What’s the Best Way to Securely Access an Azure Foundry Model?

Always opt for Role-Based Access Control (RBAC) rather than access keys! If your team is small, having API Management might be overkill, but it's beneficial if you need enterprise features like throttling or cost monitoring.

You have a few solid options! Using API Management (APIM) is great because it can handle OAuth to authenticate users securely with Entra JWT. Coupling access with a subscription key allows for monitoring usage and provides metrics. Plus, you could implement a Redis cache to store common responses, leveraging APIM’s caching features. If you don’t want to build from scratch, there are open-source solutions like Open WebUI or LibreChat that also support Entra SSO! By the way, since you mentioned M365 Copilot utilizing GPT, what are you aiming for with this use case compared to tools like that?

I recommend not exposing the model directly. A common setup is to have a frontend communicate with your backend, where the backend handles calls to the model using a managed identity or a secure key stored in Azure Key Vault. API Management can give you features like rate limits and centralized logging, but it’s not essential for simple applications.

You could also host the model externally in Databricks and use notebooks there for processing, or consider a passthrough authentication method. This gives you a good blend of security and accessibility.