A secure Azure landing zone for AI: private endpoints, managed identity, APIM token limits (Bicep)

I wrote up a reference pattern for running Azure AI Foundry workloads inside a secure landing zone: Foundry (AIServices) behind a private endpoint with the three required private DNS zones, local auth disabled in favour of managed identity, and Azure API Management in front using llm-token-limit and llm-emit-token-metric to control and measure token usage.

Article: https://gisli78.substack.com/p/a-secure-azure-landing-zone-for-ai 

Code (Bicep, with automated tests): https://github.com/gislig/azure-ai-landing-zone 

Feedback welcome, especially from anyone running this pattern in production.

#mvpbuzz #azure #azug #microsoft