Plan and Manage an Azure AI Solution
Choosing the resource shape
Every solution starts with the account decision. A multi-service Azure AI Services resource gives you one endpoint and one key across many APIs, which simplifies secret management and billing - but a few capabilities, particular regions, and container deployments still require a single-service resource. Pick multi-service when the question emphasizes "one key for many services"; pick single-service when it mentions on-premises/container, a specific region, or a feature not surfaced in the multi-service bundle.
Identity, secrets, and networking
The exam repeatedly tests key vs. Microsoft Entra ID. Data-plane callers need the Cognitive Services User role; managing resources needs Contributor-level roles. Managed identity plus a Key Vault-backed key rotation pattern (two keys, rotate one at a time) is the standard answer for "avoid secrets in code." For private connectivity, pair a private endpoint with a private DNS zone, disable public network access, and allow trusted Azure services if pipelines must reach the resource.
Operations and cost
Enable diagnostic settings to route logs and metrics to Log Analytics - a silent resource produces no telemetry by default. Watch quotas: TPM/RPM limits, per-region model availability, and 429 Too Many Requests, which is a throttling signal, not an auth failure. Fix it with retry/backoff, request a quota increase, or spread load.
Traps
Questions blur authorization (401/403) with throttling (429); they assume diagnostic logs are on; they assume multi-service supports everything.
Rule of thumb: if the requirement mentions "containers" or "one feature only," choose single-service; if it mentions "minimize credential sprawl," choose multi-service with managed identity.