Claude on Microsoft Azure: Deployment Options and Architecture

Azure Deployment Options for Claude

Claude on Azure differs from AWS Bedrock and Google Cloud Vertex AI in one important architectural aspect: Claude is not a first-party model on Azure the way it is on the other clouds. Microsoft has its own proprietary AI models and Azure OpenAI Service as first-party offerings. Claude on Azure is accessed through two mechanisms: as a model available in the Azure AI Foundry model catalogue (via Anthropic's partnership with Microsoft), and through the Azure Marketplace as a pay-as-you-go managed deployment.

For most enterprise deployments, Azure AI Foundry provides the cleanest integration: Claude becomes an endpoint within your Azure subscription, managed through Azure Resource Manager, billed through Azure Cost Management, and secured through Microsoft Entra ID (formerly Azure Active Directory). This is the architecture we recommend for organisations whose security and procurement teams have already approved Azure as the cloud boundary for AI workloads.

If your organisation needs architecture help designing Claude into an Azure environment — particularly alongside existing Azure OpenAI deployments or Microsoft Copilot infrastructure — our Claude API integration team specialises in hybrid Microsoft AI architectures.

Azure AI Foundry Setup and Project Configuration

Azure AI Foundry (previously Azure AI Studio) is Microsoft's unified platform for enterprise AI development and deployment. To access Claude through Foundry, you need an Azure subscription, an AI Foundry hub resource in your subscription, and a project within that hub.

Enabling Claude in the Model Catalogue

From the Azure AI Foundry portal, navigate to the Model Catalogue and search for "Claude". Available models include Claude Sonnet 4.6 and Claude Haiku 4.5 (Opus availability varies — check the catalogue for current offerings). Select the model and click "Deploy" to provision a deployment within your project. This creates an endpoint URL and generates API credentials scoped to your Azure project.

SDK Integration via Azure AI Inference

Azure AI Foundry exposes Claude through the Azure AI Inference SDK, which provides a consistent interface across all models in the catalogue:

from azure.ai.inference import ChatCompletionsClient
from azure.core.credentials import AzureKeyCredential

client = ChatCompletionsClient(
    endpoint="https://your-endpoint.services.ai.azure.com/models",
    credential=AzureKeyCredential("your-api-key")
    # Or use DefaultAzureCredential() for managed identity
)

response = client.complete(
    model="claude-sonnet-4-6",
    messages=[
        {"role": "system", "content": "You are an enterprise analyst..."},
        {"role": "user", "content": "Summarise this earnings release..."}
    ],
    max_tokens=4096
)

Replace AzureKeyCredential with DefaultAzureCredential() from the azure.identity package in production deployments — this uses managed identity rather than static API keys, following Microsoft's recommended security patterns.

Managed Identity Authentication

Microsoft Entra managed identities are the correct authentication mechanism for production Claude deployments on Azure. A managed identity is an automatically rotated service principal that Azure infrastructure (Azure Functions, App Service, Container Apps, AKS) can assume — no secrets, no key rotation, no credential management burden.

System-Assigned Managed Identity

For applications that need to invoke Claude and nothing else, use a system-assigned managed identity — it's tied to the lifecycle of the resource and automatically deleted when the resource is deleted:

# Enable managed identity on Azure Container App
az containerapp identity assign \
  --name your-app \
  --resource-group your-rg \
  --system-assigned

# Grant the managed identity Cognitive Services User role
# on the AI Foundry resource
az role assignment create \
  --assignee [principal-id from above] \
  --role "Cognitive Services User" \
  --scope /subscriptions/[sub-id]/resourceGroups/[rg]/providers/
    Microsoft.CognitiveServices/accounts/[foundry-resource]

User-Assigned Managed Identity for Multi-Service Access

If multiple application components need to invoke Claude — a web API, a background processor, and a scheduled job — use a user-assigned managed identity shared across components. This simplifies role assignments: grant the shared identity access once, and attach it to each component that needs Claude access. Role assignment changes are made in one place.

Azure Private Link for Network Isolation

Azure Private Link creates a private endpoint within your Virtual Network for Azure AI Foundry — all traffic from your applications to Claude routes through your VNet over Microsoft's private backbone, never traversing the public internet. For organisations with network segmentation requirements or compliance frameworks that prohibit egress to public endpoints, Private Link is mandatory.

Configure a private endpoint for your AI Foundry resource in the resource's networking settings. Select the VNet and subnet where your applications run, choose the relevant sub-resource (account for the AI Foundry resource), and confirm. DNS resolution for the AI Foundry endpoint is updated via Azure Private DNS Zone to resolve to the private IP within your VNet.

After enabling Private Link, test that your applications can reach the endpoint from within the VNet. If your applications are outside the VNet (e.g., developers on-premises), configure VPN Gateway or ExpressRoute connectivity to the VNet to maintain access through the private endpoint.

Azure Monitor and Diagnostic Settings

Azure AI Foundry integrates with Azure Monitor for logging and metrics. Enable diagnostic settings on your AI Foundry resource to route logs to Log Analytics Workspace — this captures all API invocations, request counts, token usage, and error rates.

In Log Analytics, create custom queries to monitor Claude usage patterns:

// Token usage by day
AzureDiagnostics
| where ResourceType == "ACCOUNTS"
| where Category == "RequestResponse"
| summarize TotalInputTokens = sum(todouble(requestBodyTokens_d)),
            TotalOutputTokens = sum(todouble(responseBodyTokens_d))
  by bin(TimeGenerated, 1d)
| order by TimeGenerated desc

Create Azure Monitor alerts that trigger when: error rates exceed 1% over a 5-minute window, average latency exceeds your SLA threshold, or daily token consumption exceeds your budget threshold. Route alerts to your operations team via Action Groups — email, SMS, Azure DevOps, or webhook to PagerDuty.

Entra ID RBAC and Conditional Access

Azure AI Foundry supports Microsoft Entra ID role-based access control at the resource and project level. Define roles for: AI developers (can create deployments and test models), AI operators (can invoke models and read logs, cannot modify deployments), and AI administrators (full control). Assign these roles via Azure RBAC — avoid giving developers direct access to production deployments.

For organisations using Conditional Access policies, AI Foundry access can be gated behind conditions: require compliant device, require specific network location (corporate IP), or require MFA. This is particularly valuable for administrative access — enforcing MFA and corporate device requirements for anyone who can modify production AI deployments significantly reduces the blast radius of credential compromise.

Azure Cost Management for Claude Inference

Claude usage in Azure AI Foundry is billed through Azure's standard billing infrastructure — usage appears in your Azure Cost Management dashboard alongside compute, storage, and other services. Tag your AI Foundry resource with cost allocation tags (department, application, environment) from day one for cost visibility.

Set Azure Budgets for the resource group containing your AI Foundry resources. Configure alert thresholds at 80% and 100% of budget. For test environments, consider using Azure Policy to enforce a spending limit that automatically modifies the deployment quota when the budget is exceeded — this prevents accidental runaway spend in non-production environments.

Compare monthly token costs against the direct Anthropic API as volume grows. Azure's billing infrastructure and potential EA pricing advantages may make Azure the more cost-effective path at very high volume, but the comparison depends heavily on your Azure enterprise agreement terms.

Claude and Microsoft 365: Co-Deployment Considerations

Azure-native organisations typically have significant Microsoft 365 infrastructure — SharePoint for documents, Teams for communication, and Microsoft 365 Copilot for AI productivity. Claude on Azure can be integrated with M365 data through several patterns.

Using Microsoft Graph API, Azure applications can read data from SharePoint, OneDrive, and Teams and pass it as context to Claude. An Azure Function triggered by a SharePoint document upload, for example, can extract the document text via Graph, pass it to Claude for analysis, and store the output back to SharePoint. This integration doesn't require any changes to your M365 licensing and works within your existing Azure application permissions.

For more direct M365 integration — putting Claude into Teams as a bot or extending SharePoint with Claude-powered search — our MCP server development team builds MCP servers that connect Claude to Microsoft 365 data sources through the standard tool-use protocol.

Compare the Azure path with AWS Bedrock and Google Cloud Vertex AI before committing architecture. For broader Claude API integration consulting, our team covers all three clouds with the same methodology.

Related Guides