AI deployed in a fully private, single-region network boundary. All services accessed exclusively via Private Endpoints — zero public internet exposure. Azure Firewall Premium controls egress, NSGs enforce micro-segmentation.
The Secure Private AI pattern implements Zero Trust principles for AI workloads. Every service has publicNetworkAccess: Disabled. Azure Firewall Premium handles all egress with TLS inspection and threat intelligence. AKS runs as a private cluster.
This is the most secure and most expensive pattern. It's designed for regulated industries (financial services, healthcare, government) where no data can traverse public internet.
| SKU | Premium |
| Threat Intel | Deny |
| DNS Proxy | Enabled |
| TLS Inspection | Capable |
| Allow | VNet → VNet (P100) |
| Deny | Internet In (P4000) |
| Deny | Internet Out (P4000) |
graph TB
subgraph VNet["Secure VNet 10.30.0.0/16"]
subgraph FWSubnet["Firewall Subnet /26"]
FW["Azure Firewall Premium<br/>Threat Intel: Deny<br/>DNS Proxy: On"]
end
subgraph AKSSubnet["AKS Subnet /20"]
AKS["AKS Private Cluster<br/>D4s_v5 x3 nodes<br/>NSG: deny internet"]
end
subgraph PESubnet["Private Endpoints /24"]
PE_AOAI["PE: Azure OpenAI"]
PE_AIS["PE: AI Search"]
PE_AML["PE: Azure ML"]
end
subgraph DataSubnet["Data Endpoints /24"]
PE_BLOB["PE: ADLS Blob"]
PE_DFS["PE: ADLS DFS"]
PE_KV["PE: Key Vault"]
end
subgraph MgmtSubnet["Management /24"]
MON["Log Analytics<br/>365-day retention"]
APPINS["App Insights"]
end
RT["Route Table<br/>0.0.0.0/0 → Firewall"]
end
subgraph ExtServices["All Services: publicNetworkAccess = Disabled"]
AOAI["Azure OpenAI"]
AIS["Azure AI Search"]
AML_SVC["Azure ML"]
ADLS["ADLS Gen2"]
KV["Key Vault"]
end
DNS["6 Private DNS Zones"]
AKS -->|"UDR"| FW
FW -->|"Controlled Egress"| ExtServices
AKS --> PE_AOAI
AKS --> PE_AIS
PE_AOAI --- AOAI
PE_AIS --- AIS
PE_AML --- AML_SVC
PE_BLOB --- ADLS
PE_DFS --- ADLS
PE_KV --- KV
DNS --- PESubnet
DNS --- DataSubnet
RT --- AKSSubnet
| # | Service | Resource Name | SKU / Tier | Public Access | Purpose | Monthly Cost |
|---|---|---|---|---|---|---|
| 1 | Azure Firewall | {base}-{env}-fw | Premium | N/A (perimeter) | Egress control, TLS inspection, threat intel | $1,825 |
| 2 | Azure OpenAI | {base}-{env}-openai | S0 | Disabled | LLM + embeddings (private only) | ~$2,750 |
| 3 | Azure AI Search | {base}-{env}-search | Standard | Disabled | Vector + semantic search | $245.28 |
| 4 | Azure ML | {base}-{env}-aml | Workspace | Disabled | ML workspace & registry | $0* |
| 5 | ADLS Gen2 | {base}{env}adls | Standard LRS, HNS | Disabled | Data lake (data, embeddings, models, audit) | ~$50 |
| 6 | Key Vault | {base}-{env}-kv | Standard | Disabled | Secrets, keys, certs | ~$5 |
| 7 | AKS | {base}-{env}-aks | D4s_v5 Ã- 3 | Private Cluster | Container compute | ~$420 |
| 8 | Log Analytics | {base}-{env}-law | PerGB2018, 365-day | — | Centralized logging & audit | ~$115 |
| 9 | Application Insights | {base}-{env}-ai | Workspace-based | — | APM telemetry + diagnostics | Incl. |
| 10 | Route Table (UDR) | {base}-{env}-rt | 0.0.0.0/0 → FW | — | Force all traffic through Firewall | Free |
| 11 | NSG (AI subnets) | {base}-{env}-ai-nsg | Deny Internet In+Out | — | Micro-segmentation | Free |
| 12 | NSG (AKS subnet) | {base}-{env}-aks-nsg | Deny Internet In | — | AKS subnet protection | Free |
| 13 | Private DNS Zones | 6 zones | Global | — | Private name resolution | ~$3 |
| 14 | Private Endpoints | 7 endpoints | — | — | OpenAI, Search, Blob, DFS, KV, AML | ~$51 |
| 15 | Diagnostic Settings | OpenAI → LAW | allLogs + AllMetrics | — | Full audit trail | Incl. |
| Estimated Total (Moderate Production) | ~$10,240/mo | |||||
* AML workspace free; compute billed separately. Firewall Premium is the single largest cost driver (~$1,825/mo).
The security cornerstone. All egress routed through Firewall via UDR. Threat intelligence in Deny mode blocks known malicious IPs. DNS Proxy enabled. TLS inspection capable for deep packet analysis.
Kubernetes with private API server — not accessible from internet. NSG denies all internet inbound. All egress forced through Firewall. Azure RBAC for Kubernetes authorization.
publicNetworkAccess = Disabled. Accessible only via Private Endpoint in the PE subnet. Full diagnostic settings streaming allLogs + AllMetrics to Log Analytics.
Extended 365-day retention for regulatory compliance and full audit trails. Collects all diagnostics from Firewall, OpenAI, AKS, Search, and every other service.
Every PaaS service has a dedicated Private Endpoint. Six Private DNS Zones handle name resolution for OpenAI, Search, Blob, DFS, Key Vault, and AML.
Route Table forces all 0.0.0.0/0 to Firewall. NSGs deny internet in/out on AI subnets. AKS NSG allows only VNet and Azure Load Balancer inbound. Defense in depth.
PCI-DSS compliant AI workloads with complete network isolation and full audit trails.
PHI processing with zero public internet exposure. 365-day logs for compliance audits.
Classified or sensitive workloads requiring Zero Trust architecture and air-gapped services.
Any industry with strict data residency, encryption, and network isolation requirements.
| Constraint | Mitigation |
|---|---|
| Highest cost pattern (~$10,240/mo) | Firewall Premium is main driver; consider Standard if TLS inspection not needed |
| Complex to operate and debug | Use Firewall logs for traffic analysis; jumpbox for management |
| Private Cluster requires jumpbox/bastion for kubectl | Deploy Azure Bastion or use AKS command invoke |
| All DNS must use Private DNS Zones | Automate DNS zone creation in Bicep modules |
| Longer deployment time due to PE/DNS propagation | Plan 15-30 min for full deployment; use staged approach |
Generate a complete deployment spec sheet with GitHub Actions workflow, Bicep file structure, and prerequisite checklist.
Generate Deployment Spec Sheet