Manage automatic upgrades from Azure OpenAI to Microsoft Foundry

Microsoft automatically upgrades eligible Azure OpenAI resources to Microsoft Foundry resources. In this article, you check whether a resource is scheduled for automatic upgrade, defer or opt out of the upgrade, and prepare for rollback.

The backend upgrade expands access to models and Foundry capabilities, including Foundry Agent Service, evaluations, and fine-tuning. You don't pay more for existing Azure OpenAI functionality after the upgrade. New Foundry capabilities that you use might have separate pricing. Your resource keeps its name, managed identity, endpoint, keys, security settings, permissions, Azure OpenAI v1 endpoint access, fine-tuning jobs, batches, and stored completions.

If your Azure OpenAI resource isn't eligible for auto-upgrade, you can still start the upgrade yourself by using the opt-in process.

Prerequisites

An existing Azure OpenAI resource.
Permission to read the resource and its Azure Resource Manager JSON.
A role that includes Microsoft.CognitiveServices/accounts/write if you plan to opt out. Assign permissions at the narrowest scope that meets your needs.
Your existing Bicep or Terraform configuration if you plan to opt out by using infrastructure as code. Don't deploy the examples in this article as standalone resource definitions.
Azure CLI 2.14.0 or later with Bicep installed, permission to validate deployments, and permission to update the existing account for the Bicep approach.
Terraform with the Azure AzAPI provider configured for the target subscription and the existing Azure OpenAI resource ID for the Terraform approach.
API version 2026-01-15-preview when you inspect or update the foundryAutoUpgrade property. This API version and property are in preview.

Review auto-upgrade status

Resources selected for auto-upgrade show a notice in the Azure portal. They also include a foundryAutoUpgrade block in their Azure Resource Manager resource properties. Resources that aren't yet selected show no such notice or property.

Check status in the Azure portal

To check whether your resource is selected:

Sign in to the Azure portal.
Open your Azure OpenAI resource.
Select Resource upgrade in the left-side navigation.

Inspect the resource JSON

To inspect the resource properties:

Open the Overview page.
Open JSON view.
Select API version 2026-01-15-preview.

A resource scheduled for auto-upgrade shows the following block in its JSON properties:

"foundryAutoUpgrade": {
  "mode": "Enabled",
  "plannedByMicrosoft": true,
  "scheduledAt": "2026-04-15T00:00:00Z",
  "statusReason": "<service-provided-status>"
}

Reference: Microsoft.CognitiveServices/accounts

The public API contract doesn't enumerate statusReason values. Use the Resource upgrade page to interpret the current state. Don't build automation that depends on a specific statusReason value.

If the response doesn't contain foundryAutoUpgrade, it doesn't provide an automatic-upgrade schedule. The public API contract doesn't define property absence as a conclusive selection state, so don't use absence as the sole signal in automation.

Defer or opt out of automatic upgrade

If your resource is selected for automatic upgrade, use the Azure portal to defer the upgrade or set foundryAutoUpgrade.mode to Disabled in your existing deployment definition. The public API contract describes Disabled as opting out of automatic upgrade.

Use the Azure portal to defer a scheduled upgrade. Use Bicep or Terraform to opt out by setting foundryAutoUpgrade.mode to Disabled in your existing deployment definition.

Sign in to the Azure portal.
Open your Azure OpenAI resource.
Select Resource upgrade.
Select Defer upgrade.
Return to Resource upgrade and verify that the page reflects your change.

Add the foundryAutoUpgrade block to your existing Bicep resource definition. Keep all other properties unchanged.

// Add this object to the existing properties block.
foundryAutoUpgrade: {
  mode: 'Disabled'
}

Reference: Microsoft.CognitiveServices/accounts

Preview the deployment before you apply it. Replace the placeholders with the values for your existing deployment.

az deployment group what-if --resource-group <resource-group> --template-file <template-file> --parameters @<parameters-file>

Reference: Preview Azure deployment changes

Note

ARM what-if can report changes to server-defaulted properties. Compare unexpected results with the current resource JSON, and don't treat what-if output as a guarantee of final service behavior.

Confirm that the preview updates the existing account and doesn't replace or delete it. Then deploy the template by using your existing deployment process. After the deployment completes, inspect the resource JSON and verify that foundryAutoUpgrade.mode is Disabled.

The AzureRM azurerm_cognitive_account resource doesn't expose the preview foundryAutoUpgrade property. Use AzAPI to update that property on your existing account.

# Accept the existing Azure OpenAI resource ID.
variable "azure_openai_resource_id" {
  type = string
}

# Disable automatic upgrade on the existing resource.
resource "azapi_update_resource" "disable_foundry_auto_upgrade" {
  type        = "Microsoft.CognitiveServices/accounts@2026-01-15-preview"
  resource_id = var.azure_openai_resource_id

  body = {
    properties = {
      foundryAutoUpgrade = {
        mode = "Disabled"
      }
    }
  }
}

Reference: AzAPI update resource

Run terraform plan -out=tfplan. Confirm that the plan updates the existing account and doesn't replace or delete it. Then run terraform apply tfplan. After the apply operation completes, inspect the resource JSON and verify that foundryAutoUpgrade.mode is Disabled.

Check eligibility and upgrade constraints

Auto-upgrade rolls out in stages based on technical readiness and observed usage patterns. This staged approach helps ensure a predictable, low-disruption experience as support expands.

Review these constraints before you upgrade:

Resources that use private networking or customer-managed key (CMK) encryption aren't selected at first. Review the manual upgrade requirements before manually upgrading one of these resources.
Foundry doesn't support a Weights & Biases integration.
Private network setups require DNS resolution for the <custom-domain>.openai.azure.com, <custom-domain>.services.ai.azure.com, and <custom-domain>.cognitiveservices.azure.com FQDNs. Update the private endpoint's IP configurations, or delete and re-create the private endpoint.

For details, see Upgrade from Azure OpenAI to Microsoft Foundry.

Roll back an auto-upgraded resource

If your resource was auto-upgraded and you need to return to Azure OpenAI, follow the rollback steps in Upgrade from Azure OpenAI to Microsoft Foundry. Before you roll back, delete any Foundry-specific sub-resources that prevent rollback, such as projects, connections, and non-Azure OpenAI model deployments. Also confirm that your subscription has capacity below the limit of 30 Azure OpenAI resources in the target region.

After rollback, verify that the resource is shown as Azure OpenAI and that its existing endpoint, deployments, networking settings, and identity configuration remain available.

Troubleshoot automatic upgrade

Issue	Resolution
Resource upgrade and `foundryAutoUpgrade` aren't present	The resource isn't currently selected. Use the opt-in upgrade process if you need to upgrade now.
You can't opt out	Confirm that your role includes `Microsoft.CognitiveServices/accounts/write` on the resource.
A Bicep or Terraform plan replaces the resource	Stop the deployment. Confirm that you are updating the existing resource definition and preserving its current properties.
Azure CLI can't produce a what-if result	Confirm that Azure CLI 2.14.0 or later and Bicep are installed and that your identity has deployment-validation and resource-write permissions.
Terraform can't initialize or resolve `azapi_update_resource`	Confirm that Terraform and the Azure AzAPI provider are configured for the target subscription, initialize the working directory, and verify that `azure_openai_resource_id` contains the existing account ID.
A private network blocks upgrade	Follow the private network steps in Upgrade from Azure OpenAI to Microsoft Foundry before you manually upgrade.
Customer-managed keys block upgrade	Review the customer-managed key requirements in Upgrade from Azure OpenAI to Microsoft Foundry.
A Weights & Biases integration blocks upgrade	Remove or replace the integration before you upgrade. Foundry resources don't support this integration.
Upgrade exceeds the regional resource limit	Confirm that the subscription has fewer than 100 `AIServices` resources in the target region.
Rollback exceeds the regional resource limit	Confirm that the subscription has fewer than 30 Azure OpenAI resources in the target region.

Review Foundry governance and security guidance

If your organization needs more time to complete security reviews or update governance controls, complete these actions before your scheduled upgrade date:

Review existing Azure RBAC assignments and Azure Policy controls. Azure OpenAI and Microsoft Foundry resources use the same Azure resource type and management APIs, so these controls continue to apply after upgrade.
Identify broad permissions that also apply to the expanded Foundry model set.
Use Azure Policy to constrain which models teams can deploy. For details, see Built-in policy for model deployment.
Approve Foundry capabilities in phases, such as non-OpenAI models, Agent Service, and Foundry Tools.
For teams that need only Azure OpenAI data actions, use Cognitive Services OpenAI User. For Foundry project development, use Foundry User or Foundry Owner, as appropriate. Use a custom role when the built-in roles grant broader access than the team requires.

Important

The Foundry RBAC roles were recently renamed. Foundry User, Foundry Owner, Foundry Account Owner, and Foundry Project Manager were previously named Azure AI User, Azure AI Owner, Azure AI Account Owner, and Azure AI Project Manager. You might still see the previous names in some places while the rename rolls out. The role IDs and core permissions are unchanged by the rename.

For more upgrade-specific guidance, see Considerations for RBAC and policy during upgrade. For broader security and governance guidance, see Manage compliance and security in Microsoft Foundry.

Feedback

Was this page helpful?

Last updated on 2026-08-20