Managing, Monitoring, and Securing AI Systems

• Foundry quota is expressed in tokens per minute and requests per minute and is a throughput control, not a spending control
• Onboarded models pool quota across the subscription, and the Quota page Scope column tells you which system applies
• An HTTP 429 means the token or request rate limit was exceeded, and the documented remedy is backoff honoring Retry-After plus quota reallocation
• Spillover routes overflow from a saturated provisioned deployment to a standard deployment in the same Foundry resource
• Scaling past one deployment's quota ceiling is done by fronting several deployments with an AI gateway backend pool, which is also where per-consumer token limits and chargeback metrics live
• Cached input tokens do not consume PTU capacity, so cache rate directly changes how many PTUs a deployment needs
• Agentic retrieval bills on tokens across two services, unlike the classic pipeline's per-query semantic ranker charge
• Azure Reservations discount provisioned capacity relative to hourly billing for steady production volume
• Cost Management budgets are evaluated periodically and are notification-only by default, so they cannot stand in for an approval gate
• Continuous evaluation scores live production traffic at a configured sampling rate and only belongs after the evaluator is trusted
• Scheduled evaluation replays a fixed test dataset on a cadence to expose system drift, and scheduled red teaming probes adversarially
• Foundry tracing follows OpenTelemetry GenAI semantic conventions and records inputs, outputs, tool calls and results, token consumption, and latency per span
• Azure Monitor dynamic thresholds adapt to recent history, so a gradual multi-week climb never triggers them
• Traces do not yet support a network-isolated Application Insights resource
• Centralizing AI resource logs requires an Azure Monitor diagnostic setting on each Foundry resource, which is a different mechanism from Application Insights GenAI tracing
• An indexer must be set to the private execution environment to traverse private endpoints, or it fails silently and leaves the index empty
• An indexed knowledge source needs a search index carrying a semantic configuration, because the pipeline reranks every subquery with the semantic ranker
• The @search.score value is an unbounded relevance score for a query match, not a confidence you can threshold
• The retrieve response can return source references and an execution activity log showing which subqueries hit which sources with what parameters
• Indexers detect changed source content automatically but never detect deletions, so without a deletion detection policy removed documents keep grounding answers
• Replicas buy query throughput and the SLA, partitions buy storage and indexing throughput, and an exhausted partition quota fails indexing rather than validation
• A shared private link is the search service's own outbound private connection, created on the search service and approved by the target resource's owner
• Raising the failed-item thresholds lets an indexer run finish by skipping documents, so a missing document is found in that execution's specific errors and a debug session, never in the run's overall status
• Foundry User is the least-privilege role for developers building and testing agents: reader access plus project data actions and nothing more
• Foundry Agent Consumer is the least-privilege role for principals that only call agent endpoints, and it can be scoped to a single agent
• Roles beginning with Cognitive Services and the Azure AI Developer role are documented as wrong for Foundry project scenarios
• Entra ID authentication issues short-lived per-principal tokens and RBAC only applies when you use it; disabling local auth is what forces it
• Inbound isolation is governed by the public network access flag, and adding or removing a private endpoint does not change it
• A user-assigned managed identity can be created and granted downstream roles before the Foundry resource exists and outlives it; a system-assigned identity cannot

Unlock with Premium — includes all practice exams and the complete study guide.