The AI Layer
Azure AI Foundry
Azure's AI workspace — one place to deploy models, build agents, run evaluations, see traces, and connect data. Sits on top of Azure OpenAI + the Anthropic-on-Azure deployments + the agent runtime.
Replaces: hand-rolled Anthropic SDK + Python Council runner + ad-hoc eval scripts. Example: upload brand guidelines → Foundry indexes them → an agent answers "does this Instagram post match the brand?" using Claude, with full traces stored automatically.
Foundry Hub vs. Project
Hub = shared infrastructure (which models are deployed, which storage to use, who has access). Projects = workspaces inside the Hub where individual workloads live (content engine, OM daily, IT-AI-agents, MI6, etc.). Costs and RBAC scope per project.
Familiar comparison: Hub = the org account. Projects = team workspaces inside it.
Model deployments
A "deployment" is an instance of a model with its own endpoint URL and TPM quota. You don't just "use Claude" — you create a deployment named e.g. sonnet-46-default with 500k TPM, and your code calls that endpoint.
Example: sonnet-46-default (500k TPM, daytime work) vs. sonnet-46-bulk (200k TPM, overnight batch) vs. haiku-45-classifier (1M TPM, action briefings).
Azure AI Search
A managed search engine with keyword and vector (semantic) search. Feed it documents; it indexes them; you query with text or with an embedding and get ranked results. The piece that makes RAG (retrieval-augmented generation) work.
Replaces: hand-rolling Pinecone/Weaviate + separate text search. Example: index 260 practice brand guidelines → "find clinical photos matching Modis brand voice" → top 10 results → Claude writes the recommendation.
Azure AI Document Intelligence
Reads PDFs, scanned docs, forms, invoices. Pulls out structured data: text, tables, key/value pairs, signatures. OCR + structure detection + form parsing in one.
Replaces: hand-rolled Python extractors for dental audit corpus ingestion. Example: upload an insurance fee schedule PDF → structured JSON of every code + fee → loaded into Postgres for the fee negotiation tool.
Data Storage
Azure Database for PostgreSQL — Flexible Server
A managed Postgres database. Microsoft handles backups, patching, HA, scaling. Connect with a normal Postgres connection string.
Replaces: Railway Postgres + the AWS RDS Postgres we settled on but never built. Example: existing Drizzle schemas run unchanged; just repoint the connection string.
Azure Blob Storage
Object storage for binary files (images, videos, PDFs). Files in buckets (called "containers" in Azure, unrelated to Docker). Same model as AWS S3. Tiers: Hot / Cool / Archive for cost.
Replaces: AWS S3 + Railway disk volumes. Example containers: originals/, variants/, previews/ for the DAM; plus backups/, documents/, logs/ for other workloads.
Code & Deployment
Azure Container Apps
Run containerized code without managing Kubernetes. Auto-scales with traffic. Scales to zero when idle so you don't pay for empty boxes. Easier than AKS, more capable than Heroku.
Replaces: AWS ECS/Fargate; the Azure-side option when something needs to run inside the tenant. Railway compute stays where it is for now. Example: the asset registry Fastify API runs here. Idle at 3 AM = zero cost.
Azure Container Registry (ACR)
A private place to store Docker images. CI builds images; Container Apps pulls and runs them.
Familiar comparison: Docker Hub or AWS ECR but inside our tenant.
Azure Static Web Apps
Hosting for static front-end builds (React/Vite output) plus optional serverless endpoints. Native Entra ID auth integration.
Replaces (selectively): Cloudflare Pages for SGA-staff-only dashboards that need SSO. Public reports stay on Cloudflare.
Security & Secrets
Azure Key Vault
Where you store passwords, API keys, connection strings, certificates. Code references secrets by name; Azure resolves them at runtime using the service's identity. Actual values never appear in code, env files, or GitHub.
Replaces: the .env sprawl across Railway / Cloudflare / local. Example: Container App starts → reads DATABASE_URL from Key Vault → connects to Postgres. No password in any config file.
Microsoft Entra ID
Microsoft's identity directory. SGA already has one — where every employee logs in to Microsoft 365. We use it for: Azure portal login, the service principal in the ask, and eventually staff SSO into our apps.
Replaces: nothing today — the alternative to AWS Cognito for staff auth.
Observability
Application Insights
Monitoring for running code. Auto-traces, metrics, error tracking, dependency maps. Tells you which requests are slow, where errors happen, how services connect.
Replaces: "Pino + Railway logs only" — today's #1 observability pain. Roughly = Sentry + Datadog APM combined. Example: /api/assets/list is slow → App Insights shows the DB query took 2 seconds → add an index.
Log Analytics Workspace
The data store under App Insights and most Azure telemetry. Where logs and metrics live. Queried with KQL (Kusto Query Language — similar to SQL, different syntax).
Familiar comparison: the "database" App Insights queries.
Email
Azure Communication Services — Email
Transactional email. Verify a domain, call an API, email sends.
Replaces: the AWS SES integration that was settled but never provisioned, plus the current EmailStubProvider. Example: studio request approved → notification sent to the champion.