Skip to main content

Azure OpenAI

Azure OpenAI Service runs OpenAI models (GPT-4o, o1, o3, and others) inside your Azure subscription. The wire shape is identical to OpenAI's Chat Completions API; the differences are in how the URL is built (resource host + deployment name) and how credentials work (an api-key header rather than a Bearer token).

Best fit for organisations that have an Azure enterprise agreement, want OpenAI model quality with data residency in Azure, or need to run inference inside a VNet.

What you need​

  • An Azure subscription with Azure OpenAI Service enabled (it requires a manual access request: aka.ms/oai/access)
  • An Azure OpenAI resource in the Azure portal (the one that has your "Keys and Endpoint" page)
  • At least one deployment created inside that resource in Azure AI Foundry (previously Azure AI Studio)
  • The resource's API key (key 1 or key 2 from the "Keys and Endpoint" page)

Steps​

1. Find your resource hostname​

In the Azure portal, open your Azure OpenAI resource → Keys and Endpoint. The Endpoint field looks like:

https://myresource.openai.azure.com/

The hostname you need is everything between https:// and the trailing slash:

myresource.openai.azure.com

Do not include https:// or any path.

2. Create or note your deployments​

In Azure AI Foundry (aka Azure AI Studio) → your resource → Deployments, you'll see the deployments you've created. Each deployment has:

  • A deployment name you chose (e.g. prod-gpt-4o-eastus)
  • The underlying model it serves (e.g. gpt-4o)
  • An API version string (e.g. 2024-10-21)

Write these down — you'll enter them as model IDs in the next step.

3. Add to Kenaz​

  1. Open the Providers view → Add provider → Azure OpenAI.
  2. Resource Hostname: paste the hostname from step 1 (e.g. myresource.openai.azure.com). Do not include https://.
  3. API Key: paste key 1 or key 2 from the "Keys and Endpoint" page.
  4. Model IDs: enter the model IDs your deployments serve, one per line. Use the canonical OpenAI model identifier (e.g. gpt-4o, o1, o3-mini), not the Azure deployment name — Kenaz maps model IDs to deployment names via the deployment registry. You can list multiple models if you have multiple deployments.
  5. Click Add provider.

How model routing works​

The Azure adapter uses a deployment registry to map (resource host, model ID) → (Azure deployment name, api-version). This registry is populated with the models you enter during setup. For each request, Kenaz resolves the entry and builds the URL:

https://<host>/openai/deployments/<deployment>/chat/completions?api-version=<version>

The default API version for GA models is 2024-10-21; o1/o3 preview models use 2025-01-01-preview. If Kenaz can't find a deployment entry for the selected model it returns a 404-class error.

Models and what they're for​

Azure OpenAI deployments mirror the OpenAI model catalog. Available models depend on which region your resource is in and what Microsoft has enabled for your subscription. Common picks:

  • gpt-4o — multimodal flagship, vision + tool use, GA.
  • o1 / o3 — reasoning models. Azure supports reasoning_effort (high/medium/low), which Kenaz maps from your session's reasoning budget.
  • gpt-4.1 — previous generation flagship, lower cost.

Request model access via your Azure portal if a model you want isn't available in your resource's region.

Pricing​

Billed as an Azure consumption line item. Pricing is on the Azure OpenAI pricing page. Provisioned throughput (PTU) is available for predictable high-volume workloads.

Privacy posture​

  • Prompts and completions stay in your Azure subscription. Microsoft does not use them to train models by default. Data residency is controlled by your resource's Azure region.
  • Azure OpenAI is covered by the Microsoft Azure DPA, SOC 2 Type II, ISO 27001, and HIPAA (with BAA). See azure.microsoft.com/support/legal/ for the full compliance portfolio.
  • Kenaz talks directly to your resource's HTTPS endpoint. No intermediary.

Troubleshooting​

  • 401 Unauthorized / 403 Forbidden — the API key is wrong or was regenerated. Rotate the key in your resource's "Keys and Endpoint" page and update it in Kenaz (Settings → Providers → Edit → paste new key).
  • 404 Not Found — usually means the deployment name Kenaz resolved doesn't exist on your resource. Check that the model ID you entered matches a live deployment, and that the deployment is in a Succeeded state in Azure AI Foundry.
  • Resource hostname required — you left the hostname field blank, or included https://. Enter just the bare hostname: myresource.openai.azure.com.
  • Rate limit (429) — Bedrock and Azure both surface this when you exceed the tokens-per-minute quota for a deployment. Request a quota increase in Azure AI Foundry → Quotas, or enable PTU.
  • Deprecation warning in Kenaz. Azure sends api-deprecation and azureml-model-deprecation headers when a model version is nearing end-of-life. Create a new deployment targeting a supported model version and update the model ID in Kenaz.