Meeting Foundry project creation requirements: DLP and No Local Authentication

For a new Foundry project, the documented CLI flow supports creating the Foundry resource and project, but it does not include a project-creation setting for DLP or a wizard option to disable local authentication during project creation.

What is supported:

1. Create the Foundry resource first.
   • If using Azure CLI, create the resource with --allow-project-management enabled.
   • This flag is required for project management and cannot be changed after the resource is created.
2. Create the project under that resource.
   • Use az cognitiveservices account project create after the resource exists.
3. Disable local authentication on the Foundry resource separately.
   • This is supported through Azure Policy, ARM/Bicep property disableLocalAuth: true, or PowerShell with Set-AzCognitiveServicesAccount -DisableLocalAuth $true.
   • The classic guidance also states this cannot currently be done through the Azure portal for Foundry Tools; use PowerShell instead.
4. If organizational requirements such as security controls, naming, tags, or policy compliance must be applied at creation time, use Azure portal advanced configuration or template-based deployment.
   • The Foundry project creation guidance explicitly says that if the organization requires customized Azure configurations, security controls, or cost tags, Azure portal or template options might be needed to comply with Azure Policy requirements.

A supported manual path is:

resource foundry 'Microsoft.CognitiveServices/accounts@2023-10-01' = {
  name: 'my-foundry-resource'
  location: 'eastus'
  kind: 'AIServices'
  sku: {
    name: 'S0'
  }
  properties: {
    customSubDomainName: 'my-foundry-resource'
    disableLocalAuth: true
    allowProjectManagement: true
  }
}

Supported facts for that template:

• disableLocalAuth: true is the documented property for disabling local authentication in ARM/Bicep.
• allowProjectManagement must be enabled when creating the Foundry resource if projects will be created under it.

If using CLI instead of Bicep, the equivalent resource creation pattern is:

az cognitiveservices account create \
  --name my-foundry-resource \
  --resource-group my-foundry-rg \
  --kind AIServices \
  --sku S0 \
  --location eastus \
  --custom-domain my-foundry-resource \
  --allow-project-management

Then create the project:

az cognitiveservices account project create \
  --name my-foundry-resource \
  --resource-group my-foundry-rg \
  --project-name my-foundry-project \
  --location eastus

Important constraints:

• --allow-project-management cannot be changed after the resource is created.
• The custom domain must be globally unique.
• Creating resources requires Contributor, Owner, or a custom role with Microsoft.CognitiveServices/accounts/write.
• If local authentication is disabled, use Microsoft Entra authentication.

The provided material does not include a Foundry-project ARM/Bicep template definition for DLP settings specifically. It supports disabling local authentication at the resource level and using template-based deployment when policy/security requirements must be enforced during creation.

References:

• # Create a project for Microsoft Foundry
• # Disable local authentication in Foundry Tools
• # Quickstart: Set up your first Foundry resource (azcli)