Keys, costs, and deployment choices

A model deployment is a named address your code or agent calls to reach a model. Concept 1 introduced deployments; Concept 2 showed how to create one in the Microsoft Foundry portal. This concept covers the choices that follow: which deployment type to pick, how much capacity your subscription shares, how callers prove who they are, and how to keep token use from turning into a surprise bill.

Foundry separates who pays (your Azure subscription) from who builds (people and apps in a Foundry project). Deployments and quota sit mostly at the resource and subscription level. Sign-in method decides whether a call can be tied to a person or app. Spend comes from tokens and reserved capacity, plus any other Azure services you attach.

When you deploy a model through the serverless API option, you choose a deployment type. That choice sets where prompt and answer data may be processed while the model runs, how you are billed, and how steady the service feels under load. Microsoft Foundry groups types into pay-per-token standard, reserved provisioned throughput, and discounted batch processing.

Stored data stays in the geography you chose for the Foundry resource, but live processing follows the deployment type. Global types may process prompts and answers in any Azure region. Data Zone types keep processing inside the US, EU, or APAC zone. Standard and Regional Provisioned types process inside the geography you selected. For most new work, start with Global Standard unless your organization requires a narrower boundary.

• Pick Global Standard when you want the broadest region coverage, the lowest standard price, and the highest default quota.
• Move to Global Provisioned or Regional Provisioned when traffic is steady and you need reserved capacity instead of pure pay-per-token billing.
• Pick Global Batch or Data Zone Batch when a job can wait hours and you want batch pricing rather than immediate responses.

Your application should not use the catalog model name in production unless you use instant access (preview). In the usual path, you create a deployment, write down its deployment name, and pass that name in SDK or REST calls. Concept 2 walks through the portal flow: find a model under Discover or Build, select Deploy, choose Default settings, and wait until status shows Succeeded.

• Each Foundry resource supports up to 32 model deployments per region under subscription quota rules—plan names so teams do not collide.
• After deployment, the model playground opens on that deployment so you can test prompts before you connect an agent.
• Instant access (preview) lets you call supported models by model name with no deployment. During preview it requires a Foundry project in West US 3 and the Foundry User role on the project or account.
• Instant access uses the same SDK and project endpoint as deployments; samples use DefaultAzureCredential after you sign in with az login.

Example: a small online shop builds a support assistant. The team deploys gpt-5-mini as Global Standard, copies the deployment name into its app, and sends short test prompts in the playground before exposing the agent to customers.

Quota is the upper limit on how many tokens or requests your subscription can send through a model deployment type. Tokens per minute (TPM) and requests per minute (RPM) limits protect shared Azure capacity. When a deployment exceeds TPM, callers typically see HTTP 429 Too Many Requests. Subscription-wide quota tracking in Microsoft Foundry started after May 7, 2026: for onboarded models, all Global Standard deployments of the same model and version in a subscription share one pool across regions, and Data Zone Standard deployments share a pool within each data zone.

• Open the Quota pane from the Manage toolbar button in the Foundry portal. By default it lists models with active deployments; turn on Show all to see models and regions you have not deployed yet.
• Check the Scope column. Values such as Global or Data Zone mean one shared pool for the whole subscription; a region name means separate quota for that model in that region.
• Request more model quota through the Foundry quota increase process when tests succeed but limits block production traffic.

Because pools are shared, one team's load test in East US can use up quota that another team's deployment needs in West Europe. Agree on deployment types and regions before major experiments.

Subscription quota protects Azure capacity. AI Gateway adds per-project caps so one project cannot use all the tokens inside your organization. The gateway sits between clients and model deployments and sends traffic through the linked Azure API Management instance.

• You need a Foundry resource with AI Gateway configured and a project whose deployment is attached to that gateway.
• In the Microsoft Foundry portal, select Manage, then AI Gateway, open your gateway, then Token management.
• Select + Set limit, pick the project and deployment, and enter a tokens-per-minute limit.
• Optionally set a total token quota for a period such as hourly, daily, weekly, monthly, or yearly.
• When TPM is exceeded, callers receive 429 Too Many Requests; when the quota period is exhausted, they receive 403 Forbidden.

Use these limits when several teams share one subscription and you need predictable ceilings for cost or rules, not only when Azure-wide quota runs out.

Every call to a deployment must prove who is calling. Foundry supports API keys and Microsoft Entra ID. Assigned roles apply only when you use Entra ID; a resource API key grants full access without role checks, which is why Microsoft recommends Entra ID for production.

• API keys are fast for local prototypes, but they cannot show which person sent a request and are hard to limit narrowly.
• Microsoft Entra ID ties each user or app to an identity. SDK quickstarts use DefaultAzureCredential after az login, or a short-lived token from az account get-access-token --scope https://ai.azure.com/.default for REST tests.
• For portal and project work, assign Foundry User on the Foundry resource. To call a deployment when your app runs, you need Foundry User on the resource or the resource API key. Do not use the Azure AI Developer role for Foundry projects—it applies to Azure Machine Learning workspaces and Foundry hubs, not project work.
• For Entra access when calling models, assign Cognitive Services User on the Foundry resource to the app or user, as documented for Azure AI services authentication.

Never commit keys to source control or share them in chat. Prefer managed identities for apps running in Azure so no long-lived secret sits in configuration.

• Pay-per-token deployments (Global Standard, Standard, Data Zone Standard) bill for input and output tokens you consume. Provisioned deployments bill for reserved PTUs whether or not you use them.
• Global Batch and Data Zone Batch trade immediate responses for batch pricing at roughly 50% savings versus Global Standard, with a target turnaround within 24 hours and no real-time service level agreement.
• Instant access (preview) still consumes tokens; it removes deployment setup, not metering. The Foundry platform is free to explore, but each service bills at its own rate.

Set a budget in Azure Cost Management for your subscription or resource group. Budgets send email alerts when thresholds are met; they do not stop usage. Cost and usage data usually appears within 8–24 hours, and budgets evaluate against that data about every 24 hours, so set the first alert conservatively.

Use the Azure pricing calculator and the Microsoft Foundry pricing pages to estimate model and Agent Service charges before you scale tests. Playground evaluations can be enabled by default and included in consumption billing—turn off evaluators in the agents playground if you only need informal tries.

• Sending the catalog model name instead of the deployment name in production code (unless you deliberately use instant access in West US 3).
• Assuming free to explore means free model use—token and provisioned charges still apply.
• Ignoring shared subscription quota so one deployment starves another with 429 errors.
• Relying on API keys in shared repositories instead of Entra ID and Foundry User assignments.
• Choosing Global Batch for a chatbot that needs immediate replies—batch jobs target completion within about 24 hours.

Concept 5 covers prompts and model settings—the options that change how many tokens each request uses. Set deployment type and sign-in method first so those experiments run against the right endpoint and identity.

• Full comparison of deployment types and where data is processed: Deployment types for Microsoft Foundry Models
• Subscription-level quota pools and default limits: Microsoft Foundry Models quotas and limits
• Configure TPM and total token quotas per project: Enforce token limits for models
• Create budgets and alert thresholds in Azure: Create and manage budgets in Azure Cost Management