Autonomous Foundry deployment

Autonomous Foundry deployment lets Strata provision a new model deployment straight into your organization's own Azure AI Foundry — no trip to the Azure portal. Once it's enabled, turning a model on in the Model Catalog that isn't yet deployed in your Foundry makes Strata create that deployment for you, with a live Deploying… status, and turns the model on once it's ready.

It is an opt-in, admin-controlled capability. Nothing deploys automatically until an administrator turns it on, and every provisioning action is deliberate and audit-logged.

Note

This is distinct from simply enabling or disabling which models your organization can use. Curating the model lineup is governed by the Manage AI models permission; provisioning into your Foundry is governed by Manage AI provider key (see Roles and permissions).

Prerequisites

• Your organization must already have its own Azure AI Foundry connected in Organization settings › AI engine. Autonomous deployment provisions into that Foundry, so connect your organization's Azure AI Foundry there first if you have not already.
• You need the Manage AI provider key permission (canManageFoundry). The built-in admin role has it by default; it can be granted to a custom role on the Roles page by someone who already holds it.
• You need your Foundry's Azure coordinates: the subscription ID, resource group, and Foundry account name.

How the trust works

Strata never holds standing access to your Azure subscription. Instead, the already-consented Strata application (the same app your organization consented to at sign-in) is granted a single, scoped Azure role on your Foundry account: Cognitive Services Contributor. Strata then calls the Azure Resource Manager API as that application, in your tenant, to create model deployments — and only on the Foundry account you specify.

This means:

• The grant is yours to give and yours to revoke — remove the role assignment in Azure and Strata can no longer deploy.
• Access is scoped to the one Foundry account, not your whole subscription.
• No new app consent is required; you are only adding a role assignment to an app you already trust.

Setting it up

Open the Model Catalog (Organization › Models › Manage models, or View models for an admin without Manage AI models). When you have a Foundry connected and the permission, a banner — "Want to enable autonomous Foundry deployments?" — appears. Click Set up to open the three-step flow.

Step 1 — Tell Strata where your Foundry lives

Enter your subscription ID, resource group, and Foundry account name (and your directory/tenant ID if Strata couldn't auto-detect it from your sign-in). These are not secrets; Strata stores them to know which account to deploy into. Click Save & continue.

Step 2 — Grant Strata access to your Foundry

Give the Strata application the Cognitive Services Contributor role on your Foundry account. The setup panel shows the Strata application ID and a ready-to-run command:

az role assignment create \
  --assignee "<strata-app-id>" \
  --role "Cognitive Services Contributor" \
  --scope "/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<account>"

Run it in Azure Cloud Shell (or any signed-in az) in your own tenant. Prefer the portal? Open your Foundry account → Access control (IAM) → Add role assignment → assign Cognitive Services Contributor to the Strata app. Then click Check access — Strata verifies it can reach your Foundry account with the role you granted.

Step 3 — Turn it on

Once access is confirmed, type your organization name to confirm and click Enable autonomous deployment.

Tip

Role assignments can take a minute or two to propagate in Azure. If the access check fails immediately after granting the role, wait briefly and check again.

What happens when you enable a model

With autonomous deployment on, enabling a model in the Model Catalog that isn't yet deployed in your Foundry triggers Strata to provision it. The model's Enable control shows a live Deploying… state, and the model turns on for your organization (the control then reads Enabled) only once Azure finishes creating the deployment. If the model is already deployed, nothing is re-created. If Azure is still creating the deployment after about two minutes, the model is left off and the catalog says to enable it once it shows as deployed. If the deployment is ready but your Foundry still isn't answering for it after about two more minutes, the model is also left off and the catalog says to enable it again in a few minutes.

Before deploying, Strata checks your Foundry's available capacity for that model and region, and sizes the deployment to fit. If your subscription has no quota for the model, the deployment is not attempted — you get a clear message asking you to request a quota increase in Azure, rather than a silent failure.

Provisioning is idempotent and deliberate — it happens because an administrator enabled a model, never on a hidden schedule.

Warning

Claude (Anthropic) models cannot be auto-deployed. Claude — and other models sold through the Azure Marketplace / Models-as-a-Service — require a one-time Azure Marketplace agreement and use a separate inference path, which Strata cannot set up on your behalf. When one of these models isn't deployed in your Foundry yet, Strata can't enable it: the catalog shows Needs Marketplace agreement and refuses the enable. Accept the Marketplace offer and deploy it once in Azure AI Foundry, then enable it in the catalog. (Marketplace models such as Claude are also limited to the Azure regions where Microsoft offers them — confirm the region for the model you want in Azure AI Foundry.) Models sold first-party by Azure — OpenAI (GPT), and the first-party catalog models — deploy automatically.

Managing token capacity (TPM)

Once autonomous deployment is on, you manage each deployed model from its own page in the Model Catalog (open a model, then Manage deployment). On that page you can:

• Increase or decrease its token rate (TPM) with the slider. There is no Apply button — releasing the slider saves the new rate automatically. Strata shows the maximum your quota allows and clamps to it.
• Pin a model version or set its auto-update policy, and choose the content-filter (Responsible-AI) policy applied to the deployment.
• Remove the deployment with the Undeploy button, then Remove deployment to confirm — it's deleted from your Foundry, and Strata turns the model off for your organization too: chats using it switch to another model. This needs Manage AI provider key, not Manage AI models. Both the section and the confirmation say If agents run on it, Strata names them and asks before they pause. Strata checks your organization's model list before it deletes anything, with the same checks as disabling the model in the catalog. While an agent that can still run is set to the model (paused agents, and agents owned by disabled members, don't count), nothing is deleted yet: a second dialog, Remove deployment?, counts those agents and their owners and lists them by owner (see Agent permissions). Remove deployment anyway goes ahead; Cancel leaves the deployment and the model as they were. Those agents pause on their next unattended run, and their owners are told. The removal is refused outright if the model is your last chat model. Sent through the API without ?confirmPause=1, the removal answers 409 with Nothing was removed yet. <N> agents run on this model. Turning it off pauses them until moved to another model. Agents: <agent> (<owner>), … and <N> more. Once the deployment is deleted, Strata turns the model off, trying a second time if the first attempt fails. If both fail, the deployment is gone but the model is still on, and the page says Removed <deployment> from your Foundry, but Strata could not turn the model off. Turn it off in the Model Catalog, or ask an admin who manages models. A removal is audit-logged as auto_deploy.deleted, and the model being turned off as model_disabled (model_disable_failed when both attempts failed). It's reversible: re-enable the model to redeploy.

The catalog's Settings (gear) › Autonomous deployments section is where you set up, enable, or turn off autonomous deployment. Every capacity change and removal is audit-logged. This is the "mini-Foundry" — you manage deployments and their throughput from inside Strata, without opening the Azure portal.

Permissions

Both are managed on the Roles and permissions page. Keeping them separate lets you let a teammate curate the model lineup without also granting them the ability to provision resources in your Azure subscription.

Governance

• Opt-in and admin-controlled. Nothing deploys until an administrator turns it on.
• Deliberate. Provisioning is triggered by enabling a model, not by a background process.
• Audit-logged. Configuring, enabling, disabling, and provisioning are all recorded in the Audit log.
• Reversible. Turn it off anytime from the setup panel, or revoke the Strata app's role in Azure to cut off access entirely.

Troubleshooting

• "Connect your organization's Azure AI Foundry first." Autonomous deployment provisions into your own Foundry, so you must connect one in Organization settings › AI engine before the setup steps appear.
• The access check fails. The role assignment may not have propagated yet (wait a minute and retry), the role may have been granted to the wrong application or scope, or the subscription / resource group / account details may be off. Re-check the location details (Step 1) and the role grant (Step 2).
• The banner or setup option isn't visible. You need the Manage AI provider key permission. Ask an administrator who already holds it to grant it on the Roles page.
• A model stays in "Deploying…". Azure deployment creation can take a little time; the state resolves to Ready when it completes. If it does not, confirm the role assignment is still in place and the Foundry account has capacity for the model.

Related

• AI engine — connect and manage your organization's Azure AI Foundry.
• Models — the Model Catalog you enable models from.
• Roles and permissions — grant Manage AI provider key and Manage AI models.
• Audit log — where provisioning and configuration events are recorded.