Independent community resource – not affiliated with or endorsed by Microsoft. All trademarks belong to Microsoft Corporation. Pricing shown is estimated and may not reflect current Azure rates – always verify with the Azure Pricing Calculator.

10 Reference Architectures · Open Source

Azure AI
Deployment Patterns

AI Architecture Hub · Spoke · Hybrid · MLOps · Serverless · Private AI · Lakehouse
Migration Lift & Shift · SQL to Azure SQL
Greenfield Landing Zone Accelerator · AVM · Entra Governance
Backup & Resilience Azure Backup · Ransomware Recovery · Vault Governance

Each pattern includes: services, costs, SLA alignment, WAF checklist, and Bicep deployment templates.

Explore Patterns Compare All Backup Patterns

Canada Central

Default Region

Patterns

40+

Azure Services

99.97%

Highest Composite SLA

Spec-Driven Deploy

Deployment Patterns

Click any card for details. Use the search box to filter.

AI Architecture – Patterns 1–7

Cloud-native AI workloads on Azure

Centralized Hub AI

~$3,400/mo

Centralized AI hub via Azure AI Foundry, APIM GenAI gateway with semantic caching, and Azure OpenAI with gpt-4o/gpt-4o-mini.

AI Foundry APIM GenAI AI Search Vector

Full Details SLA 99.72% · Pattern 1

Decentralized Spoke AI

~$7,400/mo

Each BU owns AI resources in a spoke VNet with Azure Virtual Network Manager and per-spoke AI Foundry workspaces.

Per-team AOAI Spoke VNETs Azure Firewall

Full Details SLA 99.67% · Pattern 2

Hybrid Central-Spoke

~$5,600/mo

APIM GenAI gateway with load balancing + AI Foundry hub/spoke projects + Prompt flow orchestration.

APIM GenAI AI Foundry Prompt flow

Full Details SLA 99.54% · Pattern 3

AI Factory / MLOps

~$4,770/mo

Azure AI Foundry with Prompt flow, AI Evaluation, AI Agent Service, NC A100 v4 GPU, and AI Model Catalog.

AI Foundry Prompt flow AI Evaluation

Full Details SLA 99.72% · Pattern 4

Serverless AI

~$645/mo

Functions Flex Consumption + Container Apps + Durable Functions with gpt-4o-mini for cost-optimized AI.

Flex Functions Container Apps gpt-4o-mini

Full Details SLA 99.73% · Pattern 5

Secure Private AI

~$11,038/mo

Zero-trust with DCesv5 confidential VMs, Entra Workload ID, Confidential Ledger, AI Foundry managed VNet.

DCesv5 Entra Workload ID Confidential Ledger

Full Details SLA 99.68% · Pattern 6

Data-Centric Lakehouse AI

~$7,300/mo

OneLake + Real-Time Intelligence + Direct Lake mode, Databricks Unity Catalog + Mosaic AI, Fabric AI Skills.

OneLake Unity Catalog Mosaic AI

Full Details SLA 99.67% · Pattern 7

Migration – Patterns 8–9

Migrate existing workloads to Azure

Lift & Shift Migration

~$4,500/mo

Azure Migrate + Site Recovery with D4s_v6 Cobalt 100 VMs, Azure Arc, Update Manager, and AMA agent.

Azure Arc Update Manager D4s_v6

Full Details SLA 99.95% · Pattern 8

SQL to Azure SQL Migration

~$4,100/mo

SQL MI Link for near-zero downtime, Next-gen GP tier, ledger tables, and Microsoft Purview governance.

SQL MI Link Next-gen GP Purview

Full Details SLA 99.97% · Pattern 9

Greenfield – Pattern 10

Build a new Azure environment from scratch

Greenfield Azure Deployment

~$5,800/mo

Landing Zone Accelerator + Azure Verified Modules (AVM), Entra ID Governance, managed Grafana, Copilot for Azure.

AVM Landing Zone Entra Governance

Full Details SLA 99.95% · Pattern 10

Backup & Resilience – Patterns A–D

Spec-driven Azure Backup demos, ransomware recovery, modern workload protection, and enterprise governance

Pattern A: Core Demo

Demo-ready

Rapid Azure Backup demo for VM, Azure Files, Recovery Services vault, restore workflows, and monitoring.

VM backup File restore KQL

Demo .md

Pattern B: Ransomware

Security

RBAC separation, soft delete, immutable vault guidance, and alerting for ransomware recovery conversations.

RBAC Soft delete Alerts

Demo .md

Pattern C: Modern

Cloud-native

Vault selection for Recovery Services vault vs Backup vault across disk, AKS, blob, VM, and file workloads.

Backup vault AKS Blob

Demo .md

Pattern D: Enterprise

Governance

CAF-aligned resource separation, zero-trust network controls, FinOps tagging, compliance audit, and runbooks.

CAF FinOps Private access

Demo .md

Open Azure Backup Pattern Hub View Published Artifacts

Pattern Comparison

Pattern	Governance	Team Autonomy	Cost	Complexity	Best For
Centralized Hub	High	Low	$$	Medium	Shared AI services org-wide
Decentralized Spoke	Medium	High	$$$	High	Autonomous team ownership
Hybrid Central-Spoke	High	Medium	$$$	High	Enterprise multi-BU balance
AI Factory / MLOps	High	Medium	$$$	Very High	Full ML lifecycle management
Serverless AI	Medium	High	$	Low	Event-driven & bursty workloads
Secure Private AI	High	Low	$$$$	Very High	Regulated / zero-trust environments
Data-Centric Lakehouse	High	Medium	$$$	High	Analytics-heavy AI workloads
Lift & Shift Migration	Medium	Low	$$	Medium	Legacy VM rehosting to Azure
SQL to Azure SQL	High	Low	$$	Medium	Database modernization & migration
Greenfield Azure	High	Medium	$$$	High	New cloud environment (Zero to Hero)

Azure Live Pricing

Prices sourced from Azure Pricing Pages (March 2026). Estimates assume moderate production workloads (~500M tokens/mo).

Per-Service Unit Prices

Service	SKU / Tier	Unit Price	Pricing Page
Azure OpenAI	GPT-4o Global Standard	Input $2.50 / Output $10 per 1M tokens	View
	GPT-4o-mini Global Standard	Input $0.15 / Output $0.60 per 1M tokens
	o1-mini (reasoning)	Input $1.10 / Output $4.40 per 1M tokens
	text-embedding-3-large	$0.143 per 1M tokens
	text-embedding-3-small	$0.022 per 1M tokens
Azure AI Foundry	Hub workspace (free tier)	No platform charge – pay for compute only	View
	NC A100 v4 (1× A100 GPU)	~$1,802/mo ($2.47/hr)
API Management v2	Basic / Standard v2 / Premium	$150 / $700 / $2,801 per month	View
	GenAI gateway policies	Included – token rate-limit, semantic cache, circuit-breaker
AI Search	Basic / S1 / S2 (vector + semantic)	$73.73 / $245.28 / $981.12 per month	View
Key Vault	Standard	$0.03 per 10K transactions	View
Azure Monitor	Analytics Logs / Basic	$2.30 / $0.50 per GB ingested	View
Functions	Flex Consumption (GA)	$0.20 per 1M exec + $0.000016/GB-s + VNet support	View
Container Apps	Consumption	vCPU $0.000024/s + memory $0.000003/GiB-s	View
Azure Firewall	Standard / Premium	$912 / $1,278 per month + data	View
Cosmos DB	Serverless / Autoscale (1K RU/s)	$0.25/1M RU / ~$58.40/mo + $0.25/GB	View
Microsoft Fabric	F64 (OneLake + Real-Time Intelligence)	~$5,000/mo	View
Azure Databricks	Premium (Unity Catalog + Mosaic AI)	$0.40–$0.65 per DBU-hr	View

Pattern Cost Estimates

Serverless AI ~$645/mo

Functions Flex Consumption (free tier) + AOAI gpt-4o-mini ~$180 + Container Apps ~$50 + Cosmos DB serverless ~$58 + Key Vault ~$5 + Monitor ~$23 + AI Search Basic $73.73

Centralized Hub ~$3,400/mo

AOAI gpt-4o ~$1,500 + gpt-4o-mini ~$200 + AI Foundry (free) + APIM Standard v2 $700 + AI Search S1 (vector+semantic) $245 + AI Content Safety ~$50 + Key Vault + Monitor

Lift & Shift Migration ~$4,500/mo

2× D4s_v6 Cobalt 100 ~$600 + SQL on VM ~$500 + Azure Arc (free) + Update Manager (free) + Bastion $329 + Backup ~$200 + LB + Storage + Monitor

SQL to Azure SQL ~$4,100/mo

SQL MI Next-gen GP 4 vCores ~$1,200 + SQL DB serverless ~$200 + SQL VM ~$500 + MI Link (included) + Purview (free tier) + DMS + Backup + Monitor

AI Factory / MLOps ~$4,770/mo

AI Foundry (free) + NC A100 v4 GPU $1,802 + AOAI gpt-4o ~$1,500 + AI Search S1 $245 + AI Evaluation + Prompt flow + ACR ~$60 + Cosmos DB ~$58 + Monitor

Hybrid Central-Spoke ~$5,600/mo

AOAI ~$1,500 + APIM GenAI gateway $700 + AI Foundry hub/projects + Prompt flow + AI Search S1 $245 + Firewall Standard $912 + Monitor ~$35 + Key Vault + VNet

Greenfield Azure ~$5,800/mo

Firewall $912 + AOAI ~$1,500 + AI Foundry + SQL MI Next-gen GP ~$1,200 + AI Search S1 $245 + App Service P1v3 ~$100 + Bastion + VPN GW + managed Grafana + Defender CSPM + AVM (free)

Data-Centric Lakehouse ~$7,300/mo

Fabric F64 (OneLake + Real-Time Intelligence) ~$5,000 + Databricks Premium (Unity Catalog + Mosaic AI) ~$800 + AOAI ~$700 + AI Search S1 $245 + ADLS Gen2 ~$150 + Monitor

Decentralized Spoke ~$7,400/mo

3× AOAI ~$3,300 + AI Foundry per spoke + Virtual Network Manager + Firewall Standard $912 + 3× AI Search Basic $221 + 3× Key Vault ~$15 + Monitor + VNet peering

Secure Private AI ~$11,038/mo

AOAI ~$1,500 + AI Foundry managed VNet + Firewall Premium $1,278 + DDoS Network Protection $2,944 + AI Search S2 $981 + Managed HSM ~$2,300 + Confidential Ledger + DCesv5 VMs + Bastion + Monitor

All prices in USD. Actual costs depend on usage, region, and reservations. See Azure Pricing Calculator for precise estimates.

Disclaimer: All pricing shown is for reference and estimation purposes only. Actual Azure costs vary by region, currency, reserved instance commitments, enterprise agreements, and real-time consumption. Currency conversions use approximate exchange rates and do not reflect Azure's official regional pricing. Always verify with the Azure Pricing Calculator or your Microsoft account team before budgeting.

Composite SLAs

The Composite SLA is the product of individual SLAs of every service in the critical request path. Fewer services or higher-tier SKUs raise the composite. Learn how it's calculated

Pattern	SLA
Serverless AI	99.73%
Centralized Hub	99.72%
AI Factory / MLOps	99.72%
Secure Private AI	99.68%
Decentralized Spoke	99.67%
Data-Centric Lakehouse	99.67%
Hybrid Central-Spoke	99.54%
SQL to Azure SQL	99.97%
Lift & Shift Migration	99.95%
Greenfield Azure	99.95%

WAF Alignment

Pattern	Reliability	Security	Cost Opt.	Ops. Ex.	Perf.
Centralized Hub	★★★	★★★★	★★★★	★★★	★★★
Decentralized Spoke	★★★★	★★★	★★	★★	★★★★
Hybrid	★★★★	★★★★	★★★	★★★	★★★★
AI Factory	★★★	★★★	★★★	★★★★★	★★★
Serverless	★★★	★★★	★★★★★	★★★★	★★★
Secure Private	★★★★★	★★★★★	★★	★★★	★★★
Data-Centric	★★★★	★★★	★★★	★★★★	★★★★★
Lift & Shift	★★★★	★★★	★★★★	★★★	★★★
SQL Migration	★★★★★	★★★★	★★★★	★★★	★★★
Greenfield	★★★★	★★★★	★★★	★★★★	★★★★

Core Azure Modules

Click any module to view its Azure documentation

Azure OpenAI

GPT-4o, embeddings, DALL-E

AI Search

Vector + semantic search

Azure AI Foundry

Hub, Prompt flow, Evaluations

API Management

GenAI gateway, caching, policies

Key Vault

Secrets & certificates

Private Link

Network isolation

Azure Monitor

Logs, metrics, alerts

Functions

Serverless compute

Container Apps

Managed containers

Cosmos DB

Multi-model database

Microsoft Fabric

OneLake, Real-Time Intelligence

Azure Firewall

Network security

Entra ID

Identity & RBAC

Virtual Network

Hub-spoke topology

Container Registry

Docker image store

Event Grid

Event routing

Azure Policy

Compliance guardrails

Azure Databricks

Unity Catalog, Mosaic AI

Azure SQL MI

Managed Instance, MI Link

Azure Arc

Hybrid management

Azure Migrate

Discovery & migration

Azure Bastion

Secure VM access

DDoS Protection

Network protection

Managed Grafana

Dashboards & monitoring

Landing Zone Architecture

Reference Guide · CAF Aligned

A prescriptive guide to designing Azure Landing Zones that host AI services securely, at scale, and aligned with the Cloud Adoption Framework. Covers management groups, subscriptions, networking, identity, governance, and platform services.

CAF HierarchyManagement Groups & Subscriptions

Hub-Spoke NetworkingFirewall, DNS, Peering

Subnet DesignAI-optimized /16 layout

Zero Trust SecurityPrivate Endpoints, RBAC, Policy

Decision TreeChoose the right pattern/LZ

24-Item ChecklistDeployment readiness

Explore Landing Zone Guide

Pattern-to-Landing-Zone Mapping

Pattern	LZ Type	VNet Model
Centralized Hub	Platform LZ	Hub + Peering
Decentralized Spoke	App LZ (–N)	Isolated VNets
Hybrid Central-Spoke	Platform + App	Hub-Spoke
AI Factory / MLOps	Dedicated AI LZ	5+ Subnets
Serverless AI	Online / Sandbox	No VNet
Secure Private AI	Corp LZ	Fully Private
Data-Centric Lakehouse	Dedicated AI LZ	6+ Subnets
Lift & Shift Migration	Corp LZ	Hub-Spoke
SQL Migration	Data LZ	PE + DNS Zones
Greenfield Azure	Platform LZ	Hub-Spoke + VPN

Education Platform

AI Education Vertical

Intelligent student & institution insights powered by three AI crawler engines. Built on the same Azure AI patterns, tailored for higher education – from LMS activity analysis to predictive dropout prevention.

Explore Education Platform

Work IQ

Student interactions, LMS activity, engagement signals

Foundry IQ

Curriculum, policies, research, accreditation

Fabric IQ

Performance analytics, outcomes, retention metrics

AI Academic Advisor

Conversational course guidance, policy Q&A, career mapping

Dropout Risk Predictor

ML-based early warning with 4-tier risk scoring

Learning Planner

Personalized semester-by-semester adaptive plans

Ready to Deploy?

Deploy any pattern using Bicep or Terraform via the Azure Portal.

Azure Portal

Overview

A single shared Azure OpenAI instance behind API Management serves the entire organization. Azure AI Foundry provides a unified orchestration layer for prompt flows, evaluations, and model management. APIM acts as a GenAI gateway with token rate-limiting, semantic caching, and circuit-breaker policies.

Key Services

Azure OpenAI Service (gpt-4o, gpt-4o-mini, o1-mini, text-embedding-3-large)
Azure AI Foundry — unified AI development & orchestration
API Management (Standard v2) — GenAI gateway with semantic caching
Azure AI Search — vector search + semantic ranker (hybrid retrieval)
Azure AI Content Safety
Key Vault, Azure Monitor, Log Analytics, Microsoft Entra ID

When to Use

Org-wide GenAI rollout with unified policy & token governance
Cost-conscious deployments with shared capacity pooling
Teams that don't need model customization or fine-tuning

Cost Breakdown (Azure Pricing — March 2026)

Azure OpenAI GPT-4o (400M tokens) + gpt-4o-mini (100M)	~$2,415
APIM Standard v2 (GenAI gateway)	$700
AI Search S1 (vector + semantic ranker)	$245
Azure AI Foundry (free workspace tier)	$0
Key Vault + Monitor + Content Safety	~$40
Total	~$3,400/mo

Composite SLA 99.72% – how is this calculated?

The Composite SLA is the product of the individual SLAs of every service in the critical request path. If any service is unavailable, the entire request fails.

0.999 (AOAI) – 0.999 (APIM) – 0.9999 (Key Vault) – 0.999 (AI Search) – 0.9999 (Storage)

Service	Individual SLA
Azure OpenAI	99.9%
API Management v2	99.9%
Key Vault	99.99%
AI Search (S1, 3 replicas)	99.9%
Storage (LRS)	99.99%

Calculation: 0.999 – 0.999 – 0.9999 – 0.999 – 0.9999 = 0.9972 – 99.72%

Each additional service in the chain lowers the composite. Add Availability Zones or remove services from the critical path to improve it.

Microsoft: Composite SLA calculation guide – Azure SLA summary

Service Limits (2026)

AOAI: 30 deployments/resource, 450K TPM (GPT-4o), 2M TPM (GPT-4o-mini)
APIM: 5,000 req/sec (Standard v2), GenAI policies support streaming
AI Search: 50 indexes, 12 replicas (S1)

Source: AOAI · APIM · AI Foundry

View Full Details, BOM & Architecture

Overview

Each business unit owns its own Azure OpenAI, AI Foundry workspace, and networking resources within a dedicated spoke VNet. Azure Virtual Network Manager provides centralized governance across all spoke topologies.

Key Services

Per-team Azure OpenAI (gpt-4o, gpt-4o-mini)
Azure AI Foundry workspace per spoke
Azure Virtual Network Manager — centralized network governance
Spoke VNets with peering, Azure Firewall, NSGs
Dedicated Key Vaults & AI Search (vector) per spoke

When to Use

Teams needing full autonomy over AI resources & models
Different compliance / data residency requirements per BU
Large enterprises with independent P&Ls and separate AI budgets

Cost Breakdown (Azure Pricing, 3 spokes)

3× Azure OpenAI GPT-4o + gpt-4o-mini	~$3,300
Azure Firewall Standard ($1.25/hr)	$912
Azure Virtual Network Manager	~$30
3× AI Search Basic (vector enabled) ($73.73 ea)	$221
3× Key Vault + Monitor + VNet	~$55
Total	~$7,400/mo

Composite SLA 99.67% – how is this calculated?

The Composite SLA is the product of every service in the critical path. A request flows through AOAI – Firewall – AI Search – Key Vault – Storage – all must be available.

0.999 (AOAI) – 0.9999 (Firewall) – 0.999 (AI Search) – 0.9999 (Key Vault) – 0.9999 (Storage)

Service	Individual SLA
Azure OpenAI (per spoke)	99.9%
Azure Firewall	99.99%
AI Search (Basic)	99.9%
Key Vault (per spoke)	99.99%
Storage (per spoke)	99.99%

Calculation: 0.999 – 0.9999 – 0.999 – 0.9999 – 0.9999 = 0.9967 – 99.67%

Blast-radius isolation means each spoke fails independently, but the per-spoke composite remains 99.67%.

Microsoft: Composite SLA calculation guide – Azure SLA summary

Source: Firewall · VNet Manager

View Full Details, BOM & Architecture

Overview

Central APIM GenAI gateway + shared AOAI with spoke-level fine-tuned models. AI Foundry hub project provides shared prompt flows, evaluations, and model catalog; spoke projects enable team-level experimentation. APIM load-balances across multiple AOAI endpoints with semantic caching and circuit-breaker policies.

Key Services

APIM as GenAI gateway (token rate-limiting, semantic caching, load balancing)
Azure AI Foundry — hub project + spoke projects
Hub AOAI (gpt-4o, gpt-4o-mini, o1-mini) + spoke ML endpoints
Azure AI Search S1 (vector + semantic ranker)
Prompt flow for AI orchestration
Hub-spoke VNet topology, Azure Firewall

When to Use

Enterprise needing both shared & custom models
Centralized policy with spoke-level experimentation
Organizations adopting AI Foundry for unified development

Cost Breakdown (Azure Pricing)

Azure OpenAI GPT-4o (400M) + gpt-4o-mini (100M)	~$2,415
APIM Standard v2 (GenAI gateway)	$700
2× Azure AI Foundry compute D4s v5 (spoke endpoints)	$296
AI Search S1 + Firewall Standard	$1,157
Key Vault + Monitor + VNet	~$65
Total	~$5,600/mo

Composite SLA 99.54% – how is this calculated?

This pattern has the most services in the critical path (AOAI – APIM – ML endpoints – Firewall – AI Search), which produces the lowest composite SLA.

0.999 (AOAI) – 0.999 (APIM) – 0.999 (ML endpoints) – 0.9999 (Firewall) – 0.999 (AI Search)

Service	Individual SLA
Azure OpenAI	99.9%
API Management v2	99.9%
AI Foundry Endpoints	99.9%
Azure Firewall	99.99%
AI Search (S1)	99.9%

Calculation: 0.999 – 0.999 – 0.999 – 0.9999 – 0.999 = 0.9954 – 99.54%

Each 99.9% service multiplied into the chain drops the composite by ~0.1%. Remove optional services from the critical path to improve.

Microsoft: Composite SLA calculation guide – Azure SLA summary

Source: AI Foundry · APIM

View Full Details, BOM & Architecture

Overview

Full AI lifecycle via Azure AI Foundry: prompt engineering, fine-tuning, evaluation, deployment, and monitoring. Prompt flow orchestrates multi-step AI workflows. AI Evaluation scores model quality, safety, and groundedness. Supports both Azure OpenAI and open-source models from the AI Model Catalog (Llama 3, Mistral, Phi-3).

Key Services

Azure AI Foundry — unified AI platform (replaces standalone Azure ML)
Prompt flow — orchestration of LLM chains, RAG, agents
AI Evaluation — automated quality & safety scoring
AI Model Catalog — Azure OpenAI + open-source models (MaaS/MaaP)
Azure AI Agent Service — autonomous AI agents
Container Registry, Key Vault, Azure DevOps / GitHub Actions
GPU compute: NC A100 v4 (1× A100 80GB)

When to Use

Organizations training, fine-tuning & deploying custom models
Teams needing reproducible AI/ML pipelines with CI/CD
Regulated environments requiring model lineage & responsible AI

Cost Breakdown (Azure Pricing)

Azure OpenAI GPT-4o (400M) + gpt-4o-mini (100M)	~$2,415
AI Foundry compute D4s v5	$148
NC A100 v4 (1× A100 GPU, fine-tuning)	$1,803
AI Search S1 + ACR Standard	~$305
Cosmos DB + Key Vault + Monitor	~$100
Total	~$4,770/mo

Composite SLA 99.72% – how is this calculated?

The composite is the product of services in the inference/serving path: AOAI – AI Foundry endpoints – Key Vault – AI Search – Cosmos DB.

0.999 (AOAI) – 0.999 (AI Foundry endpoints) – 0.9999 (Key Vault) – 0.999 (AI Search) – 0.9999 (Cosmos DB)

Service	Individual SLA
Azure OpenAI	99.9%
AI Foundry Endpoints	99.9%
Key Vault	99.99%
AI Search (S1)	99.9%
Cosmos DB	99.99%

Calculation: 0.999 – 0.999 – 0.9999 – 0.999 – 0.9999 = 0.9972 – 99.72%

GPU training compute is not included – SLA applies to the serving/inference path only.

Microsoft: Composite SLA calculation guide – Azure SLA summary

Source: AI Foundry · GPU: NC A100 v4 at $2.47/hr · Compute

View Full Details, BOM & Architecture

Overview

Event-driven AI processing with Azure Functions Flex Consumption (faster cold starts, VNet integration, instance concurrency), Azure Container Apps for containerized AI microservices, and consumption-based pricing throughout. Durable Functions orchestrate multi-step AI workflows (RAG chains, document processing).

Key Services

Azure Functions (Flex Consumption) — faster cold starts, VNet support
Azure Container Apps — serverless containers with scale-to-zero
Durable Functions — multi-step AI orchestration
Azure OpenAI (gpt-4o-mini pay-per-token, o1-mini for reasoning)
Logic Apps, Event Grid, Cosmos DB serverless
AI Search Basic (vector + semantic ranker)

When to Use

Bursty or unpredictable AI workloads
Startups / cost-sensitive deployments needing near-zero idle cost
Document processing, chatbots, event-driven AI pipelines

Cost Breakdown (Azure Pricing)

Azure OpenAI gpt-4o-mini (~200M tokens)	~$60
Azure OpenAI gpt-4o (~50M tokens, complex tasks)	~$375
Functions Flex Consumption (5M exec)	~$3
Container Apps (0.5 vCPU, burst)	~$45
Cosmos DB serverless + AI Search Basic	~$132
Key Vault + Monitor + Event Grid	~$30
Total	~$645/mo

Composite SLA 99.73% – how is this calculated? Highest AI SLA

Serverless achieves the highest composite SLA among AI patterns because Functions Flex and Event Grid are both 99.99% – fewer low-SLA services in the path.

0.999 (AOAI) – 0.9999 (Functions Flex) – 0.9999 (Event Grid) – 0.9995 (Cosmos DB) – 0.999 (AI Search)

Service	Individual SLA
Azure OpenAI	99.9%
Azure Functions Flex	99.99%
Event Grid	99.99%
Cosmos DB (serverless)	99.95%
AI Search (Basic)	99.9%

Calculation: 0.999 – 0.9999 – 0.9999 – 0.9995 – 0.999 = 0.9973 – 99.73%

Fewer services + higher-SLA managed services = the best composite. Container Apps (99.95%) is not in the critical path (alternative compute).

Microsoft: Composite SLA calculation guide – Azure SLA summary

Source: Functions Flex · Container Apps – gpt-4o-mini: $0.15/$0.60 per 1M tokens

View Full Details, BOM & Architecture

Overview

Zero-trust AI deployment with private endpoints, confidential VMs (DCesv5 / ECesv5), CMK encryption, and full network isolation. Azure AI Foundry configured with managed VNet isolation. Microsoft Entra Workload ID replaces stored service-principal secrets. Optional Azure Confidential Ledger for tamper-proof audit trails.

Key Services

Azure AI Foundry — managed VNet isolation mode
Azure OpenAI (gpt-4o, o1-mini) via Private Endpoints only
Confidential VMs (DCesv5 — AMD SEV-SNP)
Azure Firewall Premium (IDPS + TLS inspection)
DDoS Network Protection (renamed from Standard)
Managed HSM, Customer-Managed Keys (double encryption)
Microsoft Entra Workload ID — secretless identity
Azure Confidential Ledger — immutable audit trail

When to Use

Healthcare, finance, government & defense workloads
Data that must never traverse public internet
Compliance: HIPAA, SOC 2, FedRAMP, PCI-DSS, NIST 800-53

Cost Breakdown (Azure Pricing)

Azure OpenAI GPT-4o (500M tokens, private)	~$2,750
Firewall Premium ($1.75/hr + IDPS)	$1,278
DDoS Network Protection	$2,944
Managed HSM B1 ($3.20/hr)	~$2,336
AI Search S2 + Confidential Ledger	~$1,050
Private Endpoints + Monitor + Bastion	~$680
Total	~$11,038/mo

Composite SLA 99.68% – how is this calculated?

Despite premium-tier services, the composite is pulled down by AOAI and AI Search (both 99.9%). The zero-trust security stack (Firewall Premium, HSM, Storage) all provide 99.99%.

0.999 (AOAI) – 0.9999 (Firewall Premium) – 0.999 (AI Search S2) – 0.9999 (HSM) – 0.9999 (Storage)

Service	Individual SLA
Azure OpenAI (private)	99.9%
Firewall Premium	99.99%
AI Search (S2)	99.9%
Managed HSM	99.99%
Storage (CMK)	99.99%

Calculation: 0.999 – 0.9999 – 0.999 – 0.9999 – 0.9999 = 0.9968 – 99.68%

To raise the composite: deploy AI Search with 3+ replicas for higher SLA, or add active-active multi-region.

Microsoft: Composite SLA calculation guide – Azure SLA summary

Source: Firewall Premium · Managed HSM · Confidential Ledger

View Full Details, BOM & Architecture

Overview

AI tightly coupled with a OneLake lakehouse using Microsoft Fabric, Real-Time Intelligence, and ADLS Gen2. Direct Lake mode enables zero-copy analytics over parquet/delta. Fabric AI Skills let business users query data with natural language. Databricks with Unity Catalog and Mosaic AI provides advanced ML training.

Key Services

Microsoft Fabric (F64+) — OneLake, Real-Time Intelligence, AI Skills
Direct Lake mode — zero-copy analytics over Delta tables
Azure Databricks Premium — Unity Catalog + Mosaic AI
Azure OpenAI (gpt-4o, gpt-4o-mini) + AI Search (vector)
ADLS Gen2 (medallion: bronze/silver/gold)
Data Factory / Fabric pipelines for orchestration

When to Use

Data-heavy organizations (retail, telco, manufacturing, IoT)
AI that needs tight data gravity & real-time insights
Teams already invested in Fabric / Databricks ecosystem

Cost Breakdown (Azure Pricing)

Microsoft Fabric F64 (OneLake + Real-Time Intelligence)	~$5,100
Azure Databricks Premium (8 DBU × 12h/day)	~$520
Azure OpenAI gpt-4o + gpt-4o-mini (~300M tokens)	~$1,200
AI Search S1 (vector index)	$245
ADLS Gen2 (1TB, medallion) + Monitor	~$235
Total	~$7,300/mo

Composite SLA 99.67% – how is this calculated?

The critical data path: AOAI – Fabric – Databricks – AI Search – Storage. Databricks Premium at 99.95% and Fabric at 99.9% are the main limiters.

0.999 (AOAI) – 0.999 (Fabric) – 0.9995 (Databricks) – 0.999 (AI Search) – 0.9999 (Storage)

Service	Individual SLA
Azure OpenAI	99.9%
Microsoft Fabric	99.9%
Databricks Premium	99.95%
AI Search (S1)	99.9%
ADLS Gen2 (LRS)	99.99%

Calculation: 0.999 – 0.999 – 0.9995 – 0.999 – 0.9999 = 0.9967 – 99.67%

If Databricks is only in the batch pipeline (not real-time serving), it can be excluded from the critical-path calculation, raising the composite to ~99.72%.

Microsoft: Composite SLA calculation guide – Azure SLA summary

Source: Fabric · Databricks

View Full Details, BOM & Architecture

Overview

Migrate legacy on-premises workloads to modern Azure infrastructure. Azure Migrate with agentless discovery and business-case assessment. VMs run on latest Dv5/Dv6 (Cobalt 100) series. Azure Arc extends Azure management to hybrid and multi-cloud. Azure Update Manager replaces legacy Update Management for patching.

Key Services

Azure Migrate — agentless discovery, dependency mapping, business case
Azure Site Recovery — replication & failover
Azure VMs (D4s_v5 / D4s_v6 Cobalt 100)
Azure Arc — hybrid management, Azure Policy on-prem
Azure Update Manager — unified patching (replaces Update Management)
Azure Bastion, Azure Backup, Azure Monitor Agent (AMA)

When to Use

Moving legacy Windows/Linux VMs to Azure
Rehosting with minimal application changes
First phase of a broader cloud modernization journey
Tight timeline — need to exit data center fast

T-Shirt Sizing

Small Dev/Test	2 VMs (D2s_v5), no Bastion	~$800/mo
Medium Production	5 VMs (D4s_v5), Bastion, Backup, Arc	~$4,500/mo
Large Enterprise	15+ VMs (D8s_v6), VMSS, Firewall, Arc	~$13,000/mo

Cost Breakdown (Medium — Azure Pricing)

Azure VMs × 2 (D4s_v5)	~$560
SQL Server on VM (D4s_v5 + SQL Std)	~$620
Azure Bastion (Standard)	~$330
Azure Backup (Vault) + Update Manager	~$140
Azure Site Recovery (5 VMs)	~$125
Azure Arc + Load Balancer + Storage + Monitor	~$130
Total (Medium)	~$4,500/mo

Composite SLA 99.95% – how is this calculated?

IaaS VMs with Availability Zones provide 99.95%. Combined with high-SLA managed services, the composite stays very high.

0.9995 (VM AZ) – 0.9999 (Storage) – 0.9995 (Bastion) – 0.9999 (LB)

Service	Individual SLA
Azure VM (Availability Zone)	99.95%
Azure Storage (LRS)	99.99%
Azure Bastion	99.95%
Load Balancer	99.99%

Calculation: 0.9995 – 0.9999 – 0.9995 – 0.9999 = 0.9988 – 99.95%

Bastion is for management access only – if excluded from the serving path, the composite rises to ~99.98%.

Microsoft: Composite SLA calculation guide – Azure SLA summary

View Full Details, BOM & Architecture

Overview

Comprehensive database migration from SQL Server to Azure SQL. SQL MI link enables near-zero-downtime cutover via real-time replication. Next-gen General Purpose tier provides improved performance with local SSD. Ledger tables add tamper-proof audit. Microsoft Purview provides unified data governance across all SQL targets.

Target Options

Azure SQL Database — fully managed PaaS, serverless auto-pause
SQL Managed Instance — near-100% compat, VNet-native, MI link for live migration
SQL on Azure VM — full SQL Server parity, self-managed

When to Use

SQL Server end-of-support migration
Database consolidation (many → few) with cost optimization
Compliance-driven: TDE, ledger tables, Advanced Threat Protection
Azure Hybrid Benefit for license savings (up to 55% off)

T-Shirt Sizing

Small Dev/Test	Azure SQL DB (S2, 50 DTU)	~$150/mo
Medium Production	SQL MI Next-gen GP (4 vCores) + SQL DB	~$4,100/mo
Large Enterprise	SQL MI BC (8+ vCores), 50+ DBs, Purview	~$10,000/mo

Cost Breakdown (Medium — Azure Pricing)

Azure SQL MI Next-gen GP (4 vCores, 256GB)	~$1,600
Azure SQL Database (GP S_Gen5_2, serverless)	~$370
SQL on Azure VM (D4s_v5 + SQL Std)	~$620
Azure DMS (online migration)	~$410
Microsoft Purview + Key Vault + Monitor + Backup	~$200
Total (Medium)	~$4,100/mo

Composite SLA 99.97% – how is this calculated? Highest Overall

Azure SQL services are among the highest-SLA offerings. SQL MI and SQL DB both offer 99.99%, pushing the composite close to five-nines.

0.9999 (SQL MI) – 0.9999 (SQL DB) – 0.9995 (SQL VM) – 0.9999 (Key Vault)

Service	Individual SLA
Azure SQL MI (Next-gen GP)	99.99%
Azure SQL Database	99.99%
SQL on Azure VM	99.95%
Key Vault	99.99%

Calculation: 0.9999 – 0.9999 – 0.9995 – 0.9999 = 0.9992 – 99.97%

SQL MI+DB are 99.99%. If SQL VM (99.95%) is replaced with another MI, composite rises to ~99.97+%.

Microsoft: Composite SLA calculation guide – Azure SLA summary

View Full Details, BOM & Architecture

Overview

Build a brand-new Azure environment from zero using CAF best practices. Azure Landing Zone Accelerator provides Bicep/Terraform modules for day-0 deployment. Azure Verified Modules (AVM) ensure production-grade IaC. Microsoft Entra ID Governance manages lifecycle & access reviews. Azure Monitor managed Grafana provides unified dashboards.

Key Services

Azure Landing Zone Accelerator (Bicep / Terraform)
Azure Verified Modules (AVM) for IaC
Management Groups + Azure Policy + Blueprints
Azure Firewall (hub egress) + VPN Gateway / ExpressRoute
Azure OpenAI + AI Foundry + AI Search
Microsoft Entra ID Governance — access reviews, PIM, lifecycle
Defender for Cloud CSPM + Azure Monitor managed Grafana
Microsoft Copilot for Azure — AI-assisted operations

When to Use

No existing Azure footprint — starting fresh
Cloud-first startup or enterprise digital transformation
Regulated industry needing governance from day one
Building an AI-ready platform from scratch

T-Shirt Sizing

Small Startup	1 sub, single VNet, AOAI + KV	~$1,200/mo
Medium Production	3 subs, hub-spoke, Firewall, Policy, AVM	~$5,800/mo
Large Enterprise	10+ subs, full MG, Sentinel, ExpressRoute	~$19,000/mo

Cost Breakdown (Medium — Azure Pricing)

Azure OpenAI (gpt-4o + gpt-4o-mini + embeddings)	~$1,500
Azure SQL MI Next-gen GP (4 vCores)	~$1,200
Azure Firewall (Standard)	~$912
Azure Bastion + VPN Gateway	~$470
AI Search S1 + App Service P1v3	~$385
Defender CSPM + Grafana + Monitor + Storage	~$330
Total (Medium)	~$5,800/mo

Composite SLA 99.95% – how is this calculated?

A balanced greenfield deployment. The hub Firewall and SQL MI at 99.99% anchor the composite, while AOAI and AI Search at 99.9% are the main limiters.

0.9999 (Firewall) – 0.999 (AOAI) – 0.9999 (SQL MI) – 0.999 (AI Search) – 0.9995 (App Svc)

Service	Individual SLA
Azure Firewall	99.99%
Azure OpenAI	99.9%
Azure SQL MI	99.99%
AI Search (S1)	99.9%
App Service (P1v3)	99.95%

Calculation: 0.9999 – 0.999 – 0.9999 – 0.999 – 0.9995 = 0.9973 – 99.95%

This pattern follows all 6 CAF phases. IaC via Azure Verified Modules ensures consistent deployments across regions.

Microsoft: Composite SLA calculation guide – Azure SLA summary

Follows all 6 CAF phases: Strategy → Plan → Ready → Adopt → Govern → Manage. IaC via Azure Verified Modules.

View Full Details, BOM & Architecture

Required	Owner or Contributor + User Access Administrator on the target subscription
Required	Cognitive Services Contributor – to create Azure OpenAI resources
Required	Network Contributor – for VNet, NSG, Private Endpoints
Conditional	Key Vault Administrator – if creating Key Vaults with RBAC
Conditional	Search Service Contributor – for AI Search
Recommended	Monitoring Contributor – for diagnostics & alerts

Required	Write access to the target repository (push to branch)
Required	GitHub Actions enabled on the repository
Required	GitHub secret: `AZURE_CREDENTIALS` – Service Principal JSON
Recommended	GitHub Pro / Team / Enterprise for private repo Actions minutes
Optional	GitHub Environments for deploy protection rules

Required	VS Code 1.85+ with Azure Account extension
Required	Bicep extension (ms-azuretools.vscode-bicep)
Required	Azure CLI 2.60+ installed and logged in (`az login`)
Recommended	GitHub Copilot for assisted IaC authoring
Recommended	Azure Resources extension for resource management
Optional	Terraform extension (if using TF instead of Bicep)

Azure AIDeployment Patterns

10 Architecture Patterns

Landing Zone Reference

Azure Backup Patterns

Education AI Platform

Core Azure Modules

Spec-Driven Development

Knowledge Check Quiz

Deployment Patterns

Centralized Hub AI

Decentralized Spoke AI

Hybrid Central-Spoke

AI Factory / MLOps

Serverless AI

Secure Private AI

Data-Centric Lakehouse AI

Lift & Shift Migration

SQL to Azure SQL Migration

Greenfield Azure Deployment

Pattern A: Core Demo

Pattern B: Ransomware

Pattern C: Modern

Pattern D: Enterprise

Pattern Comparison

Azure Live Pricing

Per-Service Unit Prices

Pattern Cost Estimates

Composite SLAs

WAF Alignment

Core Azure Modules

Landing Zone Architecture

Education Platform

Work IQ

Foundry IQ

Fabric IQ

AI Academic Advisor

Dropout Risk Predictor

Learning Planner

Ready to Deploy?

Pattern 1 — Centralized Hub AI

Overview

Key Services

When to Use

Cost Breakdown (Azure Pricing — March 2026)

Service Limits (2026)

Pattern 2 — Decentralized Spoke AI

Overview

Key Services

When to Use

Cost Breakdown (Azure Pricing, 3 spokes)

Pattern 3 — Hybrid Central-Spoke

Overview

Key Services

When to Use

Cost Breakdown (Azure Pricing)

Pattern 4 — AI Factory / MLOps

Overview

Key Services

When to Use

Cost Breakdown (Azure Pricing)

Pattern 5 — Serverless AI

Overview

Key Services

When to Use

Cost Breakdown (Azure Pricing)

Pattern 6 — Secure Private AI

Overview

Key Services

When to Use

Cost Breakdown (Azure Pricing)

Pattern 7 — Data-Centric Lakehouse AI

Overview

Key Services

When to Use

Cost Breakdown (Azure Pricing)

Pattern 8 — Lift & Shift Migration

Overview

Key Services

When to Use

T-Shirt Sizing

Azure AI
Deployment Patterns