Azure OpenAI in Azure Government

Provision Azure OpenAI in Azure Government and share the required connection details with StackAI.

Use this guide to provision Azure OpenAI in Azure Government. Then share the required connection details with StackAI.

Before you begin

Azure Government is separate from commercial Azure. It uses separate portals, sign-in domains, and service hostnames.

Commercial Azure subscriptions and resources do not transfer to Azure Government.

If you already have an Azure Government tenant, start at Sign in to Azure Government.

Prerequisites

• Confirm Azure Government eligibility.

• Obtain procurement authority or an existing Microsoft agreement.

• Get Global Administrator or Owner access in the target tenant.

• Choose API key or Microsoft Entra authentication with your security team.

• Prepare a secure secret-sharing method, such as Azure Key Vault.

Set up Azure OpenAI

1

Confirm eligibility

Microsoft validates every Azure Government tenant request. You must qualify under one of three categories:

Category	Who it covers
US government entity	Federal, state, local, tribal, regional/interstate, FFRDC
Government partner	Delivering to government under direct or indirect contract, including GSA agreements
Commercial entity with regulated data	ITAR, CUI, DoD UCNI, DOE, criminal justice, or DoD Impact Level data

Have supporting documentation ready — contract number, GSA schedule, or a written description of the regulated data. Microsoft's validation team will request it.

Azure Government eligibility criteria

2

Obtain a subscription

Choose one of four purchase paths:

Path	Best for	Link
Free trial (90 days)	Validating the integration before committing	Request a trial
Pay-as-you-go	Fastest production path, no commitment	PAYG offer
CSP partner	Partner-managed billing and deployment	Find a CSP
Enterprise Agreement	Existing Microsoft EA, locked multi-year pricing	Contact licensing partner

Recommended: Start the free trial immediately and run production procurement in parallel. The trial produces a real tenant with real endpoints, so integration work is not thrown away on conversion.

Microsoft validation typically takes several business days. You will receive tenant credentials on a *.onmicrosoft.us domain.

How to buy Azure Government

3

Sign in to Azure Government

Use the Government URLs. Commercial equivalents will reject Government credentials.

	Commercial Azure	Azure Government
Portal	portal.azure.com	https://portal.azure.us
Sign-in	login.microsoftonline.com	login.microsoftonline.us
Resource Manager	management.azure.com	management.usgovcloudapi.net
Key Vault	vault.azure.net	vault.usgovcloudapi.net

Azure Government endpoint mapping

4

Request Azure OpenAI access

Azure OpenAI in Azure Government has historically required registration in addition to a subscription.

Submit the access request at Azure Government - Request Access to Azure OpenAI

Confirm with your Microsoft account team whether this step is still required — the gating has been relaxed over time. If resource creation in Step 5 fails with a "not enabled for this subscription" error, this form is the fix.

5

Create the resource and deploy a model

Create the Azure OpenAI resource

In portal.azure.us:

1. Create a resource → search Azure OpenAI

2. Configure:

   • Region: US Gov Virginia or US Gov Arizona — both carry the same model set

   • Name: must not contain sensitive or export-controlled information

   • Pricing tier: Standard S0

3. Select Create

Azure resource names are not covered by export-control protections. Do not embed program names, classifications, or other sensitive strings. See naming considerations.

Deploy the model

Open the resource → Model deployments → Manage deployments → Deploy model.

Select gpt-5.1 with deployment type Data Zone Standard.

gpt-5.1 is offered only on Data Zone Standard in Azure Government. If you select plain "Standard" or "Provisioned managed," gpt-5.1 will not appear in the model list. This is the most common cause of a "model unavailable" report.

Record the deployment name you choose. StackAI requires it. The deployment name is distinct from the model name, and API calls reference the deployment.

Check current model and region availability before selecting a model.

Request a quota increase

Default tokens-per-minute quotas are low and will throttle production traffic.

Submit an increase at https://aka.ms/AOAIGovQuota

Do this early. Quota requests take time, and an unraised limit presents as a broken integration under load.

6

Choose an authentication method

Decide this with your security team before generating any credential.

Option A — API key

In the resource: Resource Management → Keys and Endpoint. Copy KEY 1 and the Endpoint.

Option B — Microsoft Entra service principal

Recommended for production

Many Government tenants disable key-based authentication by Azure Policy (disableLocalAuth). If that applies, or if a shared static secret is unacceptable to your security team, use a service principal:

1. Register an application in Microsoft Entra ID

2. Assign it the Cognitive Services OpenAI User role, scoped to the Azure OpenAI resource

3. Record the Tenant ID, Client ID, and Client Secret

Keyless authentication guidance

7

Share the connection details with StackAI

Provide these six values:

• Endpoint — https://<resource-name>.openai.azure.us

• Deployment name — the name set when you deployed the model

• Model and version — e.g. gpt-5.1 (2025-11-13)

• Region — US Gov Virginia or US Gov Arizona

• Credential — API key, or Tenant ID + Client ID + Client Secret

• Quota — approved tokens-per-minute limit

Do not transmit keys or client secrets over email or chat. Use a shared secret store, or place the secret in Azure Key Vault (vault.usgovcloudapi.net) and grant StackAI scoped access.

Troubleshooting

getaddrinfo ENOTFOUND or DNS resolution failure

Cause: The endpoint is using the commercial hostname openai.azure.com instead of the Government hostname.

Fix: Azure Government uses openai.azure.us. Check for hardcoded commercial hostnames in SDK configuration, environment variables, and firewall allowlists. This is the single most common Azure Government integration failure.

gpt-5.1 does not appear in the model deployment list

Cause: The deployment type is set to Standard or Provisioned managed. gpt-5.1 is only offered on Data Zone Standard in Azure Government.

Fix: Change the deployment type to Data Zone Standard.

401 Unauthorized with a key that was copied correctly

Cause: Local authentication is disabled on the resource by Azure Policy (disableLocalAuth), a common Government tenant hardening control.

Fix: Switch to Microsoft Entra service principal authentication.

404 Resource not found on a valid endpoint

Cause: The URL uses the model name instead of the deployment name.

Fix: The path segment after /deployments/ must be the deployment name, not gpt-5.1.

429 Too Many Requests under light load

Cause: Default tokens-per-minute quota is exhausted.

Fix: Request an increase at https://aka.ms/AOAIGovQuota. Confirm the approved TPM value and share it with StackAI for rate-limit configuration.

Resource creation fails with "not enabled for this subscription"

Cause: The subscription has not been enabled for Azure OpenAI in Azure Government.

Fix: Submit the access request at https://aka.ms/AOAIgovaccess and follow up with your Microsoft account team.

Sign-in fails with valid Government credentials

Cause: Authenticating against the commercial endpoint.

Fix: Use portal.azure.us and login.microsoftonline.us.

Related resources

• Azure OpenAI in Azure Government

• Azure Government endpoint mapping

• Azure OpenAI model availability

• LLMs hosted on Azure and AWS Bedrock