Configuring Model Deployments

What a model deployment is

A model in the catalog is a description. A deployment is the running thing your code calls, with its own name, type and quota.

You deploy a Foundry Model in a Foundry resource to make it available for inference, and the deployment is then available when you specify the deployment name in your requests. By default, the deployment uses the model name, and you can modify this name before deploying. During inference, the deployment name is used in the model parameter to route requests to that particular deployment.

Because the name is the address, one model can sit behind several addresses. You can deploy the same model multiple times as long as you give each deployment a different deployment name. This is useful when you want to test different configurations for a given model, including content filters.

A practical pattern: keep chat-prod with your production content filter, and create chat-test from the same model with a stricter filter. Your test harness sends the same prompts to both names and compares the results.

Permissions and Azure Marketplace

Two separate permission questions come up before the first deployment: can you create deployments at all, and may you buy the model you picked?

To create and manage deployments, you need the Cognitive Services Contributor role or equivalent permissions on the Foundry resource. Without it, deployment fails with an authorization error, and the resolution is to assign that role on the Foundry resource.

Foundry Models from partners and community, such as Llama-4-Scout-17B-16E-Instruct, require that you subscribe to Azure Marketplace before deployment. Foundry Models sold by Azure, such as Azure OpenAI in Foundry Models, don't have this requirement.

The Marketplace subscription has its own permissions, separate from the Foundry resource role. Subscribing needs Marketplace permissions on the Azure subscription, and the Owner and Contributor built-in roles on the subscription include them; otherwise you need a custom role with the listed actions. Creating and using the SaaS resource also needs Microsoft.SaaS/resources/read and Microsoft.SaaS/resources/write on the resource group. The Microsoft.SaaS/register/action permission is a one-time registration of the SaaS resource provider on the subscription, so it doesn't need to be repeated for each deployment.

Deploy in the Foundry portal

The portal path is the quickest way to get one deployment running and see it answer.

In the portal, you select Discover and then Models, open a model card, and choose Deploy, either with Custom settings to customize the deployment or with Default settings. For a partner model, you read the terms of use and select Agree and Proceed. When the deployment completes, you land in the playground, and you verify that the deployment status shows Succeeded. Your project and resource must be in one of the supported regions of deployment for the model.

After the first deployment, you manage them from a different place. To manage deployments, you select Build and then Models to see the list of deployments in the resource. From a deployment's detail page, you can view endpoint details and keys, adjust deployment settings, or delete a deployment that you no longer need. In the playground, the Code tab shows how to access the deployment programmatically.

Remember the two entry points: Discover is where you find and deploy a model, and Build is where you manage what you already deployed.

Deploy with Azure CLI and Bicep

Scripts and templates make deployments repeatable across environments, which the portal cannot do.

The az cognitiveservices commands are part of the core Azure CLI, version 2.60 or later, so no extra extension is required. az cognitiveservices account list-models lists the model definitions available to you and under which SKU. Each deployment type is represented by a SKU code in the CLI and ARM. To deploy, you need the model's name, format, version, and sku, where format indicates the provider offering the model; depending on the type of deployment, you might also need capacity.

az cognitiveservices account deployment create adds the deployment, with --deployment-name, --model-name, --model-version, --model-format, --sku-capacity, and --sku-name (for example, GlobalStandard). az cognitiveservices account deployment show confirms that the provisioningState is Succeeded, and the list and delete subcommands view and remove deployments. With Bicep, you describe the deployment in a template and run it with az deployment group create.

If a command isn't recognized, your Azure CLI is out of date: update to version 2.60 or later with az upgrade.

Call the deployment from code

Once the deployment shows Succeeded, your code needs two things: the route and the name.

To make requests with the OpenAI v1 API, call the /openai/v1/ route on the endpoint URL and pass the deployment name in the model field of your request. The /openai/v1/ route uses implicit versioning, so you don't pass an api-version.

So switching an application from one deployment to another in the same resource changes a single value. The base URL and the authentication stay the same, and only the deployment name in the model field moves from, say, chat-prod to chat-v2.

Quota for deployments

Every deployment draws from a shared pool, and when the pool is empty, new deployments stop.

Deploying and running inference consume quota that Azure assigns to your subscription on a per-region, per-model basis, in units of tokens per minute (TPM). You assign TPM to each deployment as you create it, which reduces the available quota for that model.

When you reach your quota limit, you can only create new deployments of that model if you request more quota by submitting a quota increase form, or adjust the allocated quota on other model deployments to free up tokens for new deployments.

Picture the pool as belonging to the subscription, the region and the model together. A new deployment name, a second resource or a new project in the same subscription and region all draw from that same pool. Only two moves create room: