AI Platform: Build on the Platform

This page is for workload teams that have a Foundry project and want to deploy an application that uses it. The examples come from the module READMEs and are reference: names, paths and module sources depend on your deployment code.

What you need from the platform team

Item	Why
Name of your project	The lookup modules find the project and its identity by this name.
Project endpoint	The URL your application calls. The lookup module builds it as https://<account>.services.ai.azure.com/api/projects/<project>.
Membership of the project groups	To work in the project, see Access and RBAC.
Models available in the account	Models are deployed at platform level, not in your project.

Find the platform and the project

Two data-only modules give your code the IDs and endpoints, so nothing is hard-coded:

module "platform_data" {
  source = "<path to modules>/platform_data"
}

module "project_data" {
  source       = "<path to modules>/project_data"
  project_name = "<project>"
}

Module	Use it for
platform_data	Resource group, Foundry account and endpoints, container registry, Container Apps environment, Cosmos DB, AI Search, storage, Key Vault, Log Analytics, spoke VNet and subnets
project_data	Project ID, name and endpoint, and the project identity (client ID, principal ID)

The full list of outputs is on Platform modules.

Give your application an identity

Create a user-assigned managed identity for the application with the workload_identity module, and assign it only the roles it needs:

module "workload_identity" {
  source = "<path to modules>/workload_identity"

  name                = "id-<workload>"
  location            = "<region>"
  resource_group_name = "<resource group>"

  role_assignments = [
    {
      scope                = module.platform_data.ai_search_id
      role_definition_name = "Search Index Data Contributor"
    }
  ]

  tags = {
    Environment = "<environment>"
    Workload    = "<workload>"
  }
}

Run the application

The reference design runs applications in the shared Container Apps environment and pulls images from the shared registry. The module READMEs show the container app receiving the project endpoint and the identity client ID as environment variables:

Environment variable	Value
AZURE_AI_PROJECT_ENDPOINT	module.project_data.project_endpoint
AZURE_CLIENT_ID	module.workload_identity.client_id
AZURE_OPENAI_ENDPOINT	module.platform_data.openai_endpoint
AZURE_AI_SEARCH_ENDPOINT	module.platform_data.ai_search_endpoint

The container app uses the user-assigned identity of the workload (identity_ids = [module.workload_identity.id]) to sign in to the Foundry project. The variable names are the ones used in the README examples. Use the names your SDK or framework expects.

Practical notes

• The workload name is used in resource names, so keep it short (maximum 8 characters in the source conventions).
• A workload can use more than one project: call project_data once per project.
• The Foundry account has no key authentication. If a client library asks for a key, use the identity-based sign-in instead.
• Network access is private. Your application must run in a network that can reach the private endpoints, and the private DNS zones of Architecture must resolve.