A single-region shared AI platform hosted in the Hub landing zone, consumed by multiple application spokes. All AI services centrally managed, governed, and shared across business units.
The Centralized Hub AI pattern deploys all AI services — Azure OpenAI, AI Search, Machine Learning, and supporting data/security services — in a single Hub VNet. Application spokes connect via VNet Peering to consume these shared services through Private Endpoints.
This pattern is ideal for enterprises that want centralized governance, shared model management, and cost-efficient reuse of expensive AI services like Azure OpenAI across many applications.
| GPT-4o | 30K TPM |
| text-embedding-3-large | 120K TPM |
Canada Central
graph TB
subgraph Spokes["Application Spokes"]
S1["Spoke 1<br/>AKS / App Service"]
S2["Spoke 2<br/>AKS / App Service"]
SN["Spoke N<br/>AKS / App Service"]
end
subgraph Hub["Hub VNet — Platform Landing Zone"]
AOAI["Azure OpenAI<br/>GPT-4o + Embeddings"]
AIS["Azure AI Search<br/>Vector + Semantic"]
AML["Azure Machine Learning<br/>Model Registry"]
ADLS["ADLS Gen2<br/>Data Lake"]
KV["Azure Key Vault<br/>Secrets"]
MON["Log Analytics +<br/>App Insights"]
end
subgraph Security["Network Security"]
PE["Private Endpoints"]
DNS["Private DNS Zones"]
NSG["NSG — DenyAllInbound"]
end
S1 -->|"VNet Peering"| AOAI
S2 -->|"VNet Peering"| AIS
SN -->|"VNet Peering"| AOAI
AOAI --> AIS
AML --> ADLS
AML --> KV
AOAI --> MON
AIS --> MON
PE --- AOAI
PE --- AIS
PE --- KV
DNS --- PE
NSG --- Hub
| # | Service | Resource Name | SKU / Tier | Purpose | Monthly Cost |
|---|---|---|---|---|---|
| 1 | Azure OpenAI | {base}-{env}-openai | S0 | GPT-4o + Embeddings for all spokes | ~$2,750 |
| 2 | Azure AI Search | {base}-{env}-search | Standard S1 | Vector + semantic search indexes | $245.28 |
| 3 | Azure Machine Learning | {base}-{env}-aml | Workspace | Model registry, experiments, pipelines | $0* |
| 4 | ADLS Gen2 | {base}{env}adls | Standard LRS, HNS | Data lake for models, embeddings, raw data | ~$50 |
| 5 | Azure Key Vault | {base}-{env}-kv | Standard | Secrets, keys, certificates (RBAC auth) | ~$5 |
| 6 | Log Analytics | {base}-{env}-law | PerGB2018 | Centralized logging (90-day retention) | ~$23 |
| 7 | Application Insights | {base}-{env}-ai | Workspace-based | APM telemetry for AI services | Incl. |
| 8 | Hub VNet | {base}-{env}-hub-vnet | /16, 4 subnets | Network isolation backbone | Free |
| 9 | Spoke VNets (Ã-N) | {base}-{env}-spoke-{n}-vnet | /16, 2 subnets | Application landing zones | Free |
| 10 | VNet Peering | Hub↔Spoke | Bidirectional | Private connectivity hub ↔ spokes | ~$10/TB |
| 11 | Private DNS Zones | 6 zones | Global | Name resolution for private endpoints | ~$3 |
| 12 | Private Endpoints | Per AI service | — | Private network access to PaaS | ~$22 |
| 13 | NSG | {base}-{env}-hub-nsg | DenyAllInbound | Micro-segmentation on hub subnets | Free |
| Estimated Range (Moderate Production) | $10,000 – $15,000/mo | ||||
* AML workspace is free; compute instances billed separately. Token costs based on ~500M tokens/month.
Provides GPT-4o (30K TPM) for chat completions and text-embedding-3-large (120K TPM) for vector embeddings. Shared across all spokes as the central LLM endpoint.
Vector and semantic search index for RAG patterns. Stores and retrieves embeddings for knowledge bases used by all spoke applications.
Central model registry for versioning, experiment tracking, and ML pipeline orchestration. Linked to ADLS, Key Vault, and App Insights.
Hierarchical data lake for raw data, processed datasets, model artifacts, and generated embeddings. Containers: raw, processed, models, embeddings.
Centralized secrets management for API keys, connection strings, and certificates. Uses RBAC authorization with purge protection enabled.
Centralized monitoring and APM. Collects diagnostics from all hub services with 90-day retention. App Insights provides request tracing and performance metrics.
Hub VNet with 4 subnets provides the network backbone. VNet Peering connects spokes to hub bidirectionally for private, low-latency connectivity.
Private Endpoints for each AI service ensure zero public internet exposure. Six Private DNS Zones (OpenAI, Search, KV, Blob, DFS, AML) handle private name resolution.
NSGs on all hub subnets enforce micro-segmentation with DenyAllInbound as the default rule. Only VNet peering traffic and private endpoint traffic is permitted.
Shared GPT-4o across multiple applications — internal knowledge assistants, document Q&A, code review bots.
Single point of management for AI models, usage quotas, cost tracking, and compliance across business units.
Amortize Azure OpenAI and AI Search costs across many consumers instead of per-workload duplication.
AML Model Registry for versioning, A/B testing, and staged deployment across all spoke applications.
| Constraint | Mitigation |
|---|---|
| Shared quota limits (OpenAI TPM/RPM) | Implement per-spoke rate limiting; request quota increases |
| Requires strong RBAC + isolation strategy | Use Azure RBAC per-spoke, service-level RBAC on OpenAI |
| Single point of failure for AI services | Monitor with App Insights; plan capacity headroom |
| Cross-spoke data leakage risk | Separate storage containers per spoke; enforce RBAC |
Generate a complete deployment spec sheet with GitHub Actions workflow, Bicep file structure, and prerequisite checklist.
Generate Deployment Spec Sheet