Skip to content

Commit 93488c4

Browse files
santiagxfsantiagxf
committed
fixes
1 parent 76cb7fa commit 93488c4

File tree

1 file changed

+80
-104
lines changed

1 file changed

+80
-104
lines changed

‎articles/ai-foundry/model-inference/how-to/configure-deployment-policies.md

Lines changed: 80 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,7 @@ When using models from Azure AI Services and Azure OpenAI with Azure AI Foundry,
2525

2626
## Create a custom policy
2727

28-
Select the scenario that applies to your case better:
29-
30-
# [Enforce specific models](#tab/models)
31-
32-
Follow these steps to create and assign an example custom policy to allow specific models from the model catalog.
28+
Follow these steps to create and assign an example custom policy to control model deployments:
3329

3430
1. From the [Azure portal](https://portal.azure.com), select **Policy** from the left side of the page. You can also search for **Policy** in the search bar at the top of the page.
3531

@@ -43,131 +39,111 @@ Follow these steps to create and assign an example custom policy to allow specif
4339
- **Name**: Enter a unique name for the policy definition. For example, `Custom allowed Azure AI services and Azure OpenAI models`.
4440
- **Description**: Enter a description for the policy definition.
4541
- **Category**: You can either create a new category or use an existing one. For example, "AI model governance."
46-
- **Policy rule**: Enter the policy rule in JSON format. The following example shows a policy rule that allows the deployment of specific Azure AI services and Azure OpenAI models:
4742

48-
> [!TIP]
49-
> Azure AI services was originally named Azure Cognitive Services. This name is still used internally by Azure, such as this custom policy where you see a value of `Microsoft.CognitiveServices`. Azure OpenAI is part of Azure AI services, so this policy also applies to Azure OpenAI models.
43+
4. On **Policy rule**, enter the policy rule details in JSON format. Select the scenario that applies to your case better:
5044

51-
```json
52-
{
53-
"mode": "All",
54-
"policyRule": {
55-
"if": {
56-
"allOf": [
57-
{
58-
"field": "type",
59-
"equals": "Microsoft.CognitiveServices/accounts/deployments"
60-
},
61-
{
62-
"not": {
63-
"value": "[concat(field('Microsoft.CognitiveServices/accounts/deployments/model.name'), ',', field('Microsoft.CognitiveServices/accounts/deployments/model.version'))]",
64-
"in": "[parameters('allowedModels')]"
65-
}
66-
}
67-
]
45+
# [Enforce specific models](#tab/models)
46+
47+
The following policy allows you to control which specific models and versions are available for deployment. You can enforce this policy at different levels depending on your needs.
48+
49+
```json
50+
{
51+
"mode": "All",
52+
"policyRule": {
53+
"if": {
54+
"allOf": [
55+
{
56+
"field": "type",
57+
"equals": "Microsoft.CognitiveServices/accounts/deployments"
6858
},
69-
"then": {
70-
"effect": "deny"
71-
}
72-
},
73-
"parameters": {
74-
"allowedModels": {
75-
"type": "Array",
76-
"metadata": {
77-
"displayName": "Allowed AI models",
78-
"description": "The list of allowed models to be deployed."
59+
{
60+
"not": {
61+
"value": "[concat(field('Microsoft.CognitiveServices/accounts/deployments/model.name'), ',', field('Microsoft.CognitiveServices/accounts/deployments/model.version'))]",
62+
"in": "[parameters('allowedModels')]"
7963
}
8064
}
65+
]
66+
},
67+
"then": {
68+
"effect": "deny"
69+
}
70+
},
71+
"parameters": {
72+
"allowedModels": {
73+
"type": "Array",
74+
"metadata": {
75+
"displayName": "Allowed AI models",
76+
"description": "The list of allowed models to be deployed."
8177
}
78+
}
8279
}
83-
```
84-
85-
4. Select **Save** to save the policy definition. After saving, you arrive at the policy definition's overview page.
86-
87-
5. From the policy definition's overview page, select **Assign policy** to assign the policy definition.
80+
}
81+
```
8882

89-
6. From the **Assign policy** page, use the following values on the **Basics** tab:
83+
# [Enforce specific deployment types](#tab/deployments)
9084

91-
- **Scope**: Select the scope where you want to assign the policy. The scope can be a management group, subscription, or resource group.
92-
- **Policy definition**: This field is prepopulated with the title of policy definition you created previously.
93-
- **Assignment name**: Enter a unique name for the assignment.
94-
- **Policy enforcement**: Make sure that the **Policy enforcement** field is set to **Enabled**. If it isn't enabled, the policy isn't enforced.
85+
The following policy allows you to control which types of deployments are allowed in the Azure AI Services or Azure OpenAI Resources. For example, you might want to prevent developers from creating deployments that result in data processed in a different region. Follow these steps to create a policy that denies creating global processing deployment types.
9586

96-
Select **Next** at the bottom of the page, or the **Parameters** tab at the top of the page.
87+
```json
88+
{
89+
"mode": "All",
90+
"policyRule": {
91+
"if": {
92+
"allOf": [
93+
{
94+
"field": "type",
95+
"equals": "Microsoft.CognitiveServices/accounts/deployments"
96+
},
97+
{
98+
"field": "Microsoft.CognitiveServices/accounts/deployments/sku.name",
99+
"equals": "GlobalStandard"
100+
}
101+
]
102+
},
103+
"then": {
104+
"effect": "deny"
105+
}
106+
}
107+
}
108+
```
97109

98-
7. From the **Parameters** tab, set **Allowed AI models** to the list of models that you want to allow. The list should be a comma-separated list of model names and approved versions, surrounded by square brackets. For example, `["gpt-4,0613", "gpt-35-turbo,0613"]`.
110+
---
99111

100112
> [!TIP]
101-
> You can find the model names and their versions in the [Azure AI Foundry Model Catalog](https://ai.azure.com/explore/models). Select the model to view the details, and then copy the model name and their version in the title.
102-
103-
8. Optionally, select the **Non-compliance messages** tab at the top of the page and set a custom message for noncompliance.
113+
> Azure AI services was originally named Azure Cognitive Services. This name is still used internally by Azure, such as this custom policy where you see a value of `Microsoft.CognitiveServices`. Azure OpenAI is part of Azure AI services, so this policy also applies to Azure OpenAI models.
104114

105-
9. Select **Review + create** tab and verify that the policy assignment is correct. When ready, select **Create** to assign the policy.
115+
5. Select **Save** to save the policy definition. After saving, you arrive at the policy definition's overview page.
106116

107-
10. Notify your developers that the policy is in place. They receive an error message if they try to deploy a model that isn't in the list of allowed models.
117+
6. From the policy definition's overview page, select **Assign policy** to assign the policy definition.
108118

119+
7. From the **Assign policy** page, use the following values on the **Basics** tab:
109120

110-
# [Enforce specific deployment types](#tab/deployments)
121+
- **Scope**: Select the scope where you want to assign the policy. The scope can be a management group, subscription, or resource group.
122+
- **Policy definition**: This field is prepopulated with the title of policy definition you created previously.
123+
- **Assignment name**: Enter a unique name for the assignment.
124+
- **Policy enforcement**: Make sure that the **Policy enforcement** field is set to **Enabled**. If it isn't enabled, the policy isn't enforced.
111125

112-
The following policy allows you to control which types of deployments are allowed in the Azure AI Services or Azure OpenAI Resources. For example, you might want to prevent developers from creating deployments that result in data processed in a different region. Follow these steps to create a policy that denies creating global processing deployment types.
126+
Select **Next** at the bottom of the page, or the **Parameters** tab at the top of the page.
113127

114-
1. From the [Azure portal](https://portal.azure.com), select **Policy** from the left side of the page. You can also search for **Policy** in the search bar at the top of the page.
115-
116-
2. From the left side of the Azure Policy Dashboard, select **Authoring**, **Definitions**, and then select **+ Policy definition** from the top of the page.
128+
8. Configure the parameters for the policy (if any):
117129

118-
:::image type="content" source="../media/configure-deployment-policies/create-new-policy.png" alt-text="An screenshot showing how to create a new policy definition in Azure Policies." lightbox="../media/configure-deployment-policies/create-new-policy.png":::
119-
120-
3. In the **Policy Definition** form, use the following values:
130+
# [Enforce specific models](#tab/models)
121131

122-
- **Definition location**: Select the subscription or management group where you want to store the policy definition.
123-
- **Name**: Enter a unique name for the policy definition. For example, `Custom allowed Azure AI services and Azure OpenAI deployments`.
124-
- **Description**: Enter a description for the policy definition.
125-
- **Category**: You can either create a new category or use an existing one. For example, "AI model governance."
126-
- **Policy rule**: Enter the policy rule in JSON format. The following example shows a policy rule that blocks specific deployment types, particularly Global Standard.
127-
128-
```json
129-
{
130-
"mode": "All",
131-
"policyRule": {
132-
"if": {
133-
"allOf": [
134-
{
135-
"field": "type",
136-
"equals": "Microsoft.CognitiveServices/accounts/deployments"
137-
},
138-
{
139-
"field": "Microsoft.CognitiveServices/accounts/deployments/sku.name",
140-
"equals": "GlobalStandard"
141-
}
142-
]
143-
},
144-
"then": {
145-
"effect": "deny"
146-
}
147-
}
148-
}
149-
```
132+
From the **Parameters** tab, set **Allowed AI models** to the list of models that you want to allow. The list should be a comma-separated list of model names and approved versions, surrounded by square brackets. For example, `["gpt-4,0613", "gpt-35-turbo,0613"]`.
150133

151-
4. Select **Save** to save the policy definition. After saving, you arrive at the policy definition's overview page.
152-
153-
5. From the policy definition's overview page, select **Assign policy** to assign the policy definition.
154-
155-
6. From the **Assign policy** page, use the following values on the **Basics** tab:
134+
> [!TIP]
135+
> You can find the model names and their versions in the [Azure AI Foundry Model Catalog](https://ai.azure.com/explore/models). Select the model to view the details, and then copy the model name and their version in the title.
156136

157-
- **Scope**: Select the scope where you want to assign the policy. The scope can be a management group, subscription, or resource group.
158-
- **Policy definition**: This field is prepopulated with the title of policy definition you created previously.
159-
- **Assignment name**: Enter a unique name for the assignment.
160-
- **Policy enforcement**: Make sure that the **Policy enforcement** field is set to **Enabled**. If it isn't enabled, the policy isn't enforced.
137+
# [Enforce specific deployment types](#tab/deployments)
161138

162-
7. Select **Next** at the bottom of the page, or the **Parameters** tab at the top of the page.
139+
This policy doesn't require parameters.
163140

164-
8. Optionally, select the **Non-compliance messages** tab at the top of the page and set a custom message for noncompliance.
141+
9. Optionally, select the **Non-compliance messages** tab at the top of the page and set a custom message for noncompliance.
165142

166-
9. Select the **Review + create** tab and verify that the policy assignment is correct. When ready, select **Create** to assign the policy.
143+
10. Select **Review + create** tab and verify that the policy assignment is correct. When ready, select **Create** to assign the policy.
167144

168-
10. Notify your developers that the policy is in place. They receive an error message if they try to deploy a model that isn't in the list of allowed models.
145+
11. Notify your developers that the policy is in place. They receive an error message if they try to deploy a model that isn't in the list of allowed models.
169146

170-
---
171147

172148
## Verify policy assignment
173149

@@ -179,9 +155,9 @@ To monitor compliance with the policy, follow these steps:
179155

180156
1. From the [Azure portal](https://portal.azure.com), select **Policy** from the left side of the page. You can also search for **Policy** in the search bar at the top of the page.
181157

182-
1. From the left side of the Azure Policy Dashboard, select **Compliance**. Each policy assignment is listed with the compliance status. To view more details, select the policy assignment.
158+
1. From the left side of the Azure Policy Dashboard, select **Compliance**. Each policy assignment is listed with the compliance status. To view more details, select the policy assignment. The following example shows the compliance report for a policy that blocks deployments of type *Global standard*.
183159

184-
:::image type="content" source="../media/configure-deployment-policies/policy-compliance.png" alt-text="An screenshot showing an example of a policy compliance report." lightbox="../media/configure-deployment-policies/policy-compliance.png":::
160+
:::image type="content" source="../media/configure-deployment-policies/policy-compliance.png" alt-text="An screenshot showing an example of a policy compliance report for a policy that blocks Global standard deployment SKUs." lightbox="../media/configure-deployment-policies/policy-compliance.png":::
185161

186162
## Update the policy assignment
187163

0 commit comments

Comments
 (0)