to preview models. Customer Copyright Commitment is a separate Microsoft commitment for some Copilot products — do not assume it covers a custom Foundry app without checking. | Confirm Models sold by Azure are on our DPA and whether preview terms apply to any production model. | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Global inference is worldwide; Data Zone and geography differ | Public claim only | Global: prompts/responses may be processed in any geography where that model is deployed. Data Zone: inside the specified zone (US, EU or APAC). Geography: inside the resource geography. At-rest including abuse store stays in the designated geography. Azure DPA transfer commitments still apply. | If we need Australia-only inference, is a geography-Australia deployment actually provisioned (not Global Standard)? | [Deployment types in Microsoft Foundry Models](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/deployment-types); [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Azure DPA incident process | Not confirmed | Security incidents follow the Microsoft DPA for Azure. No Foundry-specific hour count was extracted. Abuse-monitoring detections can also throttle or suspend the subscription under Product Terms. | Within how many hours are we notified of a Foundry incident, and who owns throttle/suspend notices? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Model launch order; retirements | Public claim only | New deployment types arrive Global, then Data Zone, then geography. Geography types have no guaranteed date. Model retirements and launch order are documented separately. Changing Global to geography is a customer configuration change with price and availability effects. | What is our model-retirement watch, and who approves switching deployment type? | [Deployment types in Microsoft Foundry Models](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/deployment-types) |
| Delete the Azure resource | Not confirmed | The customer exports application data themselves. Deleting the Foundry resource removes deployments; DPA covers remaining Customer Data. Abuse-monitoring copies and stateful stores need explicit confirmation. | On subscription exit, when are files, threads, embeddings and abuse-monitoring data deleted, with what certificate? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| On-your-data and URL augmentation | Not confirmed | Optional retrieval from a configured data store or from a URL included in the prompt augments the prompt. That is a connector into whatever the URL or store holds. Batch and Files API are additional upload paths. | Which data stores and URL-augmentation features are enabled, and how do we disable them? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Only if the app puts a URL in the prompt | Public claim only | The model service does not document a built-in Bing toggle like Copilot Chat. Prompts may be augmented with data retrieved from a source included in the prompt itself, such as a URL. If the customer app calls Bing or the open web, that is the app's connector, not Foundry's default. | Does our application add URLs or Bing results to prompts? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| API is dumb; the app takes actions | Not confirmed | Foundry returns completions, images or embeddings. Tool-calling/agents in the customer app can take actions. Assistants/Responses can persist tool state. Guardrails filter content but do not approve legal filings. | Which tools can the production agent call, and what is the kill-switch in our app? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |
| Customer-designed; Microsoft only for abuse flags | Not confirmed | Microsoft human review is limited to abuse-monitoring samples unless modified monitoring is on. Legal quality review is entirely the customer's process. Guardrails are not a substitute for a lawyer. | What named human review sits on production outputs used in advice or client documents? | [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) |

## Notes

Do not confuse with partner-hosted Foundry catalogue models. Global Standard (Microsoft's default recommendation) can infer worldwide even when the resource is in Australia. Abuse-monitoring human review is on unless modified monitoring is approved (ContentLogging false). Stateless inferencing is not the same as no logs: optional APIs and abuse store persist data.

## Sources

- [Deployment types in Microsoft Foundry Models](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/deployment-types) (checked 2026-09-21)
- [Data, privacy, and security for Models sold by Azure](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) (checked 2026-09-21)
- [Microsoft Foundry Models overview](https://learn.microsoft.com/en-us/azure/foundry/concepts/foundry-models-overview) (checked 2026-09-21)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.