Get answers to common questions about the Microsoft Discovery service.
Get started
Is Microsoft Discovery primarily an offline optimization and prediction platform, or are there capabilities for direct, real-time, closed-loop process control of physical scientific or manufacturing equipment?
Discovery is an online platform with human oversight. Researchers can change, edit, and kick off runs as needed. We're thinking about extending Microsoft Discovery to digital twins and lab automation using natural language, giving researchers more access to lab processes.
What is the Discovery Toolbox, and how do I get it?
The Discovery Toolbox is a Visual Studio Code extension that acts as a command center for setting up, managing, and operating the Azure infrastructure that Microsoft Discovery runs on. It's the fastest way to get started. From inside VS Code, it can:
- Deploy end to end—provision the full platform (virtual networks, supercomputers, workspaces, projects, chat models, storage, and managed identities) from a bundled, hardened Bicep template with live terminal output.
- Validate prerequisites—automatically check 100+ Azure prerequisites (RBAC roles, resource providers, quotas, policies, and network security perimeter) with one-click remediation.
- Publish agents and tools—create agents and containerized tools and build the tool images remotely through Azure Container Registry (ACR) Tasks, with no local Docker required.
- Inventory and clean up—run a subscription-wide scan of every Discovery resource, with per-resource delete and cascade tear-down.
- Visualize, monitor, and analyze cost—see your deployment topology as an interactive diagram, track per-resource costs, and review a diagnostics dashboard.
To install it, download the highest-numbered DiscoveryToolbox-v<version>.vsix from the vsix folder, then run Extensions: Install from VSIX from the VS Code Command Palette. Open the Discovery Toolbox icon in the Activity Bar and follow the guided Onboarding Journey.
For the other operator utilities—resource provider registration, RBAC role assignment, the supercomputer CLI, and deployment teardown—see the Tools and utilities section later in this article.
Infrastructure and deployment
What Azure resources are created when a Microsoft Discovery workspace is provisioned?
Provisioning a workspace creates a dedicated managed resource group (MRG) in your subscription that holds the workspace's backend resources, such as storage, Azure Cosmos DB, and Azure Container Apps. Additional system-created MRGs (for example, for Container Apps) can also appear.
The Bookshelf and the supercomputer are separate Discovery resources that you provision independently, and each gets its own managed resource group (for example, the supercomputer's AKS cluster lands in the supercomputer MRG). For more information, see Service architecture.
In whose subscription are the resources deployed?
All resources are deployed in your own (customer) subscription, not a Microsoft-managed subscription. You'll see a primary resource group (the control plane) and multiple managed resource groups (the data plane).
Is Azure Container Registry required?
No. Azure Container Registry is optional and is only needed when you bring your own tools (container images) to run on the supercomputer. For more information, see Azure Container Registry.
Which regions support Microsoft Discovery?
The control plane is currently available in East US, Sweden Central, and UK South. Managed resource group (data-plane) resources can be deployed in other regions by using cross-region deployment, which is useful when you have data-residency or capacity requirements. Cross-region deployment doesn't add significant latency, because workflow execution time dominates the overall response time.
Does Microsoft Discovery provide built-in backup or disaster recovery?
Not currently. Microsoft Discovery doesn't provide built-in automatic failover or disaster recovery. If you require higher availability and resiliency, deploy Microsoft Discovery across multiple regions and ensure that any stateful resources are appropriately replicated or backed up to meet your requirements. For more information, see Business continuity and disaster recovery.
Who pays for the Azure infrastructure?
You do. Because all resources are deployed into your own subscription, you pay for the underlying Azure infrastructure, which is the primary cost. For more information, see Billing.
How do I delete a Microsoft Discovery deployment, and in what order should resources be removed?
Use the deletion utility published in the public Discovery repo, delete-all-resources-2026-06-01.sh, rather than deleting resources by hand. It removes all Microsoft.Discovery and supporting Azure resources in a resource group by using the 2026-06-01 GA API version, in the correct dependency order. It also handles nuances such as clearing agent and tool links, unlinking supercomputers from workspaces, and cleaning up subnet delegations before it deletes the virtual network. Run it with --dry-run first to preview the deletion plan.
If you need to delete resources manually, follow the same dependency order that the script uses:
- Storage assets (
storageContainers/storageAssets) - Data-plane agents (per project)
- Projects
- Agents (clear blocking links first)
- Chat model deployments
- Tools (clear linked agent IDs first)
- Workflows
- Models
- Storage containers
- Workspace private endpoint connections
- Bookshelf private endpoint connections
- Unlink workspaces from supercomputers (set
supercomputerIdsto[]) - Workspaces
- Bookshelves
- Node pools
- Supercomputers
- Storage accounts
- User-assigned managed identities
- Virtual networks (remove subnet delegations and orphaned links first)
- Any remaining resources
- The resource group itself, once it's empty
This order avoids dependency failures—child resources must be removed before their parents, and workspaces must be unlinked from supercomputers before deletion.
Compute and the supercomputer
What is the supercomputer in Microsoft Discovery?
The supercomputer is a compute abstraction currently implemented on Azure Kubernetes Service (AKS). The AKS cluster and its node pools are deployed into a dedicated managed resource group. Tools aren't persistent resources—they're instantiated dynamically on the supercomputer when they're needed. For more information, see Supercomputer.
Which VM families can I use for the supercomputer node pools?
The system node pool has modest requirements (for example, Standard_D4s_v6, or a v5-family equivalent). For the compute node pool, you can use any region-available, quota-approved Azure VM CPU or GPU family that's well suited to your tools. Check quota and capacity for your target region before you deploy, because quota is allocated per region.
Network and security
Are Discovery services exposed publicly or privately?
Most backend resources are private and use private endpoints, a Network Security Perimeter (NSP), and virtual network injection. Backend resources in the managed resource groups aren't directly accessible from outside the environment. For more information, see Network security.
Is the Discovery Studio portal public or private?
The Discovery Studio portal UI is publicly accessible over the internet, similar to the Azure portal, and is secured with Microsoft Entra ID authentication. Backend data isn't exposed through public endpoints, and no internal or external DNS entries are required for the portal URL.
How do I turn on network isolation for a workspace?
Set networkIsolation to true on the workspace resource at deployment time. This setting deploys the hardened shape with an NSP and private endpoints across the workspace, Bookshelf, and supercomputer managed resource groups. The value is read during provisioning, so apply it when you create the workspace. For step-by-step guidance, see Configure network security.
What subnets does a hardened deployment need?
You pre-create the virtual network and dedicated subnets in your resource group before deployment. A typical hardened deployment uses separate subnets for the workspace, agents, private endpoints, Bookshelf search, and the supercomputer node pools. Size each subnet to your compute scale—a /24 is a common starting point, and supercomputer node pools might need more capacity. For more information, see Virtual networks.
Do I need to allow inbound access from Microsoft into my environment?
No. No explicit inbound access is required. All interactions occur within Container Apps, private endpoints, and internal Azure services.
Agents, models, and Foundry
How are Discovery agents implemented?
Agents are created as data-plane resources, with corresponding agents in Azure AI Foundry. Foundry executes the workflows that user prompts trigger. For more information, see Discovery agent.
Which models does Microsoft Discovery require?
Microsoft Discovery requires specific chat completion and text embedding model deployments across the Discovery Engine, agents, and the Bookshelf. Review the quota reservation guidance for the current required models and the minimum and recommended tokens-per-minute (TPM) quota per service. Multiply the Bookshelf values by the number of Bookshelf instances you plan to run.
Can I choose which models my agents use?
Yes. You can select different models for Discovery agents, subject to the minimum required models and any quota reservations. For more information, see Select models for agents.
Where do models run—Azure Machine Learning or the supercomputer?
Both are options. You can reuse an existing Azure Machine Learning workspace to host models, or, if a model is containerized, run it on the supercomputer. Choose based on whether you already have machine learning assets or prefer container-based execution.
Knowledge retrieval (Bookshelf and Azure AI Search)
What is the difference between Bookshelf (GraphRAG) and Azure AI Search?
Bookshelf runs a GraphRAG pipeline (OCR, normalization, embeddings, and graph-community detection). Its strength is deep, multi-hop, thematic insight that surfaces hidden relationships, but it needs a curated, connected dataset and is memory-intensive (about a 1-GB practical limit). Azure AI Search runs an index, embeddings, and agentic retrieval pipeline. Its strength is precise, local queries that work at large scale (100+ GB), but it doesn't provide graph or community reasoning. For more information, see Bookshelf knowledge bases.
Which retrieval tool should I use?
Use Azure AI Search for specific, factual lookups (local queries). Use Bookshelf (GraphRAG) for broad, thematic, discovery-oriented questions across a corpus (global queries). For production, a hybrid pattern works well: keep the full corpus in Azure AI Search, curate a small, connected subset for Bookshelf, and let an agent route each query to the right tool.
Can Bookshelf handle a 100+ GB corpus?
Not directly. A realistic Bookshelf input is about 1 GB of normalized text after extraction, because GraphRAG builds an in-memory graph. Keep the full corpus (100+ GB) in Azure AI Search and curate a small, high-quality subset for Bookshelf rather than ingesting everything. For context, roughly 6,000 research papers normalize to about 180 MB of text.
What document types does Bookshelf support?
Common document types include Word, PowerPoint, Excel, and PDF, covering content such as scientific reports, patents, and research articles.
Do scientists always need an agent to query a Bookshelf?
No. You can query a Bookshelf directly in natural language. Agents become relevant when a Bookshelf is used as grounding data in multi-step investigations. A good practice is to align specific Bookshelves to specific agents or domains for targeted retrieval.
Tools and utilities
Where can I find utilities to help operate a Microsoft Discovery deployment?
The public microsoft/discovery repo includes a set of standalone operator utilities. In addition to the Discovery Toolbox VS Code extension, the folder provides:
| Utility | What it does | When to use it |
|---|---|---|
| Resource provider registration | Registers every Azure resource provider that Discovery and its dependencies need in a target subscription (cross-platform PowerShell). | First step when onboarding a new subscription. |
| RBAC roles assignment | Assigns the complete set of Azure RBAC roles required for a Discovery persona (Platform Administrator or Scientist) to one or more users. | After provider registration, when granting users access. |
| Supercomputer CLI | Provides access to the Discovery supercomputer API for submitting and running jobs directly on the supercomputer. | Submitting jobs directly to the supercomputer. |
| Delete Discovery deployment | Deletes all Microsoft.Discovery and supporting Azure resources in a resource group, in strict dependency order, then removes the empty resource group. |
Tearing down a deployment (destructive). |
Each utility is self-contained, with its own README that documents prerequisites, parameters, and operational notes.
How do I register the Azure resource providers that Microsoft Discovery needs?
Use the resource provider registration utility, a cross-platform PowerShell script that registers every Azure resource provider that Discovery and its dependencies require in a target subscription. It auto-installs the Az.Accounts and Az.Resources modules and signs you in if needed. Running it is the recommended first step when onboarding a new subscription. The Discovery Toolbox can also perform and validate provider registration as part of its prerequisite checks.
How do I grant users the roles they need for Microsoft Discovery?
Use the RBAC roles assignment utility to assign the complete set of Azure RBAC roles required for a Discovery persona—Platform Administrator or Scientist—to one or more users. It validates the executor's permissions, supports batch assignment, and handles guest users. Run it after resource provider registration. The Discovery Toolbox surfaces the same role requirements through its permission auditing and role summary views.
How do I submit jobs directly to the supercomputer?
Use the Supercomputer CLI utility, which provides access to the Discovery supercomputer API for submitting and running jobs directly on the supercomputer compute pool.