BAA for Azure Foundry models

Question

BAA for Azure Foundry models

Alex Tran 0

Hi there,

We were told to come here to ask about signing a BAA with Azure Foundry so that we can use the HIPAA compliant version of OpenAI, Anthropic, and Gemini models within Foundry with ZDR (zero data retention) given that we operate in the health tech space. There is no information publicly about the steps to get one or who to contact and we have a time sensitive need for it in the next week, so if you could please help us, that would be greatly appreciated.

Thank you

Karnam Venkata Rajeswari 1,650 Reputation points Microsoft External Staff Moderator

2026-03-17T12:07:35.5633333+00:00

Hello Alex Tran,

Did you get any chance to review the above response?

Do let me know if you have any further queries.

Thank you
Karnam Venkata Rajeswari 1,650 Reputation points Microsoft External Staff Moderator

2026-03-18T06:42:30.8533333+00:00

Hello Alex Tran,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet.

Thank you
Karnam Venkata Rajeswari 1,650 Reputation points Microsoft External Staff Moderator

2026-03-19T07:20:28.38+00:00

Hello Alex Tran,

Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Thank you!
Karnam Venkata Rajeswari 1,650 Reputation points Microsoft External Staff Moderator

2026-03-20T08:11:04.26+00:00

Hello Alex Tran,

Following up to see if the below answer was helpful.

Since I’ve converted my earlier comment into an answer, could you please take a moment to mark it as Accepted? This helps others in the community with the same question find the solution more easily.

Thank you!

2 answers

Your answer

Karnam Venkata Rajeswari 1,650 Reputation points Microsoft External Staff Moderator

2026-03-17T12:07:35.5633333+00:00

Hello Alex Tran,

Did you get any chance to review the above response?

Do let me know if you have any further queries.

Thank you
Karnam Venkata Rajeswari 1,650 Reputation points Microsoft External Staff Moderator

2026-03-18T06:42:30.8533333+00:00

Hello Alex Tran,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet.

Thank you
Karnam Venkata Rajeswari 1,650 Reputation points Microsoft External Staff Moderator

2026-03-19T07:20:28.38+00:00

Hello Alex Tran,

Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Thank you!
Karnam Venkata Rajeswari 1,650 Reputation points Microsoft External Staff Moderator

2026-03-20T08:11:04.26+00:00

Hello Alex Tran,

Following up to see if the below answer was helpful.

Since I’ve converted my earlier comment into an answer, could you please take a moment to mark it as Accepted? This helps others in the community with the same question find the solution more easily.

Thank you!

Answer 1

Manas Mohanty 16,190 Microsoft External Staff Moderator

Hi Alex Tran

There is no additional BAA signing required unless models are accessed outside Azure.

You can refer and use the Addendum (References attached in above answer) to sign the agreements with customers as best practice

There is default retention of 30 days which can be overridden to 0 for managed customer.

Managed customer can opt out data retention by submitting details on Advanced abuse monitoring form.

Reference.

https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/abuse-monitoring#modified-abuse-monitoring

Thank you

Manas Mohanty 16,190 Reputation points Microsoft External Staff Moderator

2026-03-25T09:09:44.7+00:00

Hey Alex Tran,

Please let us know if you needed clarity on any pointers.

Thank you.

Answer 2

Hello Alex Tran,

Welcome to Microsoft Q&A and Thank you for reaching out.

The BAA is part of the Microsoft Online Services Data Protection Addendum (DPA). BAA is already in effect automatically for (EA / MCA / CSP)

Since you are consuming OpenAI, Anthropic, and Gemini through Azure AI Foundry, there is no separate BAA request per model.

The HIPAA Business Associate Agreement is provided by Azure itself via the Microsoft Products and Services Data Protection Addendum (DPA) and applies automatically for customers on Enterprise Agreement, Microsoft Customer Agreement, or CSP.

To proceed, please

Confirm your Azure subscription type if it falls under (EA / MCA / CSP).
Retain the DPA / HIPAA documentation from the Service Trust Portal
Deploy the solution using HIPAA‑aligned configurations (U.S. regions, encryption, RBAC, private networking)

There is no additional BAA signing required unless models are accessed outside Azure.

References

HIPAA - Azure Compliance | Microsoft Learn

Licensing Documents

Regulatory Compliance details for HIPAA HITRUST - Azure Policy | Microsoft Learn

Please let me know if you have any questions.

Thank you!

Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

Share via

BAA for Azure Foundry models

2 answers

Your answer