Registry / Azure OpenAI Service
Azure OpenAI Service
OpenAI GPT models served by Microsoft as "Models sold by Azure" within Microsoft Foundry (formerly Azure OpenAI Service / Azure AI Foundry). Microsoft hosts the models in its own Azure environment; customer data does not flow to OpenAI-operated services, and vendor-trust and data-handling commitments are Microsoft's/Azure's.
Watch-outs 2
The cells where this offering is not a clean public yes. This is what to check before you sign.
- SOC 2 Type II: Yes, sales-gated access requires signing in to the Service Trust Portal
- Retention / ZDR: No public evidence Official Microsoft documentation of retention and zero-data-retention is behind an authentication gate, so no publicly accessible evidence exists.
Microsoft states SOC 2 reports are available via the gated Service Trust Portal, confirming the report exists but is not publicly downloadable.
You can access Azure SOC audit reports and bridge letters from the Service Trust Portal (STP) SOC reports section.
The recorded value no_public_evidence contradicts the cited page, which is Microsoft's own (learn.microsoft.com) public documentation stating Azure and in-scope services are ISO/IEC 27001 audited. Azure OpenAI Service is a Microsoft Azure service (Microsoft states "Foundry is an Azure service" and A
Microsoft Azure, Dynamics 365, and other Microsoft online services undergo regular independent third-party audits for ISO/IEC 27001 compliance. ... The Azure ISO/IEC 27001 certificate covers Azure, Dynamics 365, Power Platform, and select Microsoft 365 cloud services.
The Microsoft Azure blog publicly announces ISO/IEC 42001:2023 certification for Azure AI Foundry Models and explicitly includes Azure OpenAI models, satisfying the question without access restrictions.
By achieving this certification, Microsoft demonstrates that Azure AI Foundry Models, including Azure OpenAI models, and Microsoft Security Copilot prioritize responsible innovation and are validated by an independent third party.
The Microsoft Service Trust Portal (servicetrust.microsoft.com) is Microsoft's own authoritative compliance/trust portal, and the cited document (Azure OpenAI PIA) and its last-updated date appear verbatim on the page, confirming the existence of a maintained trust center for Azure OpenAI Service.
Azure - OpenAI Foundational Privacy Impact Assessment (2024) ... Last updated on 2024-09-11
Microsoft’s official Q&A page confirms that Azure OpenAI Service is HIPAA‑eligible, and Microsoft’s HIPAA offering states they will sign a BAA for in‑scope services.
Coming to second question, yes, Azure OpenAI Services can be used in a HIPAA-compliant manner.
Confirmed the recorded value on Microsoft's own page: the EU Model Clauses are provided via a publicly downloadable DPA (aka.ms/DPA, no gate) that incorporates the SCCs and publishes a subprocessor list, so yes_public is correct.
Microsoft makes the EU Model Clauses available to customers as described in the Microsoft Online Services Terms (OST) [Data Protection Addendum](https://aka.ms/DPA) (DPA).
The commitment is openly published on Microsoft's own Learn page with no gate, NDA, or portal login, so the default no-training commitment is publicly verifiable: yes_public, not yes_sales_gated. Verbatim from learn.microsoft.com: "are NOT used to train any generative AI foundation models without yo
are NOT used to train any generative AI foundation models without your permission or instruction. ... prompts and completions are not used to train, retrain, or improve the base models.
Official Microsoft documentation of retention and zero-data-retention is behind an authentication gate, so no publicly accessible evidence exists.
Access to this page requires authorization. You can try signing in or changing directories.
Microsoft’s own Azure OpenAI deployment documentation explicitly states that data can be pinned to a single Azure geography (e.g., an EU region) via Standard or Regional Provisioned deployments.
Standard and provisioned deployments both offer three data-processing options: global, data zone, and single region (Azure geography). ... Pin processing to a single region: Use Standard or Regional Provisioned (where supported)
OpenAI, the model developer for Azure OpenAI Service, is listed among the signatories on the European Commission's authoritative GPAI Code of Practice page.
OpenAI
The model developer (OpenAI) states on its own help.openai.com page that it publishes Art. 53(1)(d) training-content summaries and links public per-model summaries (e.g., GPT-5.5 Public Summary), so the developer obligation is publicly verifiable with no gate.
In accordance with our obligations under Article 53(1)(d) of the EU AI Act, OpenAI publishes summaries about the content used to train our general-purpose AI models:
Spotted an error? Submit a correction with evidence, corrections with a primary source are folded in and credited in the changelog.