AI-901
Deep Dive
Azure OpenAI Service provides enterprise access to OpenAI's models (GPT-5, gpt-image, audio models) with Azure's infrastructure, security and compliance. The AI-901 tests which models to use in which scenario and how content filtering works.
Contents
Azure OpenAI Service is the Azure service that provides access to OpenAI's models (the GPT-5 family, gpt-image, audio models and embeddings) with the guarantees of the Azure platform: regulatory compliance, RBAC, private networking, enterprise SLA, and customer data is not used to train the models.
🏢
Enterprise access
Models are deployed in your own Azure region. Data is not shared with OpenAI nor used to improve the base model.
🔌
Same API
Compatible with OpenAI's API. You can migrate existing applications by only changing the endpoint and the key.
✅
Compliance
SOC 2, ISO 27001, HIPAA, GDPR. Private networks with VNet. Integrates with Azure AD/Entra ID for RBAC.
GPT-5 / GPT-5.x
Chat & Completions
Complex reasoning, image analysis, advanced code, long-form generation.
GPT-5-mini / GPT-5-nano
Chat & Completions
Chatbots, summaries, classification, extraction. Economical for high volume.
text-embedding-ada-002 / text-embedding-3
Embeddings
Convert text into vectors for RAG, semantic search, clustering.
gpt-image (gpt-image-2)
Image Generation
Generate images from text. Marketing, design, visual prototypes.
gpt-4o-transcribe / Whisper
Speech-to-Text
Audio transcription in dozens of languages. Whisper retires in December 2026.
Embeddings — what they are and what they're for
Embeddings convert text into numeric vectors that capture semantic meaning. Similar texts have similar vectors. They are used for: RAG (finding relevant documents), semantic search (searching by meaning, not exact words), and clustering (grouping documents by topic). Model to use in Azure: text-embedding-3-small or text-embedding-3-large.
In Azure OpenAI, you first create a deployment (an instance of the model) with a custom name. API calls use that deployment name, not the base model name. This allows versioning and controlling exactly which model is in use.
Create the Azure OpenAI resource
In the Azure Portal or CLI. Choose a region (model availability varies by region).
Create the deployment
Select the base model (e.g., gpt-4o), give it a custom name (e.g., "my-gpt4-prod"), configure the tokens-per-minute quota.
Get the endpoint and API key
Endpoint URL: https://{resource}.openai.azure.com/. API key from the Azure Portal or use Managed Identity.
Call the API
REST API or SDK (Python, C#, JavaScript). Uses the "deployment_name" parameter instead of "model" from the OpenAI.com API.
Deployment types
Exam trap: deployment name
In Azure OpenAI, the API receives the deployment name (which you choose), not the model name. Two deployments can use the same base model with different names. This is a common exam question.
Deploy gpt-4o under your own Azure infrastructure, with your own security and data controls.
+1 more...
Azure OpenAI Playground
Web interface for testing models interactively without writing code. Lets you experiment with system prompts, parameters, and see the generated code.
Microsoft Foundry (AI Foundry)
Unified portal for building and deploying generative AI applications. Goes beyond the playground: includes pipelines, evaluation, RAG and the model catalog.
Exam: Azure OpenAI Playground vs AI Studio
Playground = quickly test models. AI Studio = build and deploy complete GenAI applications.
Configure a system message and test a real conversation in the chat playground.
+1 more...
Create the unified workspace for building, evaluating, and deploying generative AI solutions.
+1 more...
Orchestrate an input, an LLM node, and a code validation step in an executable visual flow.
+1 more...
Azure OpenAI includes a content filtering system that applies to both prompts (input) and responses (output). It classifies content into harm categories and can block or log based on the configured level.
Hate
Off / Low / Medium / HighHate speech, discrimination based on race, gender, religion, origin.
Sexual
Off / Low / Medium / HighExplicit or suggestive sexual content.
Violence
Off / Low / Medium / HighViolent content, instructions for physical harm.
Self-harm
Off / Low / Medium / HighContent that promotes self-harm or suicide.
Jailbreak
On / OffAttempts to make the model ignore its system instructions.
Protected material
On / OffText or code protected by copyright.
How it works
1. The user sends a prompt → the filter analyzes the input.
2. If the input exceeds the configured threshold → the call is blocked (error 400).
3. The model generates a response → the filter analyzes the output.
4. If the output exceeds the threshold → an empty response or an error message is returned.
5. All filtering events are logged for auditing.
Exam trap
Content filtering applies in BOTH directions: input (the user's prompt) and output (the model's response). It's not just filtering what the model says — it also filters what it's asked.
The "Off" level is only available to approved customers with special use cases (e.g., safety research). By default, all levels have active filtering.
Adjust the blocking severity level and verify that a high-risk prompt never reaches the model.
+1 more...
| Dimension | Azure OpenAI | OpenAI.com |
|---|---|---|
| User data | Not used to train models | May be used unless you opt out |
| Compliance | HIPAA, SOC 2, ISO 27001, GDPR | More limited |
| Private networking | VNet, Private Endpoint | Public internet only |
| Authentication | Azure AD / Managed Identity + API key | API key only |
| SLA | 99.9% (Microsoft SLA) | No formal SLA |
| Available models | Subset of OpenAI models | All OpenAI models |
| Update speed | Slower (requires Azure validation) | Faster (first to launch) |
| Pricing | Similar, with a PTU option for volume | Standard pay-as-you-go |
Golden rule: Azure OpenAI for enterprises with compliance requirements, sensitive data (healthcare, finance, legal), or that need integration with their existing Azure infrastructure.
| Scenario | Model | Why |
|---|---|---|
| 24/7 customer support chatbot | GPT-5-mini | Economical for high volume, sufficient for general conversation |
| Analyzing complex legal contracts | GPT-5 | Advanced reasoning, long context, nuanced analysis |
| Analyzing scanned invoices as images | GPT-5 (multimodal) | Multimodal models accept images in the prompt; alternative: Content Understanding |
| Semantic search over a document base | text-embedding-3 | Converts text to vectors for RAG and semantic search |
| Generating illustrations for e-commerce | gpt-image-2 | Image generation model from text |
| Transcribing recorded meetings | gpt-4o-transcribe or Azure Speech | High-accuracy transcription; Whisper retires in December 2026 |
| Code assistant in an IDE | GPT-5 / GPT-5-mini | GPT-5 for complex code; GPT-5-mini for economical autocomplete |
Microsoft Copilot is the generative AI user experience layer built into Microsoft's products. It uses Azure OpenAI under the hood.
Microsoft 365 Copilot
Microsoft 365In Word, Excel, PowerPoint, Teams, Outlook. Summarizes meetings, generates documents, analyzes Excel data.
GitHub Copilot
GitHubCode assistant in VS Code and other IDEs. Autocomplete, test generation, code explanation.
Copilot in Windows
WindowsAssistant built into the operating system. Available in the side panel. Uses Bing + GPT-4.
Copilot Studio
EnterpriseNo-code/low-code platform for building custom copilots for businesses. Formerly Power Virtual Agents.
Copilot in Azure
AzureAssistant in the Azure Portal for IaC, troubleshooting, and resource queries.
Security Copilot
SecurityThreat analysis, incident response, and security report generation using natural language.
Exam trap: Copilot vs Azure OpenAI
Microsoft Copilot = ready-to-use product/experience (in M365, Windows, GitHub).
Azure OpenAI Service = infrastructure for building your own applications with OpenAI's models.
Copilot Studio = tool for building custom copilots without being a developer.
❓ Does Azure OpenAI use your data to train its models?
No. Unlike OpenAI.com (unless you opt out), Azure OpenAI guarantees that customer data is NOT used to improve the models. It's one of the key differences compared to the direct OpenAI API.
❓ Does content filtering apply only to the model's responses?
No. It applies to both the INPUT (the user's prompt) and the OUTPUT (the model's response). If the user's prompt contains harmful content, the call is blocked before it reaches the model.
❓ Do gpt-image models both generate and analyze images?
No. gpt-image models GENERATE images from text. To ANALYZE images (describe what is in a photo, extract text from an image) you use a multimodal model such as GPT-5, Azure AI Vision or Content Understanding. These are different capabilities.
❓ Are Copilot Studio and Azure OpenAI the same thing?
No. Copilot Studio is a low-code platform for building custom bots/copilots (formerly Power Virtual Agents). Azure OpenAI Service is the developer API for building applications with OpenAI models. Both can be integrated together, but they are different products.
Did you get this topic?
Test what you just learned
A hospital wants to use generative AI to help doctors draft clinical reports. The data is highly confidential (patient medical records). They need guarantees that the data will NOT be used to train external models and must comply with HIPAA. Which service should they use?
Put what you learned to the test with original AI-901 exam questions.
Start AI-901 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.