Autonomous Foundry deployment

Autonomous Foundry deployment lets Strata provision a new model deployment straight into your organization's own Azure AI Foundry — no trip to the Azure portal. Once it's enabled, turning a model on in the Model Catalog that isn't yet deployed in your Foundry makes Strata create that deployment for you, with live "Deploying… → Ready" status.

It is an opt-in, admin-controlled capability. Nothing deploys automatically until an administrator turns it on, and every provisioning action is deliberate and audit-logged.

Note

This is distinct from simply enabling or disabling which models your organization can use. Curating the model lineup is governed by the Manage AI models permission; provisioning into your Foundry is governed by Manage AI provider key (see Roles and permissions).

Prerequisites

• Your organization must already have its own Azure AI Foundry connected in Org Settings › AI Engine. Autonomous deployment provisions into that Foundry, so connect your organization's Azure AI Foundry there first if you have not already.
• You need the Manage AI provider key permission (canManageFoundry). The built-in admin role has it by default; it can be granted to a custom role on the Roles page by someone who already holds it.
• You need your Foundry's Azure coordinates: the subscription ID, resource group, and Foundry account name.

How the trust works

Strata never holds standing access to your Azure subscription. Instead, the already-consented Strata application (the same app your organization consented to at sign-in) is granted a single, scoped Azure role on your Foundry account: Cognitive Services Contributor. Strata then calls the Azure Resource Manager API as that application, in your tenant, to create model deployments — and only on the Foundry account you specify.

This means:

• The grant is yours to give and yours to revoke — remove the role assignment in Azure and Strata can no longer deploy.
• Access is scoped to the one Foundry account, not your whole subscription.
• No new app consent is required; you are only adding a role assignment to an app you already trust.

Setting it up

Open the Model Catalog (Org Settings › Models). When you have a Foundry connected and the permission, a banner — "Want to enable autonomous Foundry deployments?" — appears. Click Set up to open the three-step flow.

Step 1 — Tell Strata where your Foundry lives

Enter your subscription ID, resource group, and Foundry account name (and your directory/tenant ID if Strata couldn't auto-detect it from your sign-in). These are not secrets; Strata stores them to know which account to deploy into. Click Save & continue.

Step 2 — Grant Strata access to your Foundry

Give the Strata application the Cognitive Services Contributor role on your Foundry account. The setup panel shows the Strata application ID and a ready-to-run command:

az role assignment create \
  --assignee "<strata-app-id>" \
  --role "Cognitive Services Contributor" \
  --scope "/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<account>"

Run it in Azure Cloud Shell (or any signed-in az) in your own tenant. Prefer the portal? Open your Foundry account → Access control (IAM) → Add role assignment → assign Cognitive Services Contributor to the Strata app. Then click Check access — Strata verifies it can reach your Foundry account with the role you granted.

Step 3 — Turn it on

Once access is confirmed, type your organization name to confirm and click Enable autonomous deployment.

Tip

Role assignments can take a minute or two to propagate in Azure. If the access check fails immediately after granting the role, wait briefly and check again.

What happens when you enable a model

With autonomous deployment on, enabling a model in the Model Catalog that isn't yet deployed in your Foundry triggers Strata to provision it. The catalog shows a live Deploying… state that resolves to Ready once Azure finishes creating the deployment. If the model is already deployed, nothing is re-created.

Before deploying, Strata checks your Foundry's available capacity for that model and region, and sizes the deployment to fit. If your subscription has no quota for the model, the deployment is not attempted — you get a clear message asking you to request a quota increase in Azure, rather than a silent failure.

Provisioning is idempotent and deliberate — it happens because an administrator enabled a model, never on a hidden schedule.

Warning

Claude (Anthropic) models cannot be auto-deployed. Claude — and other models sold through the Azure Marketplace / Models-as-a-Service — require a one-time Azure Marketplace agreement and use a separate inference path, which Strata cannot set up on your behalf. When you enable one of these models, Strata enables it for your organization but does not create the Foundry deployment; deploy it once in Azure AI Foundry and Strata will detect it and show it as Deployed. (Claude is also only available in East US 2 and Sweden Central.) Models sold first-party by Azure — OpenAI (GPT), and the first-party catalog models — deploy automatically.

Managing token capacity (TPM)

Once autonomous deployment is on, you manage each deployed model from its own page in the Model Catalog (open a model, then Manage). On that page you can:

• Increase or decrease its token rate (TPM) with the slider. There is no Apply button — releasing the slider saves the new rate automatically. Strata shows the maximum your quota allows and clamps to it.
• Pin a model version or set its auto-update policy, and choose the content-filter (Responsible-AI) policy applied to the deployment.
• Remove the deployment with the Undeploy button — it's deleted from your Foundry (reversible: re-enable the model to redeploy).

The catalog's Settings (gear) › Autonomous deployments section is where you set up, enable, or turn off autonomous deployment. Every capacity change and removal is audit-logged. This is the "mini-Foundry" — you manage deployments and their throughput from inside Strata, without opening the Azure portal.

Permissions

Both are managed on the Roles and permissions page. Keeping them separate lets you let a teammate curate the model lineup without also granting them the ability to provision resources in your Azure subscription.

Governance

• Opt-in and admin-controlled. Nothing deploys until an administrator turns it on.
• Deliberate. Provisioning is triggered by enabling a model, not by a background process.
• Audit-logged. Configuring, enabling, disabling, and provisioning are all recorded in the Audit log.
• Reversible. Turn it off anytime from the setup panel, or revoke the Strata app's role in Azure to cut off access entirely.

Troubleshooting

• "Connect your organization's Azure AI Foundry first." Autonomous deployment provisions into your own Foundry, so you must connect one in Org Settings › AI Engine before the setup steps appear.
• The access check fails. The role assignment may not have propagated yet (wait a minute and retry), the role may have been granted to the wrong application or scope, or the subscription / resource group / account details may be off. Re-check the location details (Step 1) and the role grant (Step 2).
• The banner or setup option isn't visible. You need the Manage AI provider key permission. Ask an administrator who already holds it to grant it on the Roles page.
• A model stays in "Deploying…". Azure deployment creation can take a little time; the state resolves to Ready when it completes. If it does not, confirm the role assignment is still in place and the Foundry account has capacity for the model.

Related

• AI engine — connect and manage your organization's Azure AI Foundry.
• Models — the Model Catalog you enable models from.
• Roles and permissions — grant Manage AI provider key and Manage AI models.
• Audit log — where provisioning and configuration events are recorded.