For a UK public body, the first question about an AI service is where the data goes. A data protection impact assessment will ask where prompts and responses are stored, where they are processed, and who can see them. On Microsoft Foundry, the answers depend on choices made when a model is deployed.
Stored and processed
Microsoft treats data at rest and data being processed separately. For models deployed in Microsoft Foundry, data stored at rest stays in the Azure geography the customer chooses. Where prompts and responses are processed depends on the deployment type.
The deployment types
| Deployment type | Where prompts and responses are processed |
|---|---|
| Global | In any Azure region where the model is deployed. |
| Data Zone | Within a zone Microsoft defines: the United States, the European Union (following the EU Data Boundary, which can include EFTA countries such as Norway and Switzerland), or Asia Pacific. |
| Standard and Regional Provisioned | Within the Azure geography the customer specifies, with possible processing between regions in that geography for operational purposes. |
Microsoft’s data zones cover the United States, the European Union and Asia Pacific, and none of them is the United Kingdom. A UK body that needs prompts and responses processed in the UK therefore needs a Standard or Regional Provisioned deployment in a UK region, which depends on the model being offered there.
What the models do with your data
For models sold by Azure, which include the Azure OpenAI models, Microsoft states that prompts, completions, embeddings and training data are not available to other customers or to the model’s provider, and are not used to train generative AI foundation models without the customer’s permission. Models from partners and the community in Foundry are offered under their provider’s own licence terms, so their data terms need to be read separately.
Timing
Microsoft releases new deployment types in a set order: Global first, then Data Zone, then geography-based. Global deployments also receive new models first, and geography-based types have no guaranteed availability date. A UK public body that requires UK processing should plan around the models offered in UK regions today, and design its solution so that a newer model can be adopted when it reaches the region.
Every connection, as well as the model
An agent reads from data sources, calls tools and connects to other services, and each of these has its own data-handling terms. Microsoft’s documentation for connecting a Foundry agent to Fabric IQ, for example, warns that data may be sent outside the Azure compliance boundary, and that managing this is the customer’s responsibility. Each tool an agent uses belongs in the data-boundary map.
Controls that hold the boundary
- Allowed locations: a built-in Azure Policy that restricts the regions in which resources can be deployed. It does not apply to resources that use the “global” region, so those need separate review.
- Network isolation: private endpoints for inbound access to Foundry, and a virtual network for the agents’ outbound traffic.
- Customer-managed keys: keys held in the customer’s Azure Key Vault for data Foundry stores at rest, available in selected regions.
- Identity: access for every person and agent through Microsoft Entra ID.
Questions to ask before you build
- Which deployment type does each model use, and where does it process prompts and responses?
- Is the model we need offered in a UK region today?
- Which tools and connectors does the agent use, and where does each process data?
- Which Azure Policy assignments enforce the boundary, and who can change them?
- Which classification will the data carry, and which controls does that require?
How Talastron approaches it
Talastron designs to named UK standards, including the Government Security Classifications. Talastron Kinetic AI, our governed software factory for Azure, reads the client’s live Azure Policy before it designs anything, so a boundary such as “no regions outside the UK” is a hard constraint from the start. Talastron holds Cyber Essentials, and ISO/IEC 27001 is in progress; see Credentials. To see how it works for a public-sector programme, book a demo.
Sources
Microsoft Learn: Deployment types for Microsoft Foundry Models; Data, privacy, and security for Models sold by Azure; Connect agents to Microsoft Fabric with Fabric IQ (preview); Azure Policy built-in definitions; Network isolation for Microsoft Foundry; Customer-managed key encryption in Microsoft Foundry.
