> For the complete documentation index, see [llms.txt](https://docs.stackai.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stackai.com/agentic-adoption-and-security/government-deployments/azure-openai-in-azure-government.md).

# Azure OpenAI in Azure Government

Provision Azure OpenAI in Azure Government and share the required connection details with StackAI.

Use this guide to provision Azure OpenAI in Azure Government. Then share the required connection details with StackAI.

### Before you begin

Azure Government is separate from commercial Azure. It uses separate portals, sign-in domains, and service hostnames.

Commercial Azure subscriptions and resources do not transfer to Azure Government.

If you already have an Azure Government tenant, start at **Sign in to Azure Government**.

### Prerequisites

* [ ] Confirm Azure Government eligibility.
* [ ] Obtain procurement authority or an existing Microsoft agreement.
* [ ] Get Global Administrator or Owner access in the target tenant.
* [ ] Choose API key or Microsoft Entra authentication with your security team.
* [ ] Prepare a secure secret-sharing method, such as Azure Key Vault.

### Set up Azure OpenAI

{% stepper %}
{% step %}

#### Confirm eligibility

Microsoft validates every Azure Government tenant request. You must qualify under one of three categories:

| Category                                  | Who it covers                                                                        |
| ----------------------------------------- | ------------------------------------------------------------------------------------ |
| **US government entity**                  | Federal, state, local, tribal, regional/interstate, FFRDC                            |
| **Government partner**                    | Delivering to government under direct or indirect contract, including GSA agreements |
| **Commercial entity with regulated data** | ITAR, CUI, DoD UCNI, DOE, criminal justice, or DoD Impact Level data                 |

Have supporting documentation ready — contract number, GSA schedule, or a written description of the regulated data. Microsoft's validation team will request it.

[Azure Government eligibility criteria](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-welcome)
{% endstep %}

{% step %}

#### Obtain a subscription

Choose one of four purchase paths:

| Path                     | Best for                                         | Link                                                                                           |
| ------------------------ | ------------------------------------------------ | ---------------------------------------------------------------------------------------------- |
| **Free trial** (90 days) | Validating the integration before committing     | [Request a trial](https://azure.microsoft.com/en-us/global-infrastructure/government/request/) |
| **Pay-as-you-go**        | Fastest production path, no commitment           | [PAYG offer](https://azure.microsoft.com/en-us/pricing/offers/ms-azr-usgov-0003p)              |
| **CSP partner**          | Partner-managed billing and deployment           | [Find a CSP](https://go.microsoft.com/fwlink/p/?linkid=2220650)                                |
| **Enterprise Agreement** | Existing Microsoft EA, locked multi-year pricing | [Contact licensing partner](https://go.microsoft.com/fwlink/p/?linkid=2220462)                 |

{% hint style="info" %}
**Recommended:** Start the **free trial** immediately and run production procurement in parallel. The trial produces a real tenant with real endpoints, so integration work is not thrown away on conversion.
{% endhint %}

Microsoft validation typically takes several business days. You will receive tenant credentials on a `*.onmicrosoft.us` domain.

[How to buy Azure Government](https://azure.microsoft.com/en-us/explore/global-infrastructure/government/how-to-buy/)
{% endstep %}

{% step %}

#### Sign in to Azure Government

Use the Government URLs. Commercial equivalents will reject Government credentials.

|                  | Commercial Azure            | Azure Government               |
| ---------------- | --------------------------- | ------------------------------ |
| Portal           | `portal.azure.com`          | **`https://portal.azure.us`**  |
| Sign-in          | `login.microsoftonline.com` | **`login.microsoftonline.us`** |
| Resource Manager | `management.azure.com`      | `management.usgovcloudapi.net` |
| Key Vault        | `vault.azure.net`           | `vault.usgovcloudapi.net`      |

[Azure Government endpoint mapping](https://learn.microsoft.com/en-us/azure/azure-government/compare-azure-government-global-azure)
{% endstep %}

{% step %}

#### Request Azure OpenAI access

Azure OpenAI in Azure Government has historically required registration in addition to a subscription.

Submit the access request at [**Azure Government - Request Access to Azure OpenAI**](https://aka.ms/AOAIgovaccess)

Confirm with your Microsoft account team whether this step is still required — the gating has been relaxed over time. If resource creation in Step 5 fails with a "not enabled for this subscription" error, this form is the fix.
{% endstep %}

{% step %}

#### Create the resource and deploy a model

**Create the Azure OpenAI resource**

In [portal.azure.us](https://portal.azure.us/):

1. **Create a resource** → search **Azure OpenAI**
2. Configure:
   * **Region:** `US Gov Virginia` or `US Gov Arizona` — both carry the same model set
   * **Name:** must not contain sensitive or export-controlled information
   * **Pricing tier:** Standard S0
3. Select **Create**

{% hint style="warning" %}
Azure resource names are not covered by export-control protections. Do not embed program names, classifications, or other sensitive strings. See [naming considerations](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-concept-naming-resources).
{% endhint %}

**Deploy the model**

Open the resource → **Model deployments** → **Manage deployments** → **Deploy model**.

Select **`gpt-5.1`** with deployment type **Data Zone Standard**.

{% hint style="warning" %}
`gpt-5.1` is offered **only** on Data Zone Standard in Azure Government. If you select plain "Standard" or "Provisioned managed," `gpt-5.1` will not appear in the model list. This is the most common cause of a "model unavailable" report.
{% endhint %}

**Record the deployment name you choose.** StackAI requires it. The deployment name is distinct from the model name, and API calls reference the deployment.

Check [current model and region availability](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/models-sold-directly-by-azure-gov) before selecting a model.

**Request a quota increase**

Default tokens-per-minute quotas are low and will throttle production traffic.

Submit an increase at **<https://aka.ms/AOAIGovQuota>**

Do this early. Quota requests take time, and an unraised limit presents as a broken integration under load.
{% endstep %}

{% step %}

#### Choose an authentication method

Decide this with your security team **before** generating any credential.

{% tabs %}
{% tab title="Option A — API key" %}
In the resource: **Resource Management** → **Keys and Endpoint**. Copy **KEY 1** and the **Endpoint**.
{% endtab %}

{% tab title="Option B — Microsoft Entra service principal" %}
**Recommended for production**

Many Government tenants disable key-based authentication by Azure Policy (`disableLocalAuth`). If that applies, or if a shared static secret is unacceptable to your security team, use a service principal:

1. Register an application in Microsoft Entra ID
2. Assign it the **Cognitive Services OpenAI User** role, scoped to the Azure OpenAI resource
3. Record the Tenant ID, Client ID, and Client Secret

[Keyless authentication guidance](https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/managed-identity)
{% endtab %}
{% endtabs %}
{% endstep %}

{% step %}

#### Share the connection details with StackAI

Provide these six values:

* [ ] **Endpoint** — `https://<resource-name>.openai.azure.us`
* [ ] **Deployment name** — the name set when you deployed the model
* [ ] **Model and version** — e.g. `gpt-5.1` (2025-11-13)
* [ ] **Region** — US Gov Virginia or US Gov Arizona
* [ ] **Credential** — API key, or Tenant ID + Client ID + Client Secret
* [ ] **Quota** — approved tokens-per-minute limit

{% hint style="warning" %}
Do not transmit keys or client secrets over email or chat. Use a shared secret store, or place the secret in Azure Key Vault (`vault.usgovcloudapi.net`) and grant StackAI scoped access.
{% endhint %}
{% endstep %}
{% endstepper %}

### Troubleshooting

<details>

<summary><code>getaddrinfo ENOTFOUND</code> or DNS resolution failure</summary>

**Cause:** The endpoint is using the commercial hostname `openai.azure.com` instead of the Government hostname.

**Fix:** Azure Government uses **`openai.azure.us`**. Check for hardcoded commercial hostnames in SDK configuration, environment variables, and firewall allowlists. This is the single most common Azure Government integration failure.

</details>

<details>

<summary><code>gpt-5.1</code> does not appear in the model deployment list</summary>

**Cause:** The deployment type is set to Standard or Provisioned managed. `gpt-5.1` is only offered on Data Zone Standard in Azure Government.

**Fix:** Change the deployment type to **Data Zone Standard**.

</details>

<details>

<summary><code>401 Unauthorized</code> with a key that was copied correctly</summary>

**Cause:** Local authentication is disabled on the resource by Azure Policy (`disableLocalAuth`), a common Government tenant hardening control.

**Fix:** Switch to Microsoft Entra service principal authentication.

</details>

<details>

<summary><code>404 Resource not found</code> on a valid endpoint</summary>

**Cause:** The URL uses the model name instead of the deployment name.

**Fix:** The path segment after `/deployments/` must be the deployment name, not `gpt-5.1`.

</details>

<details>

<summary><code>429 Too Many Requests</code> under light load</summary>

**Cause:** Default tokens-per-minute quota is exhausted.

**Fix:** Request an increase at <https://aka.ms/AOAIGovQuota>. Confirm the approved TPM value and share it with StackAI for rate-limit configuration.

</details>

<details>

<summary>Resource creation fails with "not enabled for this subscription"</summary>

**Cause:** The subscription has not been enabled for Azure OpenAI in Azure Government.

**Fix:** Submit the access request at <https://aka.ms/AOAIgovaccess> and follow up with your Microsoft account team.

</details>

<details>

<summary>Sign-in fails with valid Government credentials</summary>

**Cause:** Authenticating against the commercial endpoint.

**Fix:** Use `portal.azure.us` and `login.microsoftonline.us`.

</details>

### Related resources

* [Azure OpenAI in Azure Government](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/azure-government)
* [Azure Government endpoint mapping](https://learn.microsoft.com/en-us/azure/azure-government/compare-azure-government-global-azure)
* [Azure OpenAI model availability](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/models-sold-directly-by-azure-gov)
* [LLMs hosted on Azure and AWS Bedrock](/workflow-builder/core-nodes/ai-agent-node/llm-hosting-and-governance/llms-hosted-on-azure-and-aws-bedrock.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.stackai.com/agentic-adoption-and-security/government-deployments/azure-openai-in-azure-government.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.