Government: Sovereign policy assistant with Microsoft Foundry

An isolated Foundry project, deployed in an EU region without public network access, surfaces internal documents through Azure AI Search with private endpoints. Sensitivity labels from Microsoft Purview travel through to the retrieve responses, so classification is not lost the moment a passage is retrieved. Provisioned Throughput gives predictable latency, and Azure Policy defines which models and regions are permitted.

Sovereignty is not an add-on applied afterward, it shapes the architecture from the first choice: region, network isolation and permitted models are fixed before a single document is indexed. Grounding on internal documents while preserving classification gives civil servants a grounded answer without exposing sensitive information beyond the intended scope.

A generic, publicly reachable AI service without a region guarantee was faster to set up, but did not meet the organization's data residency requirements. A fully on-premises solution without cloud connectivity was considered for maximum control, but would have largely negated the benefits of a managed platform, evaluations, content safety, model catalog.

• Private networking and no public network access increase security, but require careful integration with other internal systems.
• Provisioned Throughput gives predictability, but means fixed costs regardless of actual usage.
• A tightly controlled model selection via Azure Policy limits the choice flexibility that is otherwise an advantage of the platform.

Microsoft Foundry (isolated project, model catalog), Azure AI Search (grounding with private endpoints), Microsoft Purview (sensitivity labels, DSPM for AI), Azure Policy (permitted models and regions).

• Fix region, network isolation and permitted models as policy before the project is set up, not as a correction afterward.
• Let sensitivity labels explicitly travel through in retrieval, so classification does not silently disappear in an answer.
• Document sovereignty choices in an audit trail that matches the organization's oversight frameworks.

During initial setup, part of the existing document storage turned out to be located outside the chosen EU region, requiring an additional migration step before indexing could begin. That step cost time upfront, but prevented a compliance issue that would only have surfaced during an audit.