Is Azure AI Foundry the same as Microsoft Foundry?

Yes. Microsoft renamed Azure AI Foundry to Microsoft Foundry at the end of 2025. The service and existing deployments carried over, and you'll still see both names in documentation.

Does running AI in our own Azure tenant keep our data private?

With Discovery AI, the app, your documents, processing and the models all run in your tenant, and documents are never copied into our environment for review. Microsoft's position is that prompts and outputs on Foundry models aren't used to train models. Default abuse-monitoring retention is a separate question to review with your Microsoft account team.

How is Azure usage billed with bring your own Azure?

On your own Azure bill, at Microsoft's list price. That covers compute, storage and AI models. Discovery AI takes no markup, and the purchase can count toward your Azure consumption commitment.

Do we need new identity infrastructure?

No. Users sign in with Microsoft Entra ID, and your existing rules, like MFA, apply.

Azure AI Foundry (now Microsoft Foundry) for legal teams: a CIO's primer

When legal asks to bring in an AI review platform, IT usually has three questions. Where does our data go? Who can see it? What will it cost?

This primer answers those for platforms that run on Microsoft Foundry, which is how Discovery AI works.

What is Microsoft Foundry?

Microsoft Foundry is Microsoft’s platform for building and running AI applications in Azure. It was called Azure AI Foundry until Microsoft renamed it at the end of 2025. You’ll still see both names in documentation and contracts, and the service is the same.

Foundry gives you a catalog of models from Microsoft and other providers. It runs inside your Azure subscription, under the same governance, identity, and network controls you already use.

What does “bring your own Azure” mean?

Most AI software runs in the vendor’s cloud. Your documents get copied there, the models run there, and the AI cost is bundled into the vendor’s invoice.

Bring your own Azure (BYOA) flips that. The software deploys into your Azure tenant and runs on models in your own Foundry resource. The vendor provides the software. You run it.

For IT, that changes four things:

Your data stays in your boundary. The app, document storage and processing run in your tenant, in the region you choose.
Sign-in runs through your Entra ID. Your existing rules, like MFA, apply. There’s no separate user store to manage.
Usage is Azure consumption. Microsoft bills it at list price, and it can count toward your Azure commitment.
Governance stays yours. Your policies, logging, and network controls apply.

Where does our data live with Discovery AI?

In your Azure tenant. The Discovery AI app, document storage, processing and Azure AI Foundry models all run there. Documents are never copied into our environment for review.

We provide the software. You keep the data, the infrastructure, and the keys to both.

Your data isn’t used to train models, and nothing is shared across customers, including for product improvement. Basic health and usage data comes back to us. No document content.

Every AI call cites its source and records who did what, when and why.

How does procurement work?

Discovery AI is on Azure Marketplace. You buy it through your existing Microsoft agreement and procurement, and the purchase can count toward your Microsoft Azure Consumption Commitment (MACC).

Approving it works like approving one more workload in an environment your IT team already runs.

Does it connect to Microsoft Purview?

Yes. The Purview review set connector connects directly to Microsoft Purview eDiscovery (Premium). There’s no export step.

What should our security team ask?

These are worth asking any AI vendor, us included:

Where do the app, our documents and the models run, and in which region?
Is any of our data used to train models? Microsoft’s position for Foundry models is that prompts and outputs aren’t used for training. Confirm the terms for the specific models you deploy.
What does Microsoft retain? By default, Microsoft may keep prompts and outputs for up to 30 days for abuse monitoring. Enterprise customers can apply for modified abuse monitoring through their Microsoft account team, and for legal data it’s worth the conversation.
What data, if any, goes back to the vendor?
How is the vendor’s access to our tenant scoped, and is it logged?
What security certifications does the vendor hold, and what’s their status?
Can we revoke access centrally through Entra ID?

What does it cost to run?

There are two parts: the software, and the Azure usage.

With BYOA, compute, storage and AI models show up on your Azure bill at Microsoft’s list price. We take zero margin on it, so the math is yours to audit. Track it with the Azure cost tools you already use, and set a budget and an alert from day one.

A short checklist for IT

Confirm the Azure subscription and region the deployment will run in.
Deploy Discovery AI from Azure Marketplace into that subscription.
Approve the Foundry model deployments it will use.
Connect Entra ID for sign-in.
Review data retention and abuse-monitoring settings with your Microsoft account team.
Set Azure cost budgets and alerts.
Manage legal team access through Entra groups.

If you’d like to walk through the architecture with your security team, we’ll set up a technical session.