Azure
An Azure Landing Zone for AI Workloads: Networking, Private Endpoints, Identity and Policy Before the First Model
Microsoft's guidance is clear that AI workloads belong in ordinary application landing zones. What changes is the order of work. Some Foundry networking choices are fixed the moment the resource is created, so they have to be settled before the first model is deployed. This guide covers placement, private endpoints and DNS, agent network isolation, keyless identity, the renamed Foundry roles, policy, the AI gateway, quotas and regions, checked against Microsoft's documentation in September 2026.
11 min read