Why should you care?

Hospital and finance customers require Azure contracts, VNet integration, and no data used for public model training.

See it live — copy this example

Paste into an ASP.NET Core 8+ / AgentNest project, then run with dotnet run (set your API keys in user-secrets).

// Program.cs — Azure OpenAI
builder.Services.AddAzureOpenAIChatClient(
    deploymentName: builder.Configuration["AzureOpenAI:ChatDeployment"]!,
    endpoint: new Uri(builder.Configuration["AzureOpenAI:Endpoint"]!),
    credential: new DefaultAzureCredential());

builder.Services.AddAzureOpenAIEmbeddingGenerator(
    deploymentName: builder.Configuration["AzureOpenAI:EmbeddingDeployment"]!,
    endpoint: new Uri(builder.Configuration["AzureOpenAI:Endpoint"]!),
    credential: new DefaultAzureCredential());

What happened?

• DefaultAzureCredential uses managed identity in Azure App Service — no API key in config.
• Separate chat and embedding deployments match AgentNest RAG architecture.

Practice next

1. Create Azure OpenAI resource and deploy chat + embedding models.
2. Assign Cognitive Services OpenAI User role to App Service identity.
3. Add Azure.AI.OpenAI and Microsoft.Extensions.AI.Azure packages.
4. Point staging at a cheaper gpt-4o-mini deployment name.
5. Enable private endpoint and verify DNS from the App Service VNet.

Remember

Azure OpenAI uses endpoint + deployment + DefaultAzureCredential. Register both chat and embedding clients for RAG features. Managed identity removes long-lived secrets from AgentNest.

HIPAA-aligned hospital tier

A hospital tenant mandates Azure US regions and managed identity only.

Outcome: AgentNest hospital assistant runs entirely on Azure OpenAI with audit-friendly identity.