Artificial Intelligence on Microsoft Azure
Artificial Intelligence on Microsoft Azure
If your organisation already runs Microsoft 365, Entra ID and SharePoint, several of the hardest parts of an AI programme are in place: identity, permissions, sensitivity labelling and a content estate. Azure lets you build on that rather than beside it, which turns the work into grounding, evaluation and control instead of standing up a parallel access model. We use Microsoft Foundry for custom applications and Copilot Studio or Microsoft 365 Copilot where configuration is genuinely enough.
Why Azure
When this is the right platform.
- Your access model already exists. Microsoft Entra ID decides who sees what, and retrieval through Azure AI Search can honour those same permissions at query time rather than maintaining a second list of who may read which document.
- Microsoft Foundry keeps model deployment, grounding, content filtering, evaluation and quota control in one place, which shortens the distance between a prototype and something you can raise a change record against.
- Copilot Studio and Power Platform cover the last mile. A business team can own the interface and the approval flow while engineering owns retrieval, data contracts and guardrails, without two separate delivery projects.
- Microsoft Fabric and Microsoft Purview put analytical data and governance metadata in the same tenancy as the AI workload, so lineage and classification are not a separate programme bolted on later.
- If your team already deploys with Bicep, GitHub Actions or Azure DevOps and troubleshoots with Application Insights, an AI workload joins the operating model you run today instead of introducing a second one.
Where it is less suited
We would rather say this now than after a migration.
- Microsoft 365 Copilot is charged per user per month whether or not it is used, so the commercial case rests on adoption rather than deployment. We would rather start with a small allocation to well-matched roles and expand on evidence than licence a whole department and hope.
- Grounded answers are only as good as your permissions and your content. A decade of oversharing and duplicate documents in SharePoint becomes an AI problem the moment you switch an assistant on, and repairing it is an information-management project that sits outside the AI build and needs its own budget.
- This part of Azure moves quickly. Naming has shifted more than once (Azure OpenAI, then Azure AI Foundry, now Microsoft Foundry), and model availability differs between regions and does not arrive everywhere at the same time, so runbooks need a refresh cadence and you may face a real choice between the newest capability and the region you prefer.
- Power Platform makes it easy for business teams to build things nobody owns. Without an environment strategy and data-loss prevention policies in place first, an AI programme quietly inherits an estate of unsupported flows and apps.
Business outcomes
What Azure delivers here.
- A knowledge assistant that honours existing permissions
- Staff question your own SharePoint and Teams content and receive cited answers limited to what their Entra ID account already grants them. The measure agreed up front is usually the share of questions resolved without escalating to a subject-matter expert.
- Copilot licences pointed at the roles that benefit
- Instead of a tenant-wide rollout, licences go first to the roles whose daily tasks match what the tool does well, with a review point before any expansion. Finance gets a per-seat cost set against an observed change in a named task rather than a general productivity assertion.
- Document work that finishes inside familiar tools
- Contracts, tenders, invoices and forms are extracted and summarised by a pipeline, with the human review step surfaced in Teams or a Power Apps screen the team already opens each morning. The process owner tracks turnaround against the baseline captured before the build.
- Agents that act, with an approval in front of them
- A Copilot Studio agent can raise the request, update the record or start the workflow in your line-of-business system, with a Power Automate approval ahead of anything consequential. Benefit shows up as manual handoffs removed from a named process.
- Forecasts built next to the governed data
- Azure Machine Learning models draw on the same Microsoft Fabric data that feeds your reporting, so a forecast and a dashboard cannot disagree about the underlying numbers. Planners receive the model error alongside each prediction.
Common client problems
What we usually hear first.
We switched Copilot on and half the team says the answers are shallow.
That is normally a content and permissions problem rather than a model problem, so we start by establishing what the tool can actually reach and how well it is labelled. We then narrow the scope to well-maintained sources, remove the sharing that should never have existed and rebuild enablement around specific tasks.
Our SharePoint is ten years of unsorted folders. Search is already bad.
We assess the sites in scope for duplication, staleness and oversharing, and we will tell you plainly if information management has to come before an assistant. Where the corpus is only partly usable we scope the assistant to the parts that are trustworthy and declare the rest out of scope in writing.
The business keeps building Power Automate flows and nobody knows what exists.
We inventory the flows and connections in each environment, separate what is business critical from what has been abandoned, and put an environment and data-loss prevention structure around new development. Agents are then built inside that structure instead of adding another undocumented layer.
We were sold Azure OpenAI, then Azure AI Foundry, now Microsoft Foundry. What do we actually have?
We map your existing resources, deployments and commitments to the current product naming and separate what changed in substance from what changed in name only. You get a current-state diagram and a short migration list covering the few things that genuinely need to move.
Legal will not approve anything that sends contract text outside our control.
We scope which repositories are in play, use Purview labelling to keep restricted content out of the index, and configure private endpoints so model and search traffic does not traverse the public internet. Where legal rules a source out entirely, we design the workflow without it rather than argue the point.
How we deliver
Our Azure delivery approach.
- 01
Assessment and advisory
The Azure assessment starts inside your tenant, because most of the answers about feasibility are already sitting there.
- A tenant review covering Entra ID groups, guest access, sharing links and SharePoint permission inheritance, since these become the AI access model on day one.
- Content hygiene analysis across the sites and libraries in scope, identifying duplication, stale documents and oversharing that would degrade grounded answers.
- A licence and consumption review across Microsoft 365 Copilot, Power Platform and Microsoft Foundry, comparing per-seat cost against per-call cost for each candidate use case.
- A model and capability availability check in the Azure regions you intend to use, recorded with the date it was verified because availability changes.
- A build-versus-configure recommendation per use case, stating where Microsoft 365 Copilot or Copilot Studio is sufficient and where a custom Foundry application is justified.
- A Purview readiness review covering sensitivity labels, retention and whether classification is applied consistently enough to be relied on by an indexing pipeline.
- 02
Architecture and implementation
Three reference patterns cover most of what organisations need on Azure: a grounded assistant, a document-processing pipeline and a controlled agent. Each is built incrementally and deployed through your existing pipeline.
- Retrieval built on Azure AI Search with hybrid and semantic ranking, security trimming by Entra ID group, and an indexing schedule matched to how often each source actually changes.
- Model deployment in Microsoft Foundry with content filters configured explicitly, quota and rate limits set per application, and Foundry Models compared on your own evaluation set before selection.
- Runtime chosen for fit rather than fashion: Azure Functions for event-driven extraction, Azure App Service for a hosted assistant, Azure Kubernetes Service where you already operate a cluster.
- Azure API Management in front of model and tool endpoints for authentication, throttling, per-consumer quota and a single consistent point of logging.
- Copilot Studio agents, Power Automate flows and Power Apps review screens deployed as managed solutions across development, test and production, never authored directly in production.
- Azure Machine Learning for predictive workloads with registered models and versioned datasets, drawing features from Microsoft Fabric so forecasts and reports share one governed source.
- 03
Security and governance
On Azure the controls you need mostly already exist in the tenant. The work is applying them to the AI workload deliberately and proving they hold.
- Entra ID app registrations with least-privilege permissions, managed identities in place of keys and secrets, and conditional access applied to the assistant front end.
- Security trimming verified by testing retrieval with accounts at three permission levels, including one account that should be able to see nothing at all.
- Microsoft Purview sensitivity labels honoured by the ingestion pipeline, with labelled content excluded from indexes where the label requires it and the exclusion list published.
- Microsoft Foundry content filters combined with application-level prompt-injection defence: retrieved text treated as untrusted, tool allowlists enforced and adversarial cases added to the evaluation suite.
- Microsoft Defender for Cloud enabled across the AI, hosting and storage resources, with findings triaged into your existing remediation process rather than a separate report.
- Private endpoints and network restrictions on Foundry, Azure AI Search and storage accounts so model and index traffic does not cross the public internet.
- 04
Adoption and enablement
Microsoft tooling puts AI inside applications people already have open, which helps adoption and hides poor value equally well. We plan for both.
- Enablement delivered where the work happens: Microsoft 365 Copilot in Word, Outlook and Excel, and the Copilot Studio agent published into the Teams channel that team already uses.
- A licence allocation plan starting with roles whose tasks match measured strengths, with an agreed review point before the next tranche is assigned.
- Scenario libraries written in your terminology, covering the five to ten tasks each role performs most frequently and the phrasing that works for each.
- A feedback path from inside the agent into a Power Apps or Teams form, triaged weekly through the pilot and monthly afterwards.
- Usage and adoption reporting from Microsoft 365 admin data compared against the baseline agreed during assessment, reported to the sponsor.
- Published guidance for staff on what to do when an answer is wrong, how to report it, and what must never be pasted into a prompt.
- 05
Managed continuation
Azure AI services change quickly, and so does the content underneath a grounded assistant. Continuation keeps both under observation and keeps you informed of what changed.
- Scheduled evaluation runs against the agreed question set, with results trended over time and regressions raised to the named owner.
- Azure Monitor and Application Insights dashboards covering latency, failure rate, consumption per feature and retrieval quality, alerting on thresholds set at design time.
- Index health checks for failed ingestion, stale documents and permission drift following staff movements or project closures.
- Foundry model version and deprecation tracking, with a tested migration completed before a retirement date rather than after a failure.
- Cost review against the business case, separating Foundry consumption, Azure AI Search tier, application hosting and Copilot licences so each can be judged on its own.
- A monthly report to the sponsor covering usage, answer quality, incidents, spend and the single improvement we recommend next.
Technology reference
The Microsoft Azure services we build with.
A reference architecture view of the platform services used in this domain, and what each one does in the design.
Model and agent platform
Microsoft FoundryThe build and deployment surface for custom AI applications, covering model deployment, content filters, evaluation runs and per-application quota in one place.
Foundry ModelsThe model catalogue we benchmark against your own tasks, so selection is made on measured accuracy, cost and latency rather than on reputation.
Microsoft Copilot StudioBusiness-facing agents and topic flows published into Teams or a website, with connectors into line-of-business systems and approval steps before consequential actions.
Microsoft 365 CopilotTask assistance inside Word, Outlook, Excel and Teams, allocated to the roles whose daily work genuinely matches what it does well.
Grounding, data and machine learning
Azure AI SearchThe retrieval layer behind grounded answers, with hybrid and semantic ranking plus security trimming so results respect each user's existing permissions.
Microsoft FabricThe governed source of analytical data used for grounding and for any metric an assistant is asked about, keeping AI answers consistent with your reporting.
Azure Machine LearningForecasting and classification models with versioned datasets, a registered model store and a documented promotion path into production.
Identity, governance and protection
Microsoft Entra IDOne access model for users, applications and managed identities, so an assistant can only return what the signed-in person is already entitled to see.
Microsoft PurviewSensitivity labelling, classification and lineage across the content in scope, used to decide what may be indexed and what must stay out.
Microsoft Defender for CloudPosture monitoring and recommendations across AI, hosting and storage resources, with findings routed into the remediation process you already run.
Runtime and integration
Azure FunctionsEvent-driven processing for document extraction, enrichment and index updates, scaled by workload instead of provisioned in advance.
Azure App ServiceHosting for assistant front ends and APIs where a managed platform is the right fit and container orchestration would only add overhead.
Azure Kubernetes ServiceHosting where you already operate a cluster or need fine control over networking, scaling and workload isolation for the AI application.
Azure API ManagementA single governed entry point to model and tool endpoints, providing authentication, throttling, per-consumer quota and consistent request logging.
Observability and business automation
Azure MonitorPlatform metrics, alert rules and log retention across the AI workload and every resource it depends on.
Application InsightsRequest-level tracing through prompt, retrieval and tool calls, which is what makes a poor answer diagnosable instead of anecdotal.
Power AutomateApproval routing and system-to-system steps around an AI decision, so an extraction becomes an action in the correct business system.
Power AppsLightweight review and exception-handling screens where a person must confirm, correct or reject what the model produced.
Product names and icons are trademarks of Microsoft and Amazon Web Services, reproduced unmodified from their official architecture icon libraries to identify the technologies used in these architectures. Their presence does not indicate partnership, certification or endorsement by either vendor.
Related industries
Where this work has the most leverage.
Professional Services
Governed enterprise search, document intelligence and secure copilots that respect matter confidentiality and conflict boundaries.
Construction and Property
Tender intelligence, addenda tracking and project reporting that keep estimators and contract administrators ahead of the documents instead of buried in them.
Healthcare and Community Services
Administrative automation, policy search, workforce analytics and privacy uplift for healthcare and community providers, with clinical decisions left entirely to clinicians.
Free discovery workshop
Start with a artificial intelligence discovery workshop.
Bring one challenge. We will assess whether Microsoft Azure is the right platform for it before recommending anything.