1. Deployment types
| Type | Where processing happens | Billing | Good for |
|---|---|---|---|
| Standard (regional) | The resource's region | Per token | Strict regional data residency |
| Global Standard | Any Azure region worldwide | Per token, highest default quota | Most workloads without residency limits |
| Data Zone Standard | Within a data zone (for example the EU or the US) | Per token | Residency within a geography |
| Provisioned (Regional / Global / Data Zone PTU) | As above | Per PTU-hour (reservations available) | Steady volume, predictable latency |
| Batch (Global / Data Zone) | As above | Per token at a discount | Asynchronous jobs completed within 24 h |
Data stored at rest stays in the resource's geography in every case. The type controls where inference runs.
2. Create the resource and deployment
az cognitiveservices account create -n aoai-prod-cin -g rg-ai-prod -l centralindia \
--kind OpenAI --sku S0 --custom-domain aoai-prod-cin
az cognitiveservices account deployment create -n aoai-prod-cin -g rg-ai-prod \
--deployment-name chat-gpt4o \
--model-name gpt-4o --model-version "2024-11-20" --model-format OpenAI \
--sku-name GlobalStandard --sku-capacity 300
--sku-capacity for Standard types is in units of 1,000 tokens per minute (300 = 300K TPM). Check the model and region availability tables before you choose.
3. Quota
- Quota is per subscription, per region, per model and per deployment type.
- See it in the Foundry portal under Quota, or with
az cognitiveservices usage list -l centralindia. - Split quota across deployments by app. Ask for an increase early (the request form for Standard types; PTU needs available capacity).
4. PTU sizing
Use the capacity calculator in the Foundry portal with your real numbers: requests per minute, prompt tokens, and output tokens. Then:
- Start a PTU deployment with the calculated units and a reservation if it's long term.
- Watch the
Provisioned-managed Utilizationmetric. At 100%, requests get 429s, so spill over to a Standard deployment through the gateway.
5. Version upgrade policy
When you create a deployment, choose:
- Auto-update to default: moves to new default versions automatically.
- Upgrade when expired: stays on your version until it's retired.
- No auto-upgrade: the deployment stops working when the version is retired.
For production, pin the version, test new versions with your evaluation set, and upgrade on purpose before the retirement date.
6. Content filters
The default filter applies medium thresholds for hate, sexual, violence and self-harm, plus prompt shields. Create a custom filter policy if your use case needs different settings (stricter for public users), and attach it to the deployment.
7. Keyless authentication
from azure.identity import DefaultAzureCredential, get_bearer_token_provider
from openai import AzureOpenAI
token = get_bearer_token_provider(DefaultAzureCredential(), "https://cognitiveservices.azure.com/.default")
client = AzureOpenAI(azure_endpoint="https://aoai-prod-cin.openai.azure.com",
azure_ad_token_provider=token, api_version="2024-10-21")
r = client.chat.completions.create(model="chat-gpt4o",
messages=[{"role": "user", "content": "Hello"}])
print(r.choices[0].message.content)
Give the app's managed identity Cognitive Services OpenAI User, then disable key authentication on the resource.
Tip
One deployment per application (not one shared deployment) gives you per-app quota, metrics and version control, at no extra cost for pay-as-you-go types.