Plan and manage an Azure AI solution

Plan and manage is the one AI-103 domain that does not build a kind of AI. The other four each implement a specific capability, computer vision, text analysis, information extraction, and the generative and agentic apps themselves, while this domain is the lifecycle wrapped around all of them, and every step of it happens inside one platform: Microsoft Foundry (formerly Azure AI Foundry, and Azure AI Studio before that), whose single resource fronts the model catalog, the prebuilt tools, and Foundry Agent Service. At 25–30% it is the second-largest domain on the exam, behind implementing generative AI and agents. Hold it as four phases taken in order: Choose what goes into the solution, Set up the platform that runs it, Operate it while it serves traffic (the phase where tracing and diagnostic logs tell you what happened), and Govern what it is allowed to say and do. The trap the model exists to dodge is the borrowed instrument: an answer that reaches into the wrong phase, offering a rate cap where the requirement asks about spend, or a content filter where it asks about the agent's behavior. Each subtopic warns about this in its own corner; at the domain level the first move is always to name the phase the requirement lives in, because that decides which toolbox is even open.

The four subtopics are those four phases, and reading them in order is the through-line of the whole domain. Choosing Foundry Services decides what goes in: which model class fits the task, whether a prebuilt Foundry Tool beats calling a chat model, how content is indexed and retrieved, and which tools and memory an agent carries. Setting Up AI Solutions stands the platform up in provisioning order, the Foundry resource and project, model and agent deployments, the role assignments they all depend on, and network isolation, plus the pipeline that reproduces the whole footprint; two of those setup choices are one-way doors, irreversible without deleting and rebuilding the project, which is where the planning effort concentrates. Managing, Monitoring, and Securing takes over once the system serves traffic, splitting the running work into capacity and cost, model behavior, ingestion and index health, and identity and network access. Responsible AI closes the loop by deciding what generative and agentic systems may say and do, through guardrails that judge content inline, evaluation and red teaming that measure how often it fails, tool-access limits that constrain what an agent can even attempt, and the audit trail that records what happened.

Across all four phases the exam rewards the same instinct when more than one option would technically function. First, match the requirement to the instrument that actually owns it rather than a neighbor that looks close: rate, spend, and approval are three different controls, a data-plane call needs a data-plane role, and judging content is not the same as evaluating behavior. Second, prefer the identity-native, least-privilege path: authenticate with Microsoft Entra ID rather than a key, and assign the most narrowly scoped named Foundry role that still lets the task succeed rather than an authoritative-sounding control-plane role that grants more and still fails the data-plane call with 403. When two answers both work, the more tightly scoped, identity-first one is almost always the intended one.