You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/ai-services/agents/how-to/use-your-own-vnet.md
+28-21Lines changed: 28 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: 'Setup an agent with standard setup and your own vnet in the Azure AI Agent Service'
2
+
title: 'Set up an agent with standard setup and your own vnet in the Azure AI Agent Service'
3
3
titleSuffix: Azure OpenAI
4
4
description: Learn how to use your own vnet with the Azure AI Agent Service.
5
5
services: cognitive-services
@@ -18,9 +18,9 @@ ms.custom: azure-ai-agents
18
18
19
19
1. An Azure subscription - [Create one for free](https://azure.microsoft.com/free/cognitive-services).
20
20
2.[Python 3.8 or later](https://www.python.org/)
21
-
3. Make the person deploying the template has the role: **Contributor** assigned at the resource group level and they are deploying this template in that specific resource group (specific role). [Learn more](https://learn.microsoft.com/azure/ai-studio/concepts/rbac-ai-studio)
22
-
4. To deploy the bicep template and configure RBAC you need to have the role: **Role Based Access Administrator** at the subscription level.
23
-
* Note: The **Owner** role at the subscription level satisfies this.
21
+
3. Make sure the person deploying the template has the role: **Contributor** assigned at the resource group level, and they're deploying this template in that specific resource group (specific role). [Learn more](https://learn.microsoft.com/azure/ai-studio/concepts/rbac-ai-studio)
22
+
4. To deploy the bicep template and configure RBAC (Role-Based Access Control), you need to have the role: **Role Based Access Administrator** at the subscription level.
23
+
* Note: The **Owner** role at the subscription level satisfies this requirement.
24
24
5. Install [the Azure CLI and the machine learning extension](/azure/machine-learning/how-to-configure-cli). If you have the CLI already installed, make sure it's updated to the latest version.
25
25
6. Register providers
26
26
The following providers must be registered:
@@ -45,20 +45,27 @@ ms.custom: azure-ai-agents
45
45
46
46
## Deploy the Bicep Template
47
47
48
-
**Network Secured Setup**: Agents use customer-owned, single-tenant search and storage resources. With this setup, you have full control and visibility over these resources, but you will incur costs based on your usage.
48
+
**Network Secured Setup**: Agents use customer-owned, single-tenant search and storage resources. With this setup, you have full control and visibility over these resources, but you incur costs based on your usage.
49
49
50
-
* Resources for the hub, project, storage account, key vault, AI Services, and Azure AI Search will be created for you. The AI Services, AI Search, and Azure Blob Storage account will be connected to your project/hub and a gpt-4o-mini model will be deployed in the westus2 region.
51
-
* Customerowned resources will be secured with a provisioned managed network and authenticated with a User Managed Identity with the necessary RBAC permissions. Private links and DNS zones will be created on behalf of the customer to ensure network connectivity.
50
+
* Resources for the hub, project, storage account, key vault, AI Services, and Azure AI Search are created for you. The AI Services, AI Search, and Azure Blob Storage account are connected to your project/hub, and a gpt-4o-mini model is deployed in the westus2 region.
51
+
* Customer-owned resources are secured with a provisioned managed network and authenticated with a User Managed Identity with the necessary RBAC permissions. Private links and DNS zones are created on behalf of the customer to ensure network connectivity.
52
52
53
53
<br/>
54
54
55
55
<details>
56
56
<summary><b> Bicep Technical Details</b>
57
57
</summary>
58
58
59
-
**The Bicep template automates the following configurations and resource provisions:**
60
-
* Creates a User Assigned Identify. [Learn more](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities?pivots=identity-mi-methods-azp#create-a-user-assigned-managed-identity)
61
-
* The User Assigned Managed Identity requires the following Role Based Access Roles: KeyVault Secret Officer, KeyVault Contributor , Storage Blob Data Owner, Storage Queue Data Contributor, Cognitive Services Contributor, Cognitive Services OpenAI User, Search Index Data Contributor, Search Service Contributor
59
+
**The Bicep template automates the following configurations and resource provisions:*** Creates a User Assigned Identity. [Learn more](../../../azure/active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities?pivots=identity-mi-methods-azp#create-a-user-assigned-managed-identity)
60
+
* The User Assigned Managed Identity requires the following Role-Based Access Roles:
61
+
* KeyVault Secret Officer
62
+
* KeyVault Contributor
63
+
* Storage Blob Data Owner
64
+
* Storage Queue Data Contributor
65
+
* Cognitive Services Contributor
66
+
* Cognitive Services OpenAI User
67
+
* Search Index Data Contributor
68
+
* Search Service Contributor
62
69
63
70
* Configures a managed virtual network with two subnet resources:
64
71
* Azure Resource Subnet
@@ -76,21 +83,21 @@ ms.custom: azure-ai-agents
76
83
* Private endpoints in the Azure Resource subnet
77
84
* Private DNS integration enabled
78
85
* User Assigned Identity for authentication
79
-
* Creates a hub and project using the resources provisioned above and configures them to use the Agent Resource Subnet.
80
-
* Accomplished by configuring the capabilityHost (a sub-resource of hub/project) to use the Agent Resource Subnet for network isolation and secure communication.
86
+
* Creates a hub and project using the resources provisioned and configures them to use the Agent Resource Subnet.
87
+
* Accomplished by configuring the capabilityHost (a subresource of hub/project) to use the Agent Resource Subnet for network isolation and secure communication.
| `network-secured-agent.bicep` | Deploy a network secured agent setup that uses User Managed Identity authentication on the Agent Connections. | [](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Frefs%2Fheads%2Fmaster%2Fquickstarts%2Fmicrosoft.azure-ai-agent-service%2Fnetwork-secured-agent%2Fazuredeploy.json)
90
97
91
98
### Option 2: Manually Deploy the Bicep Template
92
99
93
-
1. If you want to manually run the bicep templates, you can [download the template from GitHub](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.azure-ai-agent-service/network-secured-agent). Download the following from the network-secured-agent folder:
100
+
1. To manually run the bicep templates, [download the template from GitHub](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.azure-ai-agent-service/network-secured-agent). Download the following from the network-secured-agent folder:
94
101
1. main.bicep
95
102
1. azuredeploy.parameters.json
96
103
1. modules-network-secured folder
@@ -106,7 +113,7 @@ ms.custom: azure-ai-agents
106
113
az group create --name {my_resource_group} --location eastus
107
114
```
108
115
109
-
Make sure you have the role Azure AI Developer on the resource group you just created.
116
+
Make sure you have the role Azure AI Developer on the resource group you created.
110
117
1. Using the resource group you created in the previous step and one of the template files (either basic-agent-keys.bicep or basic-agent-identity.bicep), run one of the following commands:
111
118
112
119
1. To use default resource names, run:
@@ -115,14 +122,14 @@ ms.custom: azure-ai-agents
115
122
az deployment group create --resource-group {my_resource_group} --template-file main.bicep
116
123
```
117
124
118
-
1. To specify custom names for the hub, project, storage account, and/or Azure AI service resources (Note: a randomly generated suffix will be added to prevent accidental duplication), run:
125
+
1. To specify custom names for the hub, project, storage account, and/or Azure AI service resources (Note: a randomly generated suffix is added to prevent accidental duplication), run:
119
126
120
127
```console
121
128
az deployment group create --resource-group {my_resource_group} --template-file main.bicep --parameters aiHubName='your-hub-name' aiProjectName='your-project-name' storageName='your-storage-name' aiServicesName='your-ai-services-name'
122
129
123
130
```
124
131
125
-
1. To customize additional parameters, including the OpenAI model deployment, download and edit the azuredeploy.parameters.json file, then run:
132
+
1. To customize other parameters, including the OpenAI model deployment, download and edit the azuredeploy.parameters.json file, then run:
126
133
127
134
```console
128
135
az deployment group create --resource-group {my_resource_group} --template-file main.bicep --parameters @azuredeploy.parameters.json
| Agent | Custom AI that uses AI models in conjunction with tools. |
142
+
| Agent | Custom AI that uses AI models with tools. |
136
143
| Tool | Tools help extend an agent’s ability to reliably and accurately respond during conversation. Such as connecting to user-defined knowledge bases to ground the model, or enabling web search to provide current information. |
137
144
| Thread | A conversation session between an agent and a user. Threads store Messages and automatically handle truncation to fit content into a model’s context. |
138
145
| Message | A message created by an agent or a user. Messages can include text, images, and other files. Messages are stored as a list on the Thread. |
@@ -156,11 +163,11 @@ Next, to authenticate your API requests and run the program, use the [az login](
156
163
az login
157
164
```
158
165
159
-
Use the following code to create and run an agent. To run this code, you will need to create a connection string using information from your project. This string is in the format:
166
+
Use the following code to create and run an agent. To run this code, you need to create a connection string using information from your project. This string is in the format:
`HostName` can be found by navigating to your `discovery_url` and removing the leading `https://` and trailing `/discovery`. To find your `discovery_url`, run this CLI command:
0 commit comments