Quickstart: Deploy Microsoft Discovery infrastructure

In this quickstart, you set up your Microsoft Discovery environment so that you can run your first AI-powered scientific investigation. You can complete the setup in two ways:

• Azure portal – Create each resource manually through a guided, step-by-step experience. Choose this path if you want to understand each component or you prefer a UI-driven workflow.
• Bicep – Deploy the full stack with a single infrastructure-as-code template. Choose this path if you want a repeatable, automated deployment.

Both paths provision the same core resources: networking, identity, storage, a supercomputer with a node pool, a workspace with a chat model deployment, a storage container, and a project.

Select the tab that matches your preferred experience under Deploy Microsoft Discovery infrastructure.

Prerequisites

The following prerequisites apply to both the Azure portal and Bicep experiences:

• An active Azure subscription that's enabled (allow-listed) for Microsoft Discovery access. If your subscription isn't yet enabled, contact your Microsoft account representative to request access.

• Sufficient permissions in your Azure subscription to register resource providers, assign roles, and create resources:

  • The Owner, Role Based Access Control Administrator, or User Access Administrator role is required to assign roles to administrators (Platform Admins, Scientists, and Engineers) who manage and use Discovery resources. For the full list of required roles, see Roles required by persona.

  • A Contributor or higher privileged role (for example, Owner) is required to register resource providers and create a resource group.

    Tip

    To assign the full Platform Administrator persona role set in a single, idempotent command, use the open-source Set-DiscoveryRoleAssignments.ps1 PowerShell script. See Assign Microsoft Discovery persona roles with a PowerShell script. This method is the recommended path for onboarding multiple users.

• Register the required resource providers in your subscription. For more information, see Resource provider registration. To register Microsoft.Discovery:

  1. Sign in to the Azure portal.
  2. Navigate to Subscriptions and select your subscription.
  3. In the left-hand menu, select Resource Providers.
  4. Search for Microsoft.Discovery.
  5. Select the provider name and select Register.

  Note

  Ensure that the following resource providers are also registered on your subscription. If not, register them: Microsoft.Network, Microsoft.Compute, Microsoft.Storage, Microsoft.ManagedIdentity, Microsoft.AlertsManagement, Microsoft.Authorization, Microsoft.CognitiveServices, Microsoft.ContainerInstance, Microsoft.ContainerRegistry, Microsoft.ContainerService, Microsoft.DocumentDB, Microsoft.Features, Microsoft.KeyVault, Microsoft.MachineLearningServices, Microsoft.OperationalInsights, Microsoft.ResourceGraph, Microsoft.Search, Microsoft.Web, Microsoft.Insights, Microsoft.Resources, Microsoft.Sql, Microsoft.App, Microsoft.Bing

• Assign the Discovery NSP Perimeter Joiner role. Microsoft Discovery workspaces, bookshelves, and supercomputers are network-hardened by default using Network Security Perimeter (NSP) rules. Before you create your first workspace, bookshelf, or supercomputer, you must create the Discovery NSP Perimeter Joiner custom role. Once created, assign the Discovery NSP Perimeter Joiner custom role and the Reader role to the Discovery control-plane service App (the first-party service principal) so the control plane can configure Network Security Perimeters in your subscription. For step-by-step instructions, see Assign the NSP Perimeter Joiner role.

• Microsoft Foundry, Azure OpenAI quotas, and VM SKU/quotas available in your chosen region. See Quota reservations.

• An existing resource group, or permissions to create a new one. Creating a resource group requires Contributor role on the subscription.

Important

Microsoft Discovery resources are supported in three production regions: East US, Sweden Central, and UK South. Create all resources for a single deployment in the same region, subscription, and resource group for simplicity.

Note

You can associate a virtual network with only one Microsoft Discovery workspace. If you need multiple workspaces, create a separate virtual network and subnets for each one.

Important

If you deploy the networking resources into a separate resource group from your other Discovery resources, make sure you assign yourself the appropriate permissions on the virtual network's resource group so that the supercomputer resource deploys successfully. The permissions to consider are Network Contributor and Microsoft Discovery Platform Administrator (Preview). If you use the Bicep template, update it to create the virtual network in that separate resource group.

Tip

You can deploy Discovery resources with complete network isolation. When networkIsolation is enabled, all resources are shielded within the private network and are reachable only through the private endpoint and Network Security Perimeter (NSP). You can still reach the workspace over the public network through Discovery Studio and the REST API. To lock down access to your private network only, disable public network access for your workspace and create private endpoints for the workspace resources. For guidance, see Configure network security for Microsoft Discovery workspaces.

Deploy Microsoft Discovery infrastructure

Select the Azure portal tab to create each resource manually, or the Bicep tab to deploy the full stack by using an infrastructure-as-code template.

Azure portal

Use the Azure portal to create each Microsoft Discovery resource through a guided experience.

1. Set up networking, identity, and storage

Before proceeding with the deployment of Microsoft Discovery infrastructure components, use an existing resource group or create a new one.

a. Assign roles to administrators

Tip

Instead of assigning the roles listed below one-by-one through the Azure portal, you can assign the full Platform Administrator persona role set in a single, idempotent command using the open-source Set-DiscoveryRoleAssignments.ps1 PowerShell script. See Assign Microsoft Discovery persona roles with a PowerShell script. This is the recommended path for onboarding multiple users.

Assign the following built-in roles to users at the desired scope (subscription or resource group):

• Microsoft Discovery Platform Administrator (Preview)
• Managed Identity Contributor
• Managed Identity Operator
• Storage Account Contributor
• Storage Blob Data Contributor
• Network Contributor
• ACRPush
• Foundry User
• Microsoft Discovery Bookshelf Index Data Reader (Preview)

Note

If you're assigning all roles at the subscription level, you can skip this note. If you're assigning roles at the resource group level, skip the Foundry User role for now. Continue with the next steps and revisit this role assignment after the workspace resource is created. This role must be assigned to each Platform Admin or Scientist user at the workspace managed resource group level.

Steps to assign roles:

1. Sign in to the Azure portal.
2. Navigate to Subscriptions and select your subscription.
3. In the left-hand menu, select Access control (IAM).
4. Select Add, then select Add role assignment.
5. On the Add role assignment pane, search for each role one at a time, then select Next.
6. On the Members tab, ensure Assign access to is set to User, group, or service principal.
7. Select + Select members, choose the members to assign this permission to, then select Next.
8. On the Conditions tab, select Allow user to assign all roles except privileged administrator roles Owner, UAA, RBAC (Recommended), then select Next.
9. On the Assignment Type tab, select the configuration that best suits your organization, then select Next.
10. On the Review + assign tab, verify the information, and select Review + assign.

Repeat this process for all the required roles.

b. Create a virtual network and subnets

1. Sign in to the Azure portal.
2. Search for Virtual networks and select it from the results.
3. Select Create to start creating a new virtual network.
4. Enter details such as Subscription, Resource Group, Name, and Region, then select Next.
5. Configure IP addresses:
   • IPv4 address space: Enter your chosen CIDR (Classless Inter-Domain Routing) block (for example, 10.0.0.0/16).
   • Add the following subnets:
     • supercomputerNodepoolSubnet: 10.0.1.0/24
     • aksSubnet: 10.0.2.0/24
     • workspaceSubnet: 10.0.3.0/24
     • privateEndpointSubnet: 10.0.4.0/24
     • agentSubnet: 10.0.5.0/24
     • searchSubnet: 10.0.6.0/24
6. For workspaceSubnet, agentSubnet and searchSubnet, under SubnetDelegation, select Microsoft.App/environments.
7. For workspaceSubnet, agentSubnet, supercomputerNodepoolSubnet, and aksSubnet, under Service Endpoints, add Microsoft.Storage.
8. Optionally, you can remove the default subnet from the list.
9. Review and create the virtual network.

Note

Network Security Groups (NSGs) aren't mentioned in this step, but it's a general best practice to implement NSGs for each subnet in a virtual network, depending on your organization's policies.

c. Create a user assigned managed identity (UAMI)

You can create different UAMIs each with their own required permissions for specific resource access, or you can create a single UAMI with all necessary permissions for the platform. For this exercise, create a single UAMI by following these steps:

1. Sign in to the Azure portal.
2. Search for Managed Identities and select it from the list.
3. Select Create.
4. Fill in the required details such as subscription, resource group, region, and name.
5. Select Review + Create, then select Create.

d. Assign Azure Role Based Access Control (RBAC) roles to UAMI

Assign the following built-in roles to the new User Assigned Managed Identity at Resource Group level:

• Microsoft Discovery Platform Contributor (Preview)
• Storage Blob Data Contributor
• ACRPull

1. Navigate to Subscriptions and select your subscription.
2. Select the resource group that you're using for this exercise.
3. In the left-hand menu, select Access control (IAM).
4. Select Add, then select Add role assignment.
5. On the Add role assignment pane, search for each role one at a time, then select Next.
6. On the Members tab, ensure Assign access to is set to Managed Identity.
7. Select + Select members. In the Select managed identities pane, select your subscription, select User-assigned managed identity type, select the managed identity you created in the previous step, then select Select.
8. On the Review + assign tab, verify all the information, and select Review + assign.

e. Create an Azure Blob Storage account

To store input and output data for your investigations, create an Azure blob storage account to associate with your storage container or use an existing one with the following requirements:

• Create a container within the storage account named discoveryoutputs where the output files are stored.
• The storage account must allow access from the Virtual Network used to create the supercomputer and workspace.
• The storage account must allow access from your client public IP or local network so you can access the output data.
• The storage account must have the correct CORS settings. You must allow these origins: https://studio.discovery.microsoft.com, https://vscode.dev, and https://*.vscode-cdn.net. Set the allowed operations to include GET, HEAD, DELETE, and PUT and set Allowed Headers and Exposed Headers to *, and Max Age to 200. This setting is found under the Resource sharing (CORS) page under the Settings tab.
• Ensure that the storage account has Storage Blob Data Contributor access to the UAMI created in the previous step.

To create an Azure blob storage account:

1. Sign in to the Azure portal.
2. Search for Storage accounts and select it from the results.
3. Select Create to start creating a new storage account.
4. Enter details such as Subscription, Resource Group, Name, and Region.
5. Select Azure Blob Storage as the primary service, then select the Networking tab.
6. Under public network access, select Enable public access from selected virtual networks and IP addresses.
7. Select the Virtual Network and all subnets created in step 1.
8. Select Add your client IP address if you're accessing data over the internet, or ensure your client can access the storage account and virtual network via private link, Site-to-Site VPN, or ExpressRoute.
9. Select Review + create, then select Create.

Note

To view and download output files, your client or browser needs network access to the blob storage. You can allow public internet access by opening public access to all networks. You can also allow your client's public IP address in the storage networking and firewall settings. Alternatively, configure private access via Azure VPN or ExpressRoute.

Create a blob container

1. After the storage account is created, navigate to the storage account overview page.
2. In the left navigation pane, under Data storage, select Containers.
3. Select Add container.
4. Enter discoveryoutputs as the name and select Create.

Enable CORS and UAMI access

1. Open the storage account we created in the previous step.
2. Under the Settings tab, select Resource sharing (CORS).
3. Under Blob service in the Allowed origins column, enter https://studio.discovery.microsoft.com, https://vscode.dev, and https://*.vscode-cdn.net. For all three, set the allowed operations to include GET, HEAD, DELETE, OPTIONS, and PUT. Set Allowed Headers and Exposed Headers to *, and Max Age to 200.
4. Select Save.

2. Create a supercomputer

You need a supercomputer with associated node pools to deploy and run scientific tools, and to index your data in Bookshelf knowledge bases. The supercomputer also executes GPU and CPU intensive workloads for simulation and modeling. It provides the compute resources on a specific virtual network within your subscription.

1. Sign in to the Azure portal.
2. Search for Microsoft Discovery Supercomputers.
3. Select Create and enter details such as Subscription ID, Resource Group name, Location, and Name, then select Next.
4. In the Networking tab, select the virtual network and aksSubnet that you created in step 1, and then select Next.
5. In the System SKU tab, select Standard_D4s_v6 as the System SKU for this deployment and select Next.
6. In the Identities tab, add the user assigned managed identity (UAMI) that you created in step 1 for the cluster identity, kubelet identity, and workload identity. Supercomputer instances use this managed identity to access data from your Azure resources. When you finish, select Next.
7. In the Encryption tab, since we're using Microsoft-managed keys for this exercise, uncheck the "Enable Customer Managed Keys" option and select Next.
8. Add tags as needed, and move to the next tab.
9. Review the Terms and Conditions and select Next.
10. Once validation is successful, select Create.

3. Create node pools

After your supercomputer is created, follow these steps to create a node pool:

1. Open the Supercomputer that we created in the previous step.
2. In the left pane, select Node pool under Settings, then select Create.
3. Enter the name and location for the node pool, then select Next.

   Note

   Node pool names must be all lowercase, a maximum of 12 characters, must start with a letter, and can only contain letters and numbers.

4. On the Networking tab, select the virtual network and supercomputerNodepoolSubnet that you created in step 1, and select Next. Note: Use the same virtual network selected for the supercomputer in step 2.
5. On the VM configuration tab, select the Virtual Machine (VM) SKU to use for the node pool, then select Next. The selected SKU and quota must be available in the region where you deploy the node pool.
6. In the Scaling section, enter the maximum node count that your node pool can scale to, for example: 5 and select Next.
7. Select Review + Create and Create.

4. Create a workspace

A workspace is a collaborative environment where teams manage large-scale scientific initiatives. Workspaces bring together the infrastructure resources such as supercomputers, agents, tools, and knowledge bases (Bookshelves) into a single secure boundary. You can create projects under workspaces, allowing researchers to organize experiments, analyze data, and use AI agents within a shared space.

Important

Make sure your workspace name is globally unique and uses only lowercase letters.

1. Sign in to the Azure portal.

2. Search for Microsoft Discovery Workspaces.

3. Select + Create and enter details such as Subscription, Resource Group, Name, and Region, then select Next.

4. On the Networking tab, select Public network access as Enable for this exercise. After that, enter the details for Private Endpoint subnet, Agent subnet, and Workspace subnet with the subnets you created earlier in step 1, and then select Next.

5. On the Encryption tab, leave the Enable customer-managed keys (CMK) unchecked. For this exercise, we'll use Microsoft-Managed Keys (MMK), just select Next to go to the next tab.

6. On the Supercomputer tab, select Add Supercomputer and select your subscription, resource group, and the supercomputer created in step 2, then select Next.

7. On the Workspace Identity tab, select Add under User Assigned Managed Identity (UAMI) and select the identity you created in step 1 to provide access to the workspace.

8. On the Tags tab, add tags as needed. (Optional) To enable GitHub Copilot and configure workspace access, add the following tags. For details, see Use GitHub Copilot in Microsoft Discovery.

   • discovery.workbench.enableGhcpAiFeatures set to true — Enables GitHub Copilot and AI features for the workspace.
   • discovery.workbench.enableExtensions set to true — Enables the VS Code Extension Marketplace in the preview experience.
   • NetworkIsolation set to false — Enables public access to the preview experience (workbench) and other managed resource group (MRG) resources. If you keep network isolation enabled (default), you need to be connected on a VPN or ExpressRoute to the virtual network where the workspace is deployed to access over private network.

   Tip

   You can deploy Discovery resources with complete network isolation. When networkIsolation is enabled, all resources are shielded within the private network and are reachable only through the private endpoint and Network Security Perimeter (NSP). You can still reach the workspace over the public network through Discovery Studio and the REST API. To lock down access to your private network only, disable public network access for your workspace and create private endpoints for the workspace resources. For guidance, see Configure network security for Microsoft Discovery workspaces.

   Note

   Tags are immutable for Microsoft Discovery resource types, including workspaces, supercomputers, node pools, and bookshelves. After a resource is created, you can't add, change, or remove its tags. Any tag modification, including adding a tag, requires redeploying the resource.

9. Review the Terms and Conditions, then select Review + Create.

10. Once validation is successful, select Create.

5. Assign Foundry User role on the managed resource group

When a workspace is created, a managed resource group is automatically provisioned alongside it. To allow users to modify agents and workflows within a project directly in Foundry portal for advanced settings, you must assign them the Foundry User role on this managed resource group.

1. Sign in to the Azure portal.
2. Go to the workspace you created in step 4 and find the Managed Resource Group name on the workspace overview page.
3. Navigate to that managed resource group.
4. In the left-hand menu, select Access control (IAM).
5. Select Add, then select Add role assignment.
6. On the Add role assignment pane, search for Foundry User and select it, then select Next.
7. On the Members tab, ensure Assign access to is set to User, group, or service principal.
8. Select + Select members, choose the users who need to modify agents and workflows, then select Select.
9. Select Review + assign, verify the information, and select Review + assign.

Repeat this process for all users who require access to agents and workflows in the workspace. Any changes made in Foundry portal directly are reflected in Discovery agent configuration automatically.

6. Create Chat Model Deployment

Chat model deployments provision foundational language models such as GPT-5.4 for use within the Microsoft Discovery Workspace. Agents created within projects can use these chat model deployments.

1. Go to the overview page of Microsoft Discovery workspace, created in the previous step.

2. Under the Settings tab on left navigation pane, select Chat Model Deployments.

3. Select the + Create option at the top.

4. Enter the Name as gpt-5-4.

5. Select the Model Format as OpenAI and Model Name as gpt-5.4 in the drop-down.

6. Then select Review + create button at the bottom and select Create.

   

Important

To use Discovery Engine and tasks within your sessions, you must use this specific deployment with name gpt-5-4 and model name gpt-5.4. However, you can have additional chat model deployments for use with agents.

You can provide access to users via Role Based Access Control (RBAC) at the resource group level. Microsoft Discovery Administrator (Preview) role is required to create projects within a workspace.

7. Sign in to Microsoft Discovery Studio

Microsoft Discovery Studio is a secure, AI-powered research environment. It enables scientists and engineers to accelerate innovation through autonomous agents, simulation workflows, and integrated data tools within a unified interface.

After your infrastructure is set up, you can sign in to Microsoft Discovery Studio directly via the URL, or find the URL in the Workspace overview page in the Azure portal.

You must sign in with your Microsoft Entra ID credentials for your work or school account. Studio supports single sign-on with Microsoft Entra ID. You don't have to explicitly provide credentials if you're already signed in to another service with your Microsoft Entra ID in the same browser.

Note

If you have access to multiple Microsoft Entra tenants, select the right tenant by selecting your profile icon on the top right corner of the page.

8. Create storage containers

After you sign in to the studio, create storage containers to organize and manage your storage assets used in your projects.

Storage containers store both input and output data as storage assets. Both inputs and outputs use a storage container of type Azure Storage Blob, backed by the storage account created in step 1.

1. In Microsoft Discovery Studio, on the left navigation pane, select the Data tab.
2. Storage Containers (new) tab is selected by default.
3. Select Create Container.
4. Enter details such as name, subscription, resource group, and location.
5. Select the storage account created in step 1.
6. Select Create.

Note

After you select Create, the resource is initially in the Accepted state. Refresh the page and wait until the Provisioning State changes to Succeeded before proceeding. This operation typically takes a few minutes.

9. Create a project

Projects help you organize and manage scientific investigations within a workspace. Each project defines the functional boundary for access to your agents, tools, and storage containers. Within a project, you can run experiments, analyze data, apply AI models, and track research progress in a collaborative environment.

Important

Your project name must be all lowercase and no more than 12 characters long. Also, ensure you refresh the page before you create a project. You can create a project by opening your workspace in the studio.

1. In Microsoft Discovery Studio, on the left navigation pane, select Workspaces. This lists all existing workspaces across your Azure subscriptions.

2. Select the workspace you created in step 4. This action opens your workspace in the studio.

3. Select Create Project.

4. Enter the name of the project and select the storage container you created in step 8.

5. Select Create.

   

Note

After you select Create, the project is initially in the Accepted state. Refresh the page and wait until the Provisioning State changes to Succeeded before proceeding.

Bicep

Use Bicep to deploy the prerequisite infrastructure for Microsoft Discovery. The deployment creates the foundational Azure resources required before you can use a Discovery workspace, supercomputer, and projects.

Bicep is a domain-specific language (DSL) that uses declarative syntax to deploy Azure resources. It provides concise syntax, reliable type safety, and support for code reuse. Bicep offers the best authoring experience for your infrastructure-as-code solutions in Azure.

Review the Bicep file

This quickstart uses a Bicep file from Azure Quickstart Templates.

In this quickstart, you deploy the full Microsoft Discovery stack into Sweden Central. The deployment creates a virtual network with a 10.0.0.0/16 address space and five subnets for supercomputer node pools, AKS, workspace, private endpoints, and agents. The deployment provisions a Standard_LRS storage account with CORS rules enabled for Discovery Studio and VS Code. It creates a user-assigned managed identity with Storage Blob Data Contributor, Discovery Platform Contributor, and AcrPull role assignments. The core Discovery resources include a supercomputer with a Standard_D4s_v6 node pool (scaling from 0 to 3 nodes), a workspace with a chat model deployment, a storage container, and a project.

Note

Enable the unified Workbench (preview). The unified Workbench, which includes GitHub Copilot and AI features, is in preview. To enable it, deploy your workspace with the tags discovery.workbench.enableGhcpAiFeatures: true and discovery.workbench.enableExtensions: true. How you access the Workbench depends on the workspace's networkIsolation setting:

• When networkIsolation is set to false, the Workbench works out of the box.
• When networkIsolation is set to true, you must establish a VPN (or ExpressRoute) connection to the virtual network where the workspace is deployed.

For more information, see Use GitHub Copilot in Microsoft Discovery.

Note

Tags are immutable for Microsoft Discovery resource types, including workspaces, supercomputers, node pools, and bookshelves. After a resource is created, you can't add, change, or remove its tags. Define all required tags in the template before you deploy; any tag modification, including adding a tag, requires redeploying the resource.

@description('Azure region for all resources. Must be a Discovery-supported region.')
@allowed([
  'eastus'
  'swedencentral'
  'uksouth'
])
param location string = 'swedencentral'

@description('Name of the Microsoft Discovery Supercomputer. Must be 3-24 characters, alphanumeric and hyphens only.')
@minLength(3)
@maxLength(24)
param supercomputerName string = 'sc-${uniqueString(resourceGroup().id)}'

@description('Name of the Node Pool created under the Supercomputer. Must be 1-12 lowercase alphanumeric characters, starting with a letter.')
@minLength(1)
@maxLength(12)
param nodePoolName string = 'nodepool1'

@description('Name of the Microsoft Discovery Workspace. Must be 3-24 characters, alphanumeric and hyphens only.')
@minLength(3)
@maxLength(24)
param workspaceName string = 'ws-${uniqueString(resourceGroup().id)}'

@description('Name of the Chat Model Deployment created under the Workspace.')
@minLength(3)
@maxLength(24)
param chatModelDeploymentName string = 'gpt-5-4'

@description('Name of the Microsoft Discovery Storage Container resource. Must be 3-24 characters, alphanumeric and hyphens only.')
@minLength(3)
@maxLength(24)
param storageContainerName string = 'stc-${uniqueString(resourceGroup().id)}'

@description('Name of the Project created under the Workspace. Must be 3-24 characters, alphanumeric and hyphens only.')
@minLength(3)
@maxLength(24)
param projectName string = 'prj-${uniqueString(resourceGroup().id)}'

@description('Name of the Virtual Network. Must be 2-64 characters: letters, numbers, underscores, periods, or hyphens; must start with a letter or number and end with a letter, number, or underscore.')
@minLength(2)
@maxLength(64)
param vnetName string = 'discovery-vnet'

@description('Name of the User-Assigned Managed Identity.')
param managedIdentityName string = 'uami-${uniqueString(resourceGroup().id)}'

@description('Globally unique name of the Azure Storage Account (3-24 lowercase alphanumeric characters).')
@minLength(3)
@maxLength(24)
param storageAccountName string = 'stg${uniqueString(resourceGroup().id)}'

@description('Name of the blob container inside the Storage Account used for Discovery outputs.')
param blobContainerName string = 'discoveryoutputs'

@description('Replication SKU for the Storage Account. Zone/geo-redundant options are recommended over locally-redundant storage for resiliency.')
@allowed([
  'Standard_ZRS'
  'Standard_GRS'
  'Standard_GZRS'
  'Standard_RAGRS'
  'Standard_RAGZRS'
])
param storageAccountSku string = 'Standard_GRS'

@description('Address space for the Virtual Network.')
param vnetAddressPrefix string = '10.0.0.0/16'

@description('Address prefix for the Supercomputer Node Pool subnet.')
param supercomputerNodepoolSubnetPrefix string = '10.0.1.0/24'

@description('Address prefix for the AKS system subnet used by the Supercomputer.')
param aksSubnetPrefix string = '10.0.2.0/24'

@description('Address prefix for the Workspace subnet (delegated to Microsoft.App/environments).')
param workspaceSubnetPrefix string = '10.0.3.0/24'

@description('Address prefix for the Private Endpoint subnet.')
param privateEndpointSubnetPrefix string = '10.0.4.0/24'

@description('Address prefix for the Agent subnet.')
param agentSubnetPrefix string = '10.0.5.0/24'

@description('Address prefix for Search Subnet.')
param searchSubnetPrefix string = '10.0.6.0/24'

@description('VM SKU for the Node Pool.')
param nodePoolVmSize string = 'Standard_D4s_v6'

@description('Maximum number of nodes in the Node Pool.')
@minValue(1)
param nodePoolMaxNodeCount int = 3

@description('Minimum number of nodes in the Node Pool (0 allows scale-to-zero).')
@minValue(0)
param nodePoolMinNodeCount int = 0

@description('Scale set priority for the Node Pool.')
@allowed([
  'Regular'
  'Spot'
])
param nodePoolScaleSetPriority string = 'Regular'

@description('Chat model format.')
param chatModelFormat string = 'OpenAI'

@description('Chat model name to deploy.')
param chatModelName string = 'gpt-5.4'

@description('Enable GitHub Copilot and AI features in the Discovery workspace via the discovery.workbench.enableGhcpAiFeatures tag.')
param enableGhcpAiFeatures bool = true

@description('Enable the VS Code Extension Marketplace in the Discovery workspace via the discovery.workbench.enableExtensions tag.')
param enableExtensions bool = true

@description('Workspace network isolation mode via the NetworkIsolation tag. Set to false to enable public preview access as documented in the Infrastructure portal quickstart.')
param networkIsolation bool = true

// Built-in role definition IDs
var storageBlobDataContributorRoleId = 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
var discoveryPlatformContributorRoleId = '01288891-85ee-45a7-b367-9db3b752fc65'
var acrPullRoleId = '7f951dda-4ed3-4680-a7ca-43fe172d538d'

resource vnet 'Microsoft.Network/virtualNetworks@2024-05-01' = {
  name: vnetName
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: [
        vnetAddressPrefix
      ]
    }
    subnets: [
      {
        name: 'supercomputerNodepoolSubnet'
        properties: {
          addressPrefix: supercomputerNodepoolSubnetPrefix
          serviceEndpoints: [
            {
              service: 'Microsoft.Storage'
            }
          ]
        }
      }
      {
        name: 'aksSubnet'
        properties: {
          addressPrefix: aksSubnetPrefix
          serviceEndpoints: [
            {
              service: 'Microsoft.Storage'
            }
          ]
        }
      }
      {
        name: 'workspaceSubnet'
        properties: {
          addressPrefix: workspaceSubnetPrefix
          delegations: [
            {
              name: 'Microsoft.App.environments'
              properties: {
                serviceName: 'Microsoft.App/environments'
              }
            }
          ]
          serviceEndpoints: [
            {
              service: 'Microsoft.Storage'
            }
          ]
        }
      }
      {
        name: 'privateEndpointSubnet'
        properties: {
          addressPrefix: privateEndpointSubnetPrefix
        }
      }
      {
        name: 'agentSubnet'
        properties: {
          addressPrefix: agentSubnetPrefix
          delegations: [
            {
              name: 'Microsoft.App.environments'
              properties: {
                serviceName: 'Microsoft.App/environments'
              }
            }
          ]
          serviceEndpoints: [
            {
              service: 'Microsoft.Storage'
            }
          ]
        }
      }
      {
        name: 'searchSubnet'
        properties: {
          addressPrefix: searchSubnetPrefix
          delegations: [
            {
              name: 'Microsoft.App.environments'
              properties: {
                serviceName: 'Microsoft.App/environments'
              }
            }
          ]
          serviceEndpoints: [
            {
              service: 'Microsoft.Storage'
            }
          ]
        }
      }
    ]
  }
}

resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' = {
  name: managedIdentityName
  location: location
  properties: {
    isolationScope: 'Regional'
  }
}

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-05-01' = {
  name: storageAccountName
  location: location
  kind: 'StorageV2'
  sku: {
    name: storageAccountSku
  }
  dependsOn: [
    vnet
  ]
  properties: {
    accessTier: 'Hot'
    allowBlobPublicAccess: false
    allowSharedKeyAccess: false
    minimumTlsVersion: 'TLS1_2'
    supportsHttpsTrafficOnly: true
    // NOTE: defaultAction is intentionally 'Allow'. 
    networkAcls: {
      defaultAction: 'Allow'
      bypass: 'AzureServices'
      virtualNetworkRules: [
        {
          id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnetName, 'supercomputerNodepoolSubnet')
          action: 'Allow'
        }
        {
          id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnetName, 'aksSubnet')
          action: 'Allow'
        }
        {
          id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnetName, 'workspaceSubnet')
          action: 'Allow'
        }
        {
          id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnetName, 'agentSubnet')
          action: 'Allow'
        }
        {
          id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnetName, 'searchSubnet')
          action: 'Allow'
        }
      ]
    }
  }
}

resource blobServices 'Microsoft.Storage/storageAccounts/blobServices@2023-05-01' = {
  parent: storageAccount
  name: 'default'
  properties: {
    cors: {
      corsRules: [
        {
          allowedOrigins: [
            'https://studio.discovery.microsoft.com'
            'https://*.vscode-cdn.net'
            'https://vscode.dev'
          ]
          allowedMethods: [
            'GET'
            'HEAD'
            'DELETE'
            'PUT'
          ]
          allowedHeaders: [
            '*'
          ]
          exposedHeaders: [
            '*'
          ]
          maxAgeInSeconds: 200
        }
      ]
    }
  }
}

resource blobContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-05-01' = {
  parent: blobServices
  name: blobContainerName
  properties: {
    publicAccess: 'None'
  }
}

resource storageBlobDataContributorAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(storageAccount.id, managedIdentity.id, storageBlobDataContributorRoleId)
  scope: storageAccount
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', storageBlobDataContributorRoleId)
    principalId: managedIdentity.properties.principalId
    principalType: 'ServicePrincipal'
  }
}

resource discoveryPlatformContributorAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, managedIdentity.id, discoveryPlatformContributorRoleId)
  properties: {
    roleDefinitionId: subscriptionResourceId(
      'Microsoft.Authorization/roleDefinitions',
      discoveryPlatformContributorRoleId
    )
    principalId: managedIdentity.properties.principalId
    principalType: 'ServicePrincipal'
  }
}

resource acrPullAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, managedIdentity.id, acrPullRoleId)
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', acrPullRoleId)
    principalId: managedIdentity.properties.principalId
    principalType: 'ServicePrincipal'
  }
}

resource supercomputer 'Microsoft.Discovery/supercomputers@2026-06-01' = {
  name: supercomputerName
  location: location
  tags: {
    version: 'v2'
  }
  dependsOn: [
    vnet
  ]
  properties: {
    subnetId: resourceId('Microsoft.Network/virtualNetworks/subnets', vnetName, 'aksSubnet')
    identities: {
      clusterIdentity: {
        id: managedIdentity.id
      }
      kubeletIdentity: {
        id: managedIdentity.id
      }
      workloadIdentities: {
        '${managedIdentity.id}': {}
      }
    }
  }
}

resource nodePool 'Microsoft.Discovery/supercomputers/nodePools@2026-06-01' = {
  parent: supercomputer
  name: nodePoolName
  location: location
  dependsOn: [
    vnet
  ]
  properties: {
    subnetId: resourceId('Microsoft.Network/virtualNetworks/subnets', vnetName, 'supercomputerNodepoolSubnet')
    vmSize: nodePoolVmSize
    maxNodeCount: nodePoolMaxNodeCount
    minNodeCount: nodePoolMinNodeCount
    scaleSetPriority: nodePoolScaleSetPriority
  }
}

resource workspace 'Microsoft.Discovery/workspaces@2026-06-01' = {
  name: workspaceName
  location: location
  tags: {
    version: 'v2'
    'discovery.workbench.enableGhcpAiFeatures': string(enableGhcpAiFeatures)
    'discovery.workbench.enableExtensions': string(enableExtensions)
    NetworkIsolation: string(networkIsolation)
  }
  dependsOn: [
    vnet
  ]
  properties: {
    workspaceIdentity: {
      id: managedIdentity.id
    }
    supercomputerIds: [
      supercomputer.id
    ]
    agentSubnetId: resourceId('Microsoft.Network/virtualNetworks/subnets', vnetName, 'agentSubnet')
    privateEndpointSubnetId: resourceId('Microsoft.Network/virtualNetworks/subnets', vnetName, 'privateEndpointSubnet')
    workspaceSubnetId: resourceId('Microsoft.Network/virtualNetworks/subnets', vnetName, 'workspaceSubnet')
  }
}

resource chatModelDeployment 'Microsoft.Discovery/workspaces/chatModelDeployments@2026-06-01' = {
  parent: workspace
  name: chatModelDeploymentName
  location: location
  properties: {
    modelFormat: chatModelFormat
    modelName: chatModelName
  }
}

resource discoveryStorageContainer 'Microsoft.Discovery/storageContainers@2026-06-01' = {
  name: storageContainerName
  location: location
  properties: {
    storageStore: {
      kind: 'AzureStorageBlob'
      storageAccountId: storageAccount.id
    }
  }
}

resource project 'Microsoft.Discovery/workspaces/projects@2026-06-01' = {
  parent: workspace
  name: projectName
  location: location
  dependsOn: [
    chatModelDeployment
  ]
  properties: {
    storageContainerIds: [
      discoveryStorageContainer.id
    ]
  }
}

@description('Resource ID of the Supercomputer.')
output supercomputerId string = supercomputer.id

@description('Resource ID of the Node Pool.')
output nodePoolId string = nodePool.id

@description('Resource ID of the Workspace.')
output workspaceId string = workspace.id

@description('Resource ID of the Chat Model Deployment.')
output chatModelDeploymentId string = chatModelDeployment.id

@description('Resource ID of the Discovery Storage Container.')
output storageContainerId string = discoveryStorageContainer.id

@description('Resource ID of the Project.')
output projectId string = project.id

@description('Resource ID of the User-Assigned Managed Identity.')
output managedIdentityId string = managedIdentity.id

@description('Resource ID of the Storage Account.')
output storageAccountId string = storageAccount.id

@description('Resource ID of the Virtual Network.')
output vnetId string = vnet.id

The Bicep file defines multiple Azure resources:

• Microsoft.Network/virtualNetworks - Virtual network with five subnets for supercomputer node pool, AKS, workspace, private endpoint, and agent workloads.
• Microsoft.ManagedIdentity/userAssignedIdentities - User-assigned managed identity for supercomputer and workspace authentication.
• Microsoft.Storage/storageAccounts - Azure Blob Storage account with CORS rules for Discovery Studio and VS Code integrations.
• Microsoft.Authorization/roleAssignments - Storage Blob Data Contributor, Discovery Platform Contributor, and AcrPull role assignments for the managed identity.
• Microsoft.Discovery/supercomputers - Supercomputer resource with cluster, kubelet, and workload identities.
• Microsoft.Discovery/supercomputers/nodePools - Configurable node pool with VM size, min/max node count, and scale set priority.
• Microsoft.Discovery/workspaces - Workspace linked to the supercomputer with agent, private endpoint, and workspace subnets.
• Microsoft.Discovery/workspaces/chatModelDeployments - Chat model deployment under the workspace.
• Microsoft.Discovery/storageContainers - Storage container backed by the Azure Blob Storage account.
• Microsoft.Discovery/workspaces/projects - Project linked to the storage container.

Deploy the Bicep file

1. Save the Bicep file as main.bicep on your local computer.

2. Replace the <prescribedSCName> and <presecribedWSName> placeholders with the supercomputer and workspace names you want to use. Update the location parameter if you're deploying to a region other than swedencentral.

3. Deploy the Bicep file by using either Azure CLI or Azure PowerShell.

   Azure CLI

   az group create --name exampleRG --location swedencentral
   az deployment group create --resource-group exampleRG --template-file main.bicep --parameters location=swedencentral supercomputerName=<prescribedSCName> workspaceName=<presecribedWSName>
   

   Azure PowerShell

   New-AzResourceGroup -Name exampleRG -Location swedencentral
   New-AzResourceGroupDeployment -ResourceGroupName exampleRG -TemplateFile ./main.bicep -location swedencentral -supercomputerName <prescribedSCName> -workspaceName <presecribedWSName>
   

When the deployment finishes, you see a message indicating the deployment succeeded.

Validate the deployment

Use the Azure portal, Azure CLI, or Azure PowerShell to list the deployed resources in the resource group.

Azure CLI

az resource list --resource-group exampleRG

Azure PowerShell

Get-AzResource -ResourceGroupName exampleRG

Clean up resources

When you no longer need the resources, use the Azure portal, Azure CLI, or Azure PowerShell to delete all the resources in the resource group.

Azure CLI

az group delete --name exampleRG

Azure PowerShell

Remove-AzResourceGroup -Name exampleRG

Next step

After you set up your infrastructure and create your project, continue with the following next step:

• Get started with agents and shared sessions in Microsoft Discovery Studio