Deployment Guide — Pillar 1: Infrastructure as Code

Value: This single deployment provisions 28 Bicep modules in a production-ready configuration — with RBAC, private networking, managed identity, Zero Trust controls, and monitoring pre-wired. Aligned with Azure CAF Landing Zone patterns, Well-Architected Framework, and Microsoft Zero Trust for AI. Without this kit, standing up equivalent infrastructure typically takes 4–6 weeks of platform engineering.

Prerequisites

Azure subscription with Owner or Contributor + User Access Administrator role
Azure CLI v2.60+ (az --version)
Bicep CLI v0.30+ (az bicep version)
Resource providers registered: Microsoft.MachineLearningServices, Microsoft.CognitiveServices, Microsoft.Search

Parameter Files

The kit ships with environment-specific parameter files in infra/bicep/parameters/:

File	Environment	Notes
`dev.bicepparam`	Development	Minimal SKUs, no private endpoints
`prod.bicepparam`	Production	Full HA, private endpoints, premium SKUs
`platform-dev.bicepparam`	Multi-LOB Dev	Shared platform hub (no private networking, no firewall)
`platform-staging.bicepparam`	Multi-LOB Staging	Shared platform hub (private networking, firewall enabled)
`platform-prod.bicepparam`	Multi-LOB Prod	Full HA, all security controls enabled
`lob-banking-prod.bicepparam`	LOB Example	Banking LOB spoke (confidential classification)
`lob.template.bicepparam`	LOB Template	Template with placeholders for new LOB onboarding

Deployment Steps

Step 1 — Authenticate

az login
az account set --subscription "<your-subscription-id>"

Step 2 — Register Resource Providers

az provider register --namespace Microsoft.MachineLearningServices
az provider register --namespace Microsoft.CognitiveServices
az provider register --namespace Microsoft.Search
az provider register --namespace Microsoft.DocumentDB

Step 3 — Deploy Infrastructure

az deployment sub create \
  --name "foundry-kit-$(date +%Y%m%d)" \
  --location eastus2 \
  --template-file infra/bicep/main.bicep \
  --parameters infra/bicep/parameters/dev.bicepparam

Step 4 — Verify Deployment

az deployment sub show \
  --name "foundry-kit-<timestamp>" \
  --query "properties.outputs"

Step 5 — Deploy Agent Application

Deploy an agent as a Foundry Agent Application (ARM resource) using the Python SDK with azure-ai-projects 2.0:

python sdk-starters/python/agent_client.py \
  --manifest agent-templates/knowledge-agent/agent-manifest.yaml \
  --toolbox toolbox-configs/knowledge-agent-toolbox.yaml

Multi-LOB Platform Deployment

Enterprise multi-LOB: For organizations with multiple lines of business, the kit provides a hub-spoke architecture with full isolation per LOB — separate networks, identities, Key Vaults, Cosmos containers, AI Search indexes, and Foundry Projects.

Step A — Deploy Shared Platform Hub

az deployment sub create \
  --name "foundry-platform-$(date +%Y%m%d)" \
  --location eastus2 \
  --template-file infra/bicep/main-platform.bicep \
  --parameters infra/bicep/parameters/platform-dev.bicepparam

Step B — Onboard LOBs via Self-Service CLI

# Automated onboarding with CIDR allocation, RBAC, and registry
python scripts/onboard_lob.py \
  --name banking \
  --display-name "Banking Division" \
  --env dev \
  --cidr 10.1.0.0/16 \
  --owner-group-id <ENTRA_GROUP_ID> \
  --data-classification confidential

# Or deploy LOB Bicep directly
az deployment sub create \
  --location eastus2 \
  --template-file infra/bicep/main-lob.bicep \
  --parameters infra/bicep/parameters/lob-banking-prod.bicepparam

Step C — Manage LOBs

python scripts/afek.py lob list --env dev        # List all LOBs
python scripts/afek.py lob status banking --env dev  # LOB health
python scripts/afek.py platform status --env dev   # Platform health
python scripts/register_lob.py info banking --env dev  # Registry details

CI/CD Pipelines

Pre-built pipelines for both platforms — each runs the full build → evaluate → deploy cycle with Azure AI Foundry Continuous Evaluation gates:

GitHub Actions — pipelines/github-actions/agent-build-eval-deploy.yml
Azure DevOps — pipelines/azure-devops/agent-pipeline.yml

Both pipelines run the full build → evaluate → deploy cycle with eval gates that block promotion if trust scores fall below thresholds. Evaluations run via azure-ai-evaluation SDK with results stored in Azure Cosmos DB.

Infrastructure Topology

The full deployment provisions 28 Bicep modules covering identity, networking, data, AI services, MCP hosting, governance controls, and Zero Trust enforcement:

Bicep Module	Azure Resource	SKU (Dev)	SKU (Prod)	Purpose
`managed-identities`	User-Assigned MI	—	—	3 identities: agent runtime, CI/CD deploy, monitoring
`network`	VNet + NSGs	Basic	Standard + DDoS	5 subnets (incl. MCP), 6 Private DNS Zones
`key-vault`	Azure Key Vault	Standard	Premium (HSM)	Secrets, certificates, CMK, ledger signing keys
`app-insights`	App Insights + Log Analytics	Per-GB	Commitment Tier	Agent telemetry, KQL dashboards, alerting
`cosmos-db`	Azure Cosmos DB	Serverless	Autoscale 1000 RU	Decision Ledger + agent memory databases
`ai-search`	Azure AI Search	Basic	Standard S2	RAG grounding with semantic ranker
`foundry-project`	AI Foundry Hub + Project	Basic	Standard	Agent workspace + 3 model deployments
`agent-application`	Agent Application (ARM)	—	—	ARM-native agent packaging + versioned deploys
`guardrails`	Foundry Guardrails	Medium	High	Content safety, PII, prompt attack defense
`toolbox`	Foundry Toolbox	—	—	Centralized tool registry + allowlisting
`entra-agent-identity`	Agent Identity Blueprint	—	—	Agent-scoped Entra identity (ZT-01)
`api-management`	Azure APIM	Developer	Standard	AI Gateway: JWT, token limits, semantic caching
`content-safety`	AI Content Safety	Free	Standard S0	PII detection, violence, prompt attacks
`runtime-interceptor`	Container Apps	Consumption	Dedicated	ZT-05 runtime checks + kill switch
`azure-policy`	Azure Policy	Audit	Deny	Governance initiative + tag enforcement
`continuous-eval`	Eval Pipeline	Daily	Daily	Scheduled quality monitoring + sampling
`api-center`	Azure API Center	Free	Standard	Private MCP Tool Catalog for discovery + approval
`function-mcp`	Azure Functions	Consumption	Premium	Event-driven MCP server hosting
`container-app-mcp`	Container Apps	Consumption	Dedicated	Long-running, stateful MCP server hosting

Post-Deployment

Configure policy packs and enable Foundry Control Plane enforcement mode
Set up continuous evaluation via Azure AI Foundry Continuous Evaluation
Connect MCP adapters to enterprise systems and register in Foundry Toolbox
Configure MCP Fleet Governance — Toolbox Lifecycle Manager, auth provider, Private Tool Catalog
Configure Foundry Guardrails (content safety, PII, prompt attack defense) per agent
Register agents in Agent 365 for cross-platform governance and observability
Run the certification pipeline to promote agents through sandbox → staging → production
Import the Azure Monitor Workbook and MCP Fleet Dashboard for agent fleet monitoring