Azure OpenAI

Azure OpenAI uses per-resource hostnames like <resource>.openai.azure.com. The proxy allow-list can be wildcarded or pinned.

1 · Environment

eval "$(aarmos env)"   # authenticated HTTPS_PROXY + HTTP_PROXY
export AZURE_OPENAI_ENDPOINT=https://myco.openai.azure.com
export AZURE_OPENAI_API_KEY=…
export AZURE_OPENAI_API_VERSION=2024-10-21

2 · Policy

[[allow]]
verb = "communicate"
host = "*.openai.azure.com"
ceiling.per_minute = 60

[[allow]]
verb = "communicate"
host = "*.cognitiveservices.azure.com"    # Foundry / content-safety

3 · Run

aarmos run -- python agent.py

Notes

  • Managed-identity auth (DefaultAzureCredential) works — the token endpoint is login.microsoftonline.com; add an allow rule if your agent calls it directly.
  • Content-safety and prompt-shield hits are governed as their own verb=`communicate` calls; use `contract` scoping to require them before certain tools.
  • Pin `principal.azure_subscription = "…"` for enterprise multi-tenant setups.

See all providers → recipes index.