Help & Getting Started

The form has two sections:

All fields have sensible defaults - you can generate a spec without filling in anything. Override only what you need:

Field	Default	Description
GitHub Org / Username	my-org	Your GitHub organization or personal username
Repository Name	azure-ai-patternN	Just the repo name (not the full URL)
Branch	main	Target branch for the workflow trigger
Target Folder Path	infra/patternN	Where the Bicep files will live
Subscription ID	00000000-...	Azure subscription GUID - replace with yours
Region	Canada Central	Azure region for deployment
Resource Group	rg-ai-<env>-<region>-001	CAF-compliant name auto-generated
Environment	Production	Affects naming and parameter files

The right side of the generator form shows exactly what you need before deploying:

• Azure RBAC Roles - Owner/Contributor, Cognitive Services Contributor, Network Contributor, etc.
• GitHub Requirements - Write access, Actions enabled, AZURE_CREDENTIALS secret
• VS Code Extensions - Bicep, Azure Account, Azure CLI 2.60+
• Quota Pre-Checks - OpenAI access, GPU quota, TPM/RPM limits, PE limits

These are specific to each pattern - Pattern 6 (Secure) will show HSM roles; Pattern 4 (MLOps) will show ML-specific roles.

Click "Generate Deployment Spec Sheet". The output follows a logical Microsoft CAF lifecycle across 6 phases and 15 sections:

Phase 1 - CAF Ready: Landing Zone Foundation

1. Target Environment - subscription, region, resource group, GitHub repo, and CAF management group hierarchy
2. CAF Resource Naming Convention - auto-generated names using <abbreviation>-<workload>-<env>-<region>-<instance> (CAF reference)
3. CAF Tagging Strategy - 6 required + 6 recommended tags, tags.bicep module, and Azure Policy JSON (CAF reference)

Phase 2 - CAF Adopt: Resource Provisioning

4. Azure Services BOM - full Bill of Materials with SKUs, Bicep resource types, model deployments, and network topology
5. Network & Connectivity - topology, private DNS, NSG rules, firewall, and forced tunneling guidance

Phase 3 - CAF Secure: Identity, Security & Compliance

6. Identity & Access Management - RBAC roles, Managed Identities, Zero Trust principles
7. Data Protection & Encryption - encryption at rest/transit, Key Vault, compliance frameworks, Azure Policy
8. GitHub & DevOps Access - repo access, OIDC credentials, branch protection

Phase 4 - CAF Manage: Operations & Resilience

9. Monitoring & Diagnostics - Log Analytics, alerts, dashboards
10. High Availability - HA strategy, composite SLA calculation with per-service breakdown
11. Disaster Recovery - DR strategy, RPO/RTO targets, failover checklist

Phase 5 - CAF Govern: Cost Management

12. Cost Management - budget alerts, optimization best practices, VS Code tooling

Phase 6 - Deployment Execution

13. Pre-Deployment Checklist - 25+ items across Azure, governance, networking, security, and DevOps readiness
14. GitHub Actions CI/CD Workflow - validate → deploy pipeline YAML with CAF tags
15. Bicep File Structure - modules for tags, identity, networking, monitoring, policies, and tests

The spec ends with a CAF Alignment Summary table mapping each CAF pillar (Strategy, Plan, Ready, Adopt, Govern, Manage, Secure) to its corresponding sections.

Pattern 6 - Secure Private AI. Fully private VNet with zero public endpoints, Azure Firewall Premium with TLS inspection, Managed HSM for keys, DDoS Protection, Azure Bastion for management access. Required for HIPAA, PCI-DSS, and ITAR workloads.

Yes! Pattern 3 (Hybrid) is specifically designed as a combination of Pattern 1 (hub) and Pattern 2 (spokes). You can also layer Pattern 6 security on top of any other pattern by adding private endpoints, firewall, and HSM. The Landing Zone guide shows how to architect multi-pattern environments.

Yes. Azure OpenAI requires an access request that must be approved before you can create an Azure OpenAI resource. Approval typically takes 1-2 business days. All 7 patterns require Azure OpenAI.

Both are Infrastructure-as-Code (IaC) tools. Bicep is Azure-native (by Microsoft), compiles to ARM templates, and has first-class VS Code support. Terraform is multi-cloud (by HashiCorp) and uses HCL syntax. This portal focuses on Bicep but all patterns work equally well with Terraform. The generated spec sheets use Bicep resource types for reference.

1. Use the Live Pricing section on the home page for real-time Azure Retail API prices
2. Use the Azure Pricing Calculator for custom configurations
3. Check the BOM table on each pattern detail page - it lists per-service monthly costs
4. For OpenAI tokens, estimate: tokens Ã- price_per_1k_tokens / 1000

Absolutely. The Education Platform is built on the same Azure AI patterns. It uses Pattern 1 (Centralized Hub) or Pattern 4 (AI Factory) as its foundation, then adds education-specific layers: Work IQ, Foundry IQ, Fabric IQ crawlers, plus three AI applications (Academic Advisor, Dropout Risk Predictor, Learning Planner). FERPA compliance is built into the architecture.

Run these commands in Azure CLI:

# Create Service Principal with Contributor role
az ad sp create-for-rbac \
  --name "sp-ai-deploy" \
  --role Contributor \
  --scopes /subscriptions/<subscription-id> \
  --json-auth

# Copy the JSON output and add it as a GitHub secret:
# Repo → Settings → Secrets → Actions → New: AZURE_CREDENTIALS

For additional RBAC roles (Cognitive Services Contributor, etc.), assign them separately: az role assignment create --assignee <sp-app-id> --role "Cognitive Services Contributor" --scope /subscriptions/<sub-id>