Skip to main content

Scenarios

Pick one with scenario: in the inputs file. List them with Get-MLOpsScenario. Scaffold an inputs file with New-MLOpsInputFile -Scenario <id or number> -Path inputs.yaml -Iac <terraform or bicep> -Cicd <github or azdo>.

#IdNetworkServingAdds
1basic-publicpublicnoneWorkspace, storage, Key Vault, Azure Container Registry, Application Insights, CPU cluster, training pipeline
2managed-vnet-internetmanaged VNet, internet outboundonlinePrivate endpoints, public access disabled
3managed-vnet-approvedmanaged VNet, approved outbound onlyonlineFQDN and service tag allow-list (allowed_outbound_fqdns)
4byo-vnetyour VNet (created)onlineSpoke VNet, subnets, private DNS zones, private endpoints (vnet_address_space)
5batch-scoringpublicbatchBatch endpoint and deployment, nightly scoring workflow
6online-bluegreenpubliconline (blue/green)Deploy workflow shifts 10% then 100% of traffic and retires the old deployment
7feature-storepubliconlineManaged feature store workspace
8registry-promotionpubliconlineShared Azure ML registry in the first environment, ml-promote workflow, deploy from the registry
9governancepubliconlineDiagnostics, budget alerts (budget_amount, alert_emails), resource lock, policy
10genai-foundrypublicnoneAI Foundry hub, AI Services account and project
11existing-platformexisting subnet and DNSonlineReuses existing_platform subnet, private DNS zones and Log Analytics; governance on
12rag-llmopspublicnoneAI Foundry plus Azure AI Search, model deployments, sample index and an evaluation quality gate

Choosing a scenario

Start here if…ScenarioRelative fixed cost
You are learning or prototyping and data is not sensitive1 basic-publicLowest (about $60 per month for 3 environments)
You need real-time scoring with a REST endpoint6 online-bluegreen (safe rollouts) or 2 to 4 (private)Low to medium
Scoring runs on a schedule, not in real time5 batch-scoringLow (compute only while running)
Security requires no public access, and you have no existing network2 managed-vnet-internet, or 3 for locked-down egressMedium; 3 adds a managed firewall, which is the largest fixed cost
You must control the network yourself4 byo-vnetMedium (private endpoints and DNS zones)
A platform team already owns the subnet, DNS and Log Analytics11 existing-platformMedium; reuses shared services
Several teams share models across workspaces or environments8 registry-promotionLow added cost
You need reusable features across models7 feature-storeLow added cost
Finance or audit needs budgets, policy and diagnostics9 governanceLow added cost
You are building generative AI apps10 genai-foundryDepends on the models you deploy
You are building a chat app over your own documents with an evaluation gate12 rag-llmopsAdds Azure AI Search (basic tier is roughly 75 USD per month) plus model token use

Costs are relative and exclude training compute and endpoint instance hours, which dominate once you deploy. The default is three environments (see the parameter checklist). Set two to cut the fixed cost.

Tip

Start with scenario 1, prove the pipeline end to end, then change scenario and regenerate. Decide the network mode early. Switching it on an existing workspace is a larger change than adding serving or governance, and it has not been tested.

Estimated fixed monthly cost

#ScenarioFixed infrastructure per monthWith one online instance per environment
1basic-public60.8360.83
2managed-vnet-internet152.08763.09
3managed-vnet-approved2,889.583,500.59
4byo-vnet272.92883.93
5batch-scoring60.8360.83
6online-bluegreen60.83671.84
7feature-store60.83671.84
8registry-promotion111.52722.53
9governance60.83671.84
10genai-foundry60.8360.83
11existing-platform261.58872.59
12rag-llmops282.02282.02

Region westus, USD, 3 environments, retrieved 2026-10-15.

Note

Based on Azure Retail Prices list prices, not your negotiated rates. Scenario 12 adds one Azure AI Search basic unit per environment (0.101 USD per hour, about 73.73 USD per month); model token usage is not included. Included: Azure Container Registry, private endpoints (5 per environment) and private DNS zones (6 per environment) for bring-your-own VNet, the managed network Azure Firewall (Standard, scenario 3) and the shared registry (scenario 8). The last column adds one Standard_DS3_v2 online-endpoint instance per environment. Not included: training compute (clusters scale to zero), Log Analytics and Application Insights ingestion, storage, data transfer, AI model usage, and the managed private endpoints that Azure ML creates for managed VNets. Managed network outbound rules were not priced individually. Treat these as order-of-magnitude figures. Generate your own with ./scripts/Get-ScenarioCostEstimates.ps1 -Region <region> -Currency <code> -Environments <n> -AsMarkdown.

Notes

  • Network modes other than public disable public access. Run the pipelines on self-hosted agents or runners that can reach the private endpoints.
  • Scenarios 1 and 10 generate no serving workflow (deploy_mode: none).
  • The training workload is the tabular taxi pack in every scenario. Scenario 10 (GenAI) provisions the platform only.
  • Scenarios 1 to 12 are applied, verified and destroyed live on Terraform and Bicep by the e2e.yml workflow. The GitHub and Azure DevOps bootstraps and the Bicep pipeline on both are also verified live. Not verified live: private runners and state storage, separate plan and apply identities, Managed DevOps Pools, the rai option, the scenario 7 feature set pack and endpoint deployment.

Alignment with Microsoft guidance