Overview
This skill area covers the platform work that sits under every Azure AI solution: picking the right Microsoft Foundry service for a requirement, creating the resource, choosing and deploying models, calling them through SDKs or REST endpoints, wiring them into CI/CD (continuous integration and continuous delivery), and running them in containers when data or latency demands it. It then moves to operations (monitoring, cost, key management, authentication) and to responsible AI: content filters, blocklists, Prompt Shields and a governance framework.
The exam treats these as engineering decisions with consequences. A wrong service choice wastes a whole design, a key pasted into code is a security finding, and a missing content filter is a compliance gap. The same decisions reappear inside the generative AI, agent, vision, language and search skill areas, so this domain works as the grammar the rest of the exam is written in.
How it's tested
Questions here are mostly requirement-to-decision scenarios: a company states constraints (data must stay on premises, no secrets in code, one bill, block jailbreak attempts) and you choose the service, deployment option, role or setting that satisfies all of them. Expect BEST and MOST secure wording, short code or CLI completions, and ordering steps for setting up a resource.
-
Constraint-driven service selection
A business need is described in plain language and you map it to a specific Foundry service or feature. The deciding detail is usually a single noun such as handwriting, intent, invoice, or live audio.
-
Least-privilege identity
You choose between keys, managed identity, service principals and RBAC (role-based access control) roles. The secure answer removes stored secrets and grants a data-plane role rather than Owner or Contributor.
-
Safety configuration
A harmful-content or prompt-attack risk is described and you pick the control: content filter severity, custom blocklist, Prompt Shields, or groundedness detection.
A hospital wants speech-to-text on audio that cannot leave its network, but finance still needs Azure billing. Rule out the public cloud endpoint because audio would leave the network. A disconnected container is possible but needs approval and a commitment plan. A connected container processes audio locally and only sends billing metering data, so it meets both stated needs. Pick the option that satisfies every constraint, not just the loudest one.
Skill groups 4
Official skill groups from the Microsoft outline, in outline order.
1.1 Select the appropriate Microsoft Foundry ServicesMap generative AI, vision, language, speech, extraction and search requirements to the right service.
- What it means
- You must match a requirement to a service family: Azure OpenAI in Foundry Models or the Foundry model catalog for generation, Azure Vision for image analysis and OCR, Azure Language for text analytics and conversational language understanding, Azure Speech for audio, Azure Translator for translation, Document Intelligence or Content Understanding for extraction, and Azure AI Search for knowledge mining.
- What to understand
- The service boundary is drawn by the input and the output. Audio in means Speech; forms with fields out means Document Intelligence; searching across thousands of enriched files means AI Search. Generative models can do many of these jobs, but the exam rewards the purpose-built service when the requirement is deterministic, structured or cost-sensitive.
- How it shows up
- A scenario lists two or three needs in one paragraph, such as translating support chats, detecting sentiment and routing by intent, and you must assign each need to the right service or pick the one service that covers all of them.
- Common confusion
- Candidates send everything to a GPT model. When the scenario asks for consistent extraction of invoice totals, Document Intelligence's prebuilt invoice model is the expected answer, not a prompt.
1.2 Plan, create and deploy a Microsoft Foundry ServiceResponsible AI planning, resource creation, model choice, deployment options, SDKs, endpoints, CI/CD and containers.
- What it means
- This covers the lifecycle from design to running service: planning against the six Microsoft responsible AI principles, creating a multi-service or single-service resource, choosing a model, picking a deployment type, installing the SDK, finding the endpoint, automating deployment through a pipeline, and packaging some services as Docker containers.
- What to understand
- A multi-service resource gives one endpoint and key for many services and one bill; a single-service resource is needed for a free tier, separate billing or a feature only that resource type offers. Containers still report usage: you must pass Eula=accept, Billing (the resource endpoint) and ApiKey when starting them. Infrastructure as code (Bicep, ARM templates or Terraform) is how a resource lands in a pipeline repeatably.
- How it shows up
- Expect a docker run command with a missing parameter, a choice between Global Standard, Data Zone and Provisioned deployments, or a step order for creating a resource and calling it from code.
- Common confusion
- Many believe a container runs fully offline by default. Standard containers need outbound connectivity to the billing endpoint; only approved disconnected containers on a commitment plan run without it.
1.3 Manage, monitor, and secure a Microsoft Foundry ServiceMetrics, diagnostic logs, cost control, key rotation and Microsoft Entra ID authentication.
- What it means
- Running a service means watching Azure Monitor metrics and diagnostic logs, setting alerts and budgets, protecting the two account keys, and preferring token-based authentication through Microsoft Entra ID with managed identities and data-plane roles.
- What to understand
- Each resource has two keys so you can rotate without downtime: move clients to key 2, regenerate key 1, then repeat. Store keys in Azure Key Vault, or remove them by using a managed identity with a role such as Cognitive Services User and disabling local (key) authentication. Entra ID authentication needs a custom subdomain endpoint. Diagnostic settings send logs to Log Analytics, storage or Event Hubs; metrics alone do not keep request-level logs.
- How it shows up
- A security review finds keys in source control, or an app must call the service without any stored secret, and you pick the rotation sequence or identity setup.
- Common confusion
- Assigning Contributor or Owner to an app. Those are management-plane roles; the app needs a data-plane role such as Cognitive Services User or Cognitive Services OpenAI User to call the inference APIs.
1.4 Implement AI solutions responsiblyContent moderation, content filters, blocklists, Prompt Shields, harm detection and governance.
- What it means
- Azure AI Content Safety and the content filters built into Foundry model deployments classify text and images into harm categories (hate, sexual, violence, self-harm) with severity levels, and let you add custom blocklists, Prompt Shields for prompt attacks, groundedness detection and protected material detection. Governance wraps these in policy, review and accountability.
- What to understand
- Content filters apply to both the prompt and the completion and are configured per deployment with a severity threshold per category. Prompt Shields detect user prompt attacks (jailbreaks) and document attacks hidden in grounding data. Blocklists catch exact terms the classifiers do not treat as harmful, such as competitor names or internal codenames. A governance framework assigns owners, impact assessments, human review and incident response.
- How it shows up
- A chatbot leaks into an unwanted topic, a user tries a jailbreak, or uploaded documents contain injected instructions, and you choose the specific control that addresses that vector.
- Common confusion
- Treating a blocklist as jailbreak protection. A blocklist matches listed terms; a reworded jailbreak passes it, which is why Prompt Shields exists.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Multi-service vs. single-service resource
A multi-service (Foundry or AI services) resource exposes many services under one endpoint, one key pair and one bill, while a single-service resource covers one service such as Speech or Language.
- Remember
- Choose single-service when you need a free (F0) tier, separate cost tracking per service, or a region where only that service is offered.
- Tested as
- Scenarios that mention consolidated billing or a single credential point to multi-service; scenarios that mention a free tier or separate department billing point to single-service.
- Trap
- Assuming a multi-service resource has a free tier; free tiers belong to single-service resources.
-
Two-key rotation
Every resource issues key 1 and key 2 so applications can switch to one key while the other is regenerated.
- Remember
- The safe order is: update clients to key 2, regenerate key 1, update clients back to key 1 if desired, then regenerate key 2.
- Tested as
- Ordering questions ask for the rotation sequence that causes no downtime.
- Trap
- Regenerating the key that clients are currently using, which breaks them immediately.
-
Managed identity with data-plane roles
A system-assigned or user-assigned managed identity gets an Entra ID token, and a role such as Cognitive Services User authorizes it to call the service with no secret stored anywhere.
- Remember
- Entra ID authentication requires a custom subdomain endpoint, and you can set disableLocalAuth to block key-based calls entirely.
- Tested as
- This is the expected answer whenever a scenario says no secrets in code or configuration.
- Trap
- Choosing Key Vault when the requirement is to eliminate secrets; Key Vault stores the key safely but a key still exists.
-
Container billing parameters
Foundry Tools containers are pulled from the Microsoft Container Registry and started with three required settings that tie them to an Azure resource for metering.
- Remember
- Eula=accept, Billing={endpoint URI}, ApiKey={key}; the container sends usage metering to Azure but your data is processed locally.
- Tested as
- Code-completion items show a docker run command with one setting missing or wrong.
- Trap
- Putting the key in the Billing parameter or the endpoint in ApiKey.
-
Deployment types for Foundry Models
Standard deployments process in one region, Global Standard routes across Azure's global capacity, Data Zone keeps processing within a geographic zone such as the EU, and Provisioned reserves throughput in provisioned throughput units (PTU).
- Remember
- Data residency points to Standard or Data Zone; predictable latency at high, steady volume points to Provisioned; batch jobs that can wait up to 24 hours point to Global Batch at lower cost.
- Tested as
- Cost, residency and latency constraints decide the deployment type in model-deployment scenarios.
- Trap
- Picking Global Standard for an EU data-residency requirement; global routing can process data outside the zone.
-
Diagnostic settings vs. metrics
Metrics (calls, latency, errors, tokens) are collected automatically; diagnostic settings must be added to stream request and audit logs to Log Analytics, a storage account or Event Hubs.
- Remember
- If the scenario wants to query individual requests with KQL (Kusto Query Language), you need a diagnostic setting to a Log Analytics workspace.
- Tested as
- Monitoring questions ask which setting to enable to investigate failures or audit access.
- Trap
- Expecting historical per-request logs from metrics alone.
-
Cost controls
Cost is managed with the pricing calculator before deployment, Cost Management budgets and alerts during operation, commitment tiers for predictable volume, and token or rate limits on model deployments.
- Remember
- Budgets alert; they do not stop spending. Commitment tiers trade a monthly fee for a lower unit price.
- Tested as
- Questions ask how to be warned before overspend or how to cut unit cost for steady high volume.
- Trap
- Believing a budget automatically shuts down the resource when reached.
-
Six responsible AI principles
Microsoft's principles are fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability.
- Remember
- Transparency is about people understanding how the system works and its limits; accountability is about humans owning outcomes.
- Tested as
- Planning questions describe a practice (publishing a transparency note, adding human review) and ask which principle it serves.
- Trap
- Mixing up transparency (explain the system) with accountability (someone answers for it).
-
Content filter severity
Filters classify hate, sexual, violence and self-harm at safe, low, medium and high severity and act on both prompts and completions.
- Remember
- Configure the threshold per category and per direction (input or output) in a content filter, then attach it to a deployment.
- Tested as
- Scenarios ask how to block more or less content for one category without affecting the others.
- Trap
- Thinking one global switch controls all categories; each category has its own threshold.
-
Prompt Shields
Prompt Shields detect user prompt attacks that try to override the system message and document attacks where instructions are hidden in content the model reads.
- Remember
- Document attacks are the indirect injection path through retrieved files, emails or web pages in a RAG (retrieval augmented generation) or agent solution.
- Tested as
- Any scenario mentioning jailbreak attempts or poisoned source documents points here.
- Trap
- Choosing a blocklist or a stricter hate filter for a jailbreak problem.
-
Custom blocklists
A blocklist is a list of exact terms or regular-expression patterns that a filter blocks regardless of harm classification.
- Remember
- Use it for business-specific terms (product codenames, competitor names, profanity variants) that classifiers would rate as safe.
- Tested as
- Requirements to block a specific word or name point to a blocklist, not to a severity change.
- Trap
- Lowering a severity threshold to catch a harmless-looking brand name, which over-blocks everything else.
-
Groundedness detection
Content Safety checks whether a model's answer is supported by the supplied source material and flags ungrounded statements.
- Remember
- It addresses hallucination in RAG answers, not harmful content.
- Tested as
- Scenarios about answers that invent facts not present in the documents point here.
- Trap
- Selecting a harm-category filter for a factual accuracy problem.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
API key vs. Key Vault vs. managed identity
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| API key in configuration | The app sends the resource key in a request header | Simplest, but a long-lived secret exists in the app's settings | Treating it as acceptable for production when the scenario mentions a security audit |
| Key in Azure Key Vault | The key is stored as a secret and the app reads it at runtime | Centralizes and audits the secret, which still exists and still needs rotation | Choosing it when the requirement is to have no secrets at all |
| Managed identity with RBAC | The app obtains an Entra ID token and holds a data-plane role on the resource | No secret to store or rotate; access is revocable by removing the role | Forgetting the custom subdomain or assigning a management role such as Contributor |
Content filter vs. blocklist vs. Prompt Shields vs. groundedness detection
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Content filter | Classifies harm categories by severity on prompts and completions | Catches harmful meaning even when wording varies | Expecting it to block a specific harmless brand name |
| Blocklist | Blocks exact listed terms or patterns | Deterministic and business-specific, but blind to rewording | Using it to stop jailbreaks |
| Prompt Shields | Detects user prompt attacks and document attacks | Targets attempts to override instructions, not harmful topics | Confusing it with a severity threshold |
| Groundedness detection | Checks the answer against provided sources | Targets fabricated facts, not safety | Applying it to toxic output |
Cloud endpoint vs. connected container vs. disconnected container
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Cloud endpoint | Requests go to the Azure-hosted service | Data leaves the network; Microsoft manages scale and updates | Choosing it when data must stay on premises |
| Connected container | The model runs in your Docker host; only metering goes to Azure | Data stays local, but outbound access to the billing endpoint is required | Assuming it works with no internet connection at all |
| Disconnected container | Runs with no connection to Azure | Requires an approved request and a commitment-tier plan | Selecting it when the scenario mentions no approval or commitment |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Key Vault as the zero-secret answer
- What candidates pick
- Store the service key in Azure Key Vault and read it at startup.
- Why it looks right
- Key Vault is the standard secure store and appears in most security guidance.
- Why it's wrong
- The requirement said no credentials stored or managed by the team; a key in Key Vault is still a credential that must be rotated.
Clue to watch for Phrases such as 'without storing any secrets' or 'without managing credentials' point to a managed identity with an RBAC role.
-
Contributor for inference calls
- What candidates pick
- Assign the web app's identity the Contributor role on the resource.
- Why it looks right
- Contributor sounds powerful enough to do anything.
- Why it's wrong
- Contributor is a management-plane role: it can change settings and list keys but has no data actions, so it is both broader than needed and unable to call the inference APIs with a token. The least-privilege role is Cognitive Services User or, for Azure OpenAI, Cognitive Services OpenAI User.
Clue to watch for The words 'least privilege' or 'only needs to call the service'.
-
Wrong key regenerated first
- What candidates pick
- Regenerate key 1, then update the application.
- Why it looks right
- It looks like the obvious first step in rotation.
- Why it's wrong
- If the app is using key 1, regenerating it first causes an outage; the app must move to key 2 before key 1 is regenerated.
Clue to watch for A requirement to rotate keys 'without service interruption'.
-
Global deployment under residency rules
- What candidates pick
- Global Standard deployment for the best quota and availability.
- Why it looks right
- It usually has the highest default throughput and newest models.
- Why it's wrong
- Global routing can process prompts in any Azure region, which breaks a stated EU or country residency requirement.
Clue to watch for Any mention of data residency, sovereignty or a regulator's geographic rule.
-
Container without metering
- What candidates pick
- Run the container with only Eula=accept because data must stay on premises.
- Why it looks right
- It feels like local processing should not need cloud settings.
- Why it's wrong
- Billing and ApiKey are mandatory for connected containers; without them the container will not start serving requests, because it must be able to report usage to Azure.
Clue to watch for The scenario describes an on-premises host that still has outbound internet access.
-
Blocklist for a jailbreak
- What candidates pick
- Add the jailbreak phrase to a custom blocklist.
- Why it looks right
- It blocks the exact text that was observed.
- Why it's wrong
- Attackers rephrase; Prompt Shields classifies the intent of an attack rather than its exact wording.
Clue to watch for Users trying to make the model 'ignore its instructions' or role-play to bypass rules.
Answer framework
Use this sequence for any AI-102 platform, security or safety decision.
- Name the input and the output in the requirement, then map them to the Foundry service built for that pair before considering a general-purpose model.
- List every hard constraint, such as residency, offline processing, single bill or free tier, and eliminate deployment and resource options that break any of them.
- Choose authentication by asking whether a secret may exist; if not, use a managed identity with the narrowest data-plane role.
- Decide where usage is observed and controlled: diagnostic settings to Log Analytics for request logs, budgets for cost alerts, deployment limits for throughput.
- Match each safety risk to its control: severity filters for harmful content, blocklists for named terms, Prompt Shields for attacks, groundedness detection for fabrication.
Practice question
Want more like this? The AI-102 practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with service selection, because every later domain assumes you can tell Vision, Language, Speech, Document Intelligence, Content Understanding and AI Search apart in one read of a scenario. Build a one-page map of input type, output type and service, and test it against short requirement statements until it is automatic.
Next, do the security and operations work hands-on rather than by reading. Create a resource, call it with a key, then switch the same app to a managed identity with Cognitive Services User and disable local authentication. Rotate the keys in the correct order. Add a diagnostic setting and run one KQL query. Pull one container image and start it with the three required parameters. These small tasks are where candidates underestimate the exam, because the questions ask for exact settings and orders.
Finish with responsible AI. Configure a content filter on a model deployment, add a blocklist, and test Prompt Shields with a jailbreak-style prompt and a document containing hidden instructions. Write one sentence for each control saying which risk it stops.
Afterwards, move to Domain 2, where deployment types and content filters reappear inside generative AI scenarios, and practice mixed question sets that combine service choice with identity and safety.
FAQ
How much of the AI-102 exam is this skill area?
Microsoft's final AI-102 study guide weights Plan and manage an Azure AI solution at 20-25%, the largest of the six skill areas. Microsoft does not publish how many questions come from each area.
Do I need to memorize every Foundry service name?
You need to recognize which service fits a requirement and know the current names, because Microsoft renamed many of them in 2025 (for example, Azure AI services became Foundry Tools). Focus on what each service takes in and returns rather than on marketing names.
When is a managed identity the right answer instead of a key?
Whenever the scenario says no secrets may be stored or managed, or asks for the most secure option for an Azure-hosted app. Pair it with a data-plane role such as Cognitive Services User and, if required, disable key-based authentication.
Do Foundry Tools containers work without the internet?
Standard containers need outbound access to report billing, though your data is processed locally. Fully disconnected containers exist but require an approved request and a commitment-tier plan.
What is the difference between Prompt Shields and content filters?
Content filters classify harmful meaning such as hate or violence by severity. Prompt Shields detect attempts to override the model's instructions, either typed by a user or hidden inside documents the model reads.
Why do candidates find this domain hard if it has no complex algorithms?
Because answers hinge on small exact details: which key to regenerate first, which role is data-plane, which container parameter holds the endpoint. Hands-on practice with a real resource is the fastest way to learn them.
How does this domain connect to the rest of AI-102?
Deployment types and content filters return in generative AI, identities and connections return in agents, and managed identities to storage return in Azure AI Search indexers. Many case studies blend these settings into otherwise service-specific questions.
Other Artificial Intelligence & Machine Learning certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 1 knowledge
You have just worked through service selection, deployment options, key rotation, managed identities and content safety controls. Practice questions show whether you can apply them when a scenario hides the deciding constraint in one sentence.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the AI-102 AI tutor Get any concept explained your way