Azure Portal vs AI Foundry Resource Deployment

Hi Yu-Jeong Seo,
In Azure, some services such as Azure OpenAI, Language, and Content Safety can be deployed as standalone resources directly through the Azure Portal, allowing you to configure features like Private Endpoints (PEP) for secure, private network communication within your virtual network. These resources are provisioned at the Azure resource level and can integrate seamlessly with other Azure services. On the other hand, features such as Prompt Shield and other emerging safety or orchestration capabilities are currently only available through AI Foundry, which serves as a unified environment for experimentation, orchestration, and governance of AI workloads, rather than a standalone Azure resource. Your understanding about PEP is correct only services deployed as Azure resources with PEP enabled support private network communication; features exposed exclusively via AI Foundry do not yet support PEP-based isolation. At present, there isn’t a way to automatically view and manage standalone Azure Portal–deployed resources directly inside AI Foundry in a single pane of glass, though you can connect and reference them when building solutions within AI Foundry.
For reference:
Azure AI Foundry overview
Create and deploy an Azure OpenAI in Azure AI Foundry Models resource

Hello, Pavankumar Purilla

Thank you for your answer. So, does this mean that the resources available only in AI Foundry without a PEP require public communication rather than private network communication?

Hi Yu-Jeong Seo

You can also secure Azure AI foundry hub resource with own virtual network or Microsoft managed virtual network

https://learn.microsoft.com/en-us/azure/ai-foundry/how-to/configure-private-link?tabs=azure-portal&pivots=fdp-project (own Vnet with Bastion/P2S/S2S)

https://learn.microsoft.com/en-us/azure/ai-foundry/how-to/configure-managed-network?tabs=portal (microsoft managed vnet for saving networking effort)

https://learn.microsoft.com/en-us/azure/ai-foundry/agents/how-to/virtual-networks (Agent isolation)

We are secure the resource once Dev and Test are done on public resources and the models are ready for production.

Securing with virtual network provides additional protection again unauthorized access.

You can entangle your private azure AI foundry resource with an APIM Gateway (with in same virtual network) with public IP to communicate with user with public, securing the full traffic through private endpoint

https://learn.microsoft.com/en-us/azure/api-management/azure-ai-foundry-api

Hope it gives the needed clarity.

Thank you

Hi Yu-Jeong Seo

Please let us know if you can accept above comment as answer or follow up queries.

Thank you

@Manas Mohanty Thank you for your response. Based on the documentation, it seems that AI Foundry projects or agents can only be used privately through Terraform or Bicep templates. Since our current environment only allows work through the Portal, I need to confirm this.Does attaching a private endpoint (PEP) to AI Foundry mean that services like Prompt Shield and Agent Service inside Foundry can also be used privately, or is that not the case?