Azure OpenAI enterprise: four decisions stall most programmes. None of them is the model.
Azure OpenAI enterprise rarely fails on model quality. Pexon finds rollouts stall on Entra permissions, token quotas and cost attribution, EU residency, and whether RAG can ship under your existing permission model. This hub covers those four decisions for industrial companies running inference in their own Azure tenant.
A resource is not a rollout.
Enabling Azure OpenAI in a subscription is a portal click. The work starts when the second team asks for a key, when legal asks where prompts land, and when finance asks which cost centre owns last month's tokens. Those are management decisions with different owners, and they stall the programme long before model quality becomes the interesting question.
We treat Azure OpenAI the same way we treat Claude in a cloud tenant: identity first, attributable spend second, residency third, and only then the application that has to survive production. The engine-manufacturer maintenance RAG on Azure OpenAI is the shape we aim for — entitlement per data node, not a shared chat that ignores permissions.
What actually stops the pilot expanding
Four decisions, four owners. Naming the owner next to the decision is usually worth more than another model bake-off, because none of the four can approve alone.
| What stalls | Who owns the decision | What a passing answer looks like |
|---|---|---|
| Entra and app identity | Identity / IAM | Every call runs as a named Entra identity or managed identity already in your directory, with app registrations that a security review can list. |
| Cost and quotas | Budget holder / FinOps | Every team has a quota and a cost centre key; spend is attributable monthly, and the hard stop is enforced before the invoice arrives. |
| EU and compliance | Legal / data protection | Region, logging retention and the processor agreement are written down, and the path matches what the record of processing activities already claims. |
| Production retrieval | Platform and data owners | RAG reads only what the caller may read in the source system, with evaluation before release — not a demo index of public PDFs. |
Four places the work actually lands
Governance and Entra — Who may call which deployment, how app registrations stay inventorisable, and how shadow Azure OpenAI traffic is brought behind one sanctioned path.
Cost and quotas — TPM and RPM limits, Cap per team or cost centre, and the arithmetic that makes an Azure OpenAI budget conversation possible at all.
EU compliance — Residency, content filters, diagnostic settings and the processor story legal will ask for before a pilot expands.
Production RAG — Permission-aware retrieval on Azure OpenAI that survives an entitlement model, not a PoC chat over a flat document dump.
When Claude and Azure OpenAI share a tenant
Many estates run Claude through Microsoft Foundry next to Azure OpenAI. The gateway, budget and logging story is shared even when the model endpoints differ — see Claude in your cloud tenant and the LLM gateway.
Pages in this cluster
Common questions
What does Azure OpenAI enterprise mean beyond enabling a resource?
A resource gives teams an endpoint. An enterprise rollout decides which Entra identity a call runs as, which quota and cost centre owns the tokens, where prompts are processed, and whether retrieval respects the same permissions as the source systems. None of those four is answered by turning the resource on.
How is this different from Claude on Microsoft Foundry?
Foundry can host Claude and other models under Azure identity and billing. Azure OpenAI is the OpenAI model family on Azure with its own safety, content-filter and regional profile. Many estates run both; the governance and cost layer should be shared even when the model endpoints differ.
Where should an Azure OpenAI programme start?
With the decision that is already blocking expansion: usually Entra and app registration hygiene, or an unattributable invoice. Starting with a demo chat next to either of those only adds another ungoverned consumer of the same quota.
What does it cost to start with Pexon?
The two-week Readiness Blueprint is fixed at €4,900 and returns the rollout path, the identity model and a costed plan. Azure OpenAI consumption bills to your own subscription at Microsoft's published rates — we do not resell tokens. A delivery pod afterwards starts at €7,500 per month. All prices are net and exclude VAT.
Not a sales call. An architecture call.
Thirty minutes with the architect who would actually run the engagement.