An organization's marketing team and finance team both want to experiment with Foundry-hosted models, but each team needs its own isolated connections, quota, and deployed models without affecting the other team's resources, while still sharing centrally managed networking and security settings set by IT. How should the organization structure this in Azure AI Foundry?
Select an answer to reveal the explanation.
Short Explanation
Think of the hub as the building and the projects as separate offices inside it. Facilities, the front door, and security are shared and managed once by the people who run the building, but each office gets its own locked door, its own supplies budget, and its own equipment that the other office can't touch or use up. Putting two teams in one office with a shared key means one team's late-night usage spike eats into what's left for the other team, and that's the exact problem here. Splitting the teams into two completely separate buildings with nothing shared would mean redoing the plumbing and security setup twice, which is wasteful when IT already wants to manage that centrally. And just telling people in a memo to behave doesn't actually stop them from bumping into each other's stuff, since a memo has no control over what resources are actually reserved for whom. Giving each team its own space inside a shared, centrally managed building is what keeps both teams independent without duplicating the parts that should stay common.
Full Explanation
The correct answer is A. A single Foundry hub lets an organization centrally manage networking, security, and governance settings, while separate projects underneath that hub give each team, in this case marketing and finance, its own isolated connections, quota, and deployed models, without one team's usage affecting the other's. Option B is incorrect because putting both teams in one project with a shared API key means they draw from the same quota and deployments, so heavy usage by one team can throttle or interfere with the other, which is exactly the isolation the organization wants to avoid. Option C is incorrect because entirely separate subscriptions with no shared configuration would force IT to duplicate networking and security setup for each team rather than manage it centrally, which contradicts the requirement to keep those settings shared and centrally controlled. Option D is incorrect because system message instructions only shape how a model responds within a conversation; they have no ability to separate quota, connections, or deployed resources between teams. Since the requirement is isolated resources per team alongside shared centrally managed infrastructure, a hub-and-project structure is the mechanism designed for that exact split.