Study guide
10.1 Create and Configure Foundry Resources and Project Environments
Microsoft AI-300: Operationalizing Machine Learning and Generative AI Solutions Exam
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 Skills Measured, Format, and How This Guide Is Organized 1.3 Candidate Profile, Azure ML v2, Foundry, and DevOps Tooling
2 Chapter 2: Azure Machine Learning Workspaces, Datastores, Compute, and IAM
2.1 Create and Manage Azure Machine Learning Workspaces 2.2 Create and Manage Datastores 2.3 Create and Manage Compute Targets 2.4 Configure Identity and Access Management for Workspaces
3 Chapter 3: Azure Machine Learning Data Assets, Environments, Components, and Registries
3.1 Create and Manage Data Assets 3.2 Create and Manage Environments 3.3 Create and Manage Components 3.4 Share Assets Across Workspaces with Registries
4 Chapter 4: Infrastructure as Code, GitHub, and Network Isolation for Azure ML
4.1 GitHub Integration and Git Source Control for Machine Learning Projects 4.2 Deploy Workspaces and Resources with Bicep and Azure CLI 4.3 Automate Resource Provisioning with GitHub Actions 4.4 Restrict Network Access to Machine Learning Workspaces
5 Chapter 5: MLflow Tracking, AutoML, Training Jobs, and Hyperparameter Sweeps
5.1 Configure Experiment Tracking with MLflow 5.2 Use Automated Machine Learning to Explore Optimal Models 5.3 Notebooks, Command Jobs, and Training Scripts 5.4 Automate Hyperparameter Tuning
6 Chapter 6: Distributed Training, Training Pipelines, and Job Comparison
6.1 Manage Distributed Training for Large and Deep Learning Models 6.2 Implement Training Pipelines 6.3 Compare Model Performance Across Jobs
7 Chapter 7: Model Registration, Responsible AI, and Lifecycle Management
7.1 Register MLflow Models and Package Feature Retrieval Specs 7.2 Evaluate Models with Responsible AI Principles 7.3 Manage Model Lifecycle and Archiving
8 Chapter 8: Online Endpoints, Batch Endpoints, Rollout, and Rollback
8.1 Deploy Models to Managed Online Endpoints 8.2 Deploy Models to Batch Endpoints 8.3 Test, Troubleshoot, Progressive Rollout, and Safe Rollback
9 Chapter 9: Data Drift, Production Metrics, Retraining, and Alerts
9.1 Detect and Analyze Data Drift 9.2 Monitor Production Metrics and Trigger Retraining or Alerts
10 Chapter 10: Microsoft Foundry Resources, IAM, Networking, and IaC
10.1 Create and Configure Foundry Resources and Project Environments 10.2 Managed Identities and RBAC for Foundry 10.3 Foundry Network Security and Private Networking 10.4 Deploy Foundry Infrastructure with Bicep and Azure CLI
11 Chapter 11: Deploying and Managing Foundation Models
11.1 Serverless API Endpoints and Managed Compute for Foundation Models 11.2 Select Foundation Models for Specific Use Cases 11.3 Model Versioning and Production Deployment Strategies 11.4 Provisioned Throughput Units for High-Volume Workloads
12 Chapter 12: Prompt Design, Variants, and Git Version Control
12.1 Design and Develop Prompts 12.2 Create Prompt Variants and Compare Performance 12.3 Version Control for Prompts with Git
13 Chapter 13: Evaluation Datasets, Quality Metrics, Safety, and Automated Workflows
13.1 Test Datasets and Data Mapping for Evaluation 13.2 Groundedness, Relevance, Coherence, and Fluency 13.3 Risk and Safety Evaluations 13.4 Built-in and Custom Automated Evaluation Workflows
14 Chapter 14: Continuous Monitoring, Performance, Cost, Tracing, and Logging
14.1 Continuous Monitoring in Microsoft Foundry 14.2 Latency, Throughput, Token Use, and Cost Metrics 14.3 Logging, Distributed Tracing, and Production Debugging
15 Chapter 15: Retrieval Tuning, Embeddings, Hybrid Search, and RAG Evaluation
15.1 Tune Similarity Thresholds, Chunk Sizes, and Retrieval Strategies 15.2 Select and Fine-Tune Embedding Models 15.3 Hybrid Search: Semantic and Keyword Retrieval 15.4 RAG Relevance Metrics and A/B Testing
16 Chapter 16: Fine-Tuning Methods, Synthetic Data, and Promotion to Production
16.1 Advanced Fine-Tuning Methods (LoRA, QLoRA, Full) 16.2 Create and Manage Synthetic Data for Fine-Tuning 16.3 Monitor, Optimize, and Promote Fine-Tuned Models
10.1 Create and Configure Foundry Resources and Project Environments
Key Takeaways Explain This Topic AI
Microsoft Foundry (formerly Azure AI Studio / Azure AI Foundry) is the GenAIOps platform on Exam AI-300. The new portal uses a Foundry resource plus child projects; hub-based projects remain in the Foundry (classic) portal.
A new Foundry resource is Microsoft.CognitiveServices/accounts with kind AIServices (SKU S0). Child projects are Microsoft.CognitiveServices/accounts/projects. Enable project management with --allow-project-management at create time; you cannot turn that flag on later.
An Azure Machine Learning hub workspace and a Foundry hub are the same resource type: Microsoft.MachineLearningServices/workspaces with kind hub. Hub-based projects are kind project under that hub. A Foundry project does not use a hub.
Hub (classic) or Foundry account (new) is the shared governance boundary for networking, encryption, model deployments, and connections. A project is the team workspace for agents, prompts, files, and evaluations.
Connections to Azure OpenAI / Foundry Models, Azure AI Search, Azure Storage, and Azure Key Vault live at the hub or Foundry account and are inherited. Connected resources keep their own networking and RBAC. Cross-subscription connections for model deployment are not supported.
Last updated: October 2026
Create and Configure Foundry Resources and Project Environments
Quick Answer: Microsoft Foundry (formerly Azure AI Studio / Azure AI Foundry ) is one Azure resource plus projects . New work uses a Foundry resource ( Microsoft.CognitiveServices/accounts , kind AIServices , SKU S0 ) and child projects ( .../accounts/projects ). Classic hub-based projects still use an Azure Machine Learning hub ( Microsoft.MachineLearningServices/workspaces , kind hub ) — the same resource type as a Foundry hub. Hub / account = shared governance. Project = team workspace. Connections to Azure OpenAI, Azure AI Search, Storage, and Key Vault live on the parent and are inherited.
Exam AI-300 Domain 3 (skills measured 2026-03-05) asks you to create and configure Foundry resources and project environments . Domain 1 already taught the Azure Machine Learning workspace. This chapter is the GenAIOps landing zone: the resource graph, identity, private networking, and Bicep/CLI you need before you deploy foundation models in Chapter 11.
The product renamed in 2026. Teach the current brand Microsoft Foundry , mention the old names once so a stem that still says Azure AI Studio does not throw you, and map exam wording onto both resource models. New Microsoft investment is the Foundry resource plus Foundry projects in the new portal ( https://ai.azure.com with the New Foundry toggle on). Hub-based projects remain in the Foundry (classic) portal. You must be able to tell them apart.
Two resource models, one exam skill
Dimension New Foundry resource + projects Classic hub + hub-based projects
Azure resource Microsoft.CognitiveServices/accounts kind AIServices Microsoft.MachineLearningServices/workspaces kind hub
Child workspace Microsoft.CognitiveServices/accounts/projects Microsoft.MachineLearningServices/workspaces kind project with a parent hub
Portal Foundry (new) Foundry (classic); also Azure Machine Learning studio
Shared governance Foundry account: networking, encryption, model deployments, connections Hub: networking, encryption, connections, compute, quota
Team isolation Project (RBAC, files, agents, evaluations) Project workspace (inherits hub settings; own RBAC)
CLI create az cognitiveservices account create --kind AIServices --sku S0 --allow-project-management then az cognitiveservices account project create az ml workspace create --kind hub then az ml workspace create --kind project --hub-id <hub-arm-id>
Does a Foundry project need a hub? No. A Foundry project does not use a hub. Yes. A hub-based project is created from a hub.
An Azure Machine Learning hub workspace and a Microsoft Foundry hub are the same thing . Microsoft documents this on the workspace and hub pages (updated 2026). That is why Domain 1 hub networking and Domain 3 Foundry hub questions can describe one resource.
Trap: creating a new Foundry project and also creating a hub "because every project needs a hub." Only hub-based projects need a hub. The new Foundry project is a child of the Cognitive Services account.
What the parent holds versus what the project holds
Think of the parent as the control-plane envelope and the project as the developer folder .
On the Foundry resource (or classic hub ) you set:
Public network access, private endpoints, and (for Agent Service) outbound virtual-network injection.
Identity and encryption, including customer-managed keys when the organization requires them.
Model deployments that every project in the account can call.
Connections to Azure OpenAI / Foundry Models, Azure AI Search, Azure Storage, Azure Key Vault, Application Insights, and other allowed types.
Azure Policy and tags that apply to the whole environment.
On each project you organize:
Agents, prompt assets, files, indexes, evaluation runs, and traces.
Project-scoped RBAC so Team A cannot edit Team B's agents.
Optional project connections that only that project's members can use, on top of shared parent connections.
Multiple projects on one Foundry resource share security, deployments, and connected tools. That is the pattern for a restricted subscription: IT builds one locked-down account; developers self-serve projects inside it.
The first project on a Foundry resource is tagged default ( is_default in API responses). Most APIs work on every project. A few Azure OpenAI-era capabilities — OpenAI Batch, OpenAI fine-tuning, stored completions, and Speech fine-tuning — remain on the default project only. If you delete the default project, the next project you create becomes default.
Create a Foundry resource and project
Prerequisites: an Azure subscription and a role that can create the account ( Foundry Account Owner or Foundry Owner on the resource group or subscription, or Azure Owner / Contributor ). For a team, you also need permission to assign roles ( Owner or User Access Administrator ).
Portal path (new Foundry): sign in at https://ai.azure.com , keep New Foundry on, choose Create new project , pick or create a resource group and region, and let the portal create the Foundry resource plus the first project. Use a new resource group while you are learning so delete means one az group delete .
Azure CLI (new model) — Contributor or Owner on the resource group, after az login : az group create --name rg-claims-foundry-dev --location eastus
- az cognitiveservices account create \
- -name claims-foundry-dev \
- -resource-group rg-claims-foundry-dev \
- -kind AIServices \
- -sku S0 \
- -location eastus \
- -custom-domain claims-foundry-dev \
- -allow-project-management
- az cognitiveservices account project create \
- -name claims-foundry-dev \
- -resource-group rg-claims-foundry-dev \
- -project-name claims-assistant \
- -location eastus
Facts the exam will poke:
--kind AIServices and --sku S0 are the documented Foundry account shape. Do not invent a special "Foundry SKU."
--allow-project-management must be set at create . You cannot enable it later. Without it you have a Cognitive Services account, not a project host.
--custom-domain must be globally unique . Token-based Microsoft Entra ID authentication requires a custom subdomain. The name itself is 2–64 characters, lowercase letters, numbers, and hyphens ( AccountNameInvalid if you break that).
Verify with az cognitiveservices account show ... --query properties.provisioningState and the matching project show . Both should return Succeeded .
Python uses CognitiveServicesManagementClient ( azure-mgmt-cognitiveservices ≥ 13.7) with api_version="2025-04-01-preview" : accounts.begin_create with kind: AIServices , sku.name: S0 , identity.type: SystemAssigned , properties.allowProjectManagement: true and customSubDomainName , then projects.begin_create with a system-assigned identity on the project.
Create a classic hub and hub-based project
Use a hub when you still need prompt flow (retiring April 20, 2027; not recommended for new work), managed compute reuse , Azure Machine Learning studio compatibility, or a shared managed virtual network across several GenAI and classic ML projects. Create it with CLI v2: az ml workspace create --kind hub --resource-group rg-claims-foundry-dev --name hub-claims
Azure provisions associated Storage and Key Vault unless you pass --storage-account and --key-vault ARM IDs. Then create a project that joins the hub: az ml workspace create --kind project --name proj-claims-chat --resource-group rg-claims-foundry-dev --hub-id /subscriptions/<sub>/resourceGroups/rg-claims-foundry-dev/providers/Microsoft.MachineLearningServices/workspaces/hub-claims
The join action is Microsoft.MachineLearningServices/workspaces/hubs/join/action . The built-in Azure AI Developer role includes it. That role is for hubs and Azure Machine Learning workspaces , not for new Foundry projects (section 10.2).
Hub settings that flow down to every hub-based project: network (one managed virtual network, one private endpoint on the hub), encryption, shared connections (Foundry portal), compute-instance reuse, and quota. Project data is still isolated (storage containers prefixed with the project GUID plus ABAC). You cannot convert a regular Azure Machine Learning workspace into a hub.
Hub feature limits that surprise MLOps engineers: hub/project workspaces do not support bring-your-own virtual network (use the managed virtual network instead), compute clusters, parallel run step, or batch endpoints. Serverless compute is the substitute for clusters.
Connections: attach data and models, do not duplicate SKUs
A connection is how a project authenticates to an Azure (or external) resource. Standard Agent deployment requires connections to Azure AI Search , Azure Storage , and (for the standard BYO data plane) Azure Cosmos DB . Model access uses a connection to Azure OpenAI or another Foundry resource. Secrets can sit in a managed Key Vault or a bring-your-own Azure Key Vault connection (one Key Vault per Foundry resource).
Documented connection types you should recognize: Azure AI Search, Azure Storage, Azure Cosmos DB (preview; code/Bicep only), Azure OpenAI, Application Insights, Azure Key Vault, Foundry, OpenAI, API key, custom key, Grounding with Bing Search, and several preview types created only from templates (Serverless Model, Databricks, SharePoint, Fabric, APIM, Model Gateway).
Create them in the new portal under Manage → Project details → Connected resources → Add connection , or from Bicep in the foundry-samples 01-connections templates. Prefer Microsoft Entra ID ( authType: AAD ) over API keys. Example Search connection JSON for az cognitiveservices account project connection create --file : {
- "properties": {
- "category": "CognitiveSearch",
- "target": "https://claims-search.search.windows.net",
- "authType": "AAD"
- }
- }
On a classic hub , create the same idea with az ml connection create --file connection.yml --workspace-name <hub> ( type: azure_ai_services or azure_ai_search ). Leave api_key empty to use Entra ID.
Rules:
Connected Storage, Key Vault, and Search are independent Azure resources. You still lock their firewalls and RBAC.
If a connected resource has public network access disabled, you need a private endpoint to that resource in the same virtual network — Foundry does not auto-create those endpoints.
Cross-subscription connections for model deployment are not supported. Keep Azure OpenAI / Foundry model hosts in the same subscription as the project that deploys against them.
One BYO Key Vault per Foundry resource. You cannot delete that Key Vault connection while other connections still exist. Deleting the vault breaks the Foundry resource.
Exam scenario
Contoso's platform team must land a claims copilot for three application squads. Security wants one private network, one set of GPT deployments, and one Azure AI Search service. Squads must not see each other's evaluation datasets.
Create one Foundry resource ( kind AIServices , --allow-project-management , custom subdomain) in a dedicated resource group. Deploy models on the account . Add account-level connections to Search and Storage using Entra ID. Create three projects on that account and assign each squad Foundry User at project scope. Do not create three hubs, three Azure OpenAI accounts, or three Search services unless a compliance boundary truly requires it. If a squad still needs prompt flow on a compute instance until its April 20, 2027 retirement, that squad gets a hub-based project under a hub — a different project type , not a third copy of GPT.
Common trap
Mixing the two graphs. A Foundry project is not az ml workspace create --kind project without a hub, and a hub-based project is not az cognitiveservices account project create . A second trap is treating connections as optional decoration: Standard Agent and RAG tools fail closed without Search and Storage connections, and a public Foundry next to a private Search still cannot query the index. A third trap is putting Batch or OpenAI fine-tuning on a non-default project and assuming every project is equivalent.