Multi-agent assistant: Copilot Studio, Azure AI Foundry and Microsoft Fabric

Flow

1An employee asks a question in Teams or Microsoft 365 Copilot; Copilot Studio authenticates them with Entra ID
2Copilot Studio hands complex requests to the Foundry orchestrator through the API Management AI gateway, passing the user's token
3API Management → Orchestrator agent (invoke)
4The orchestrator asks the model to plan and pick specialist agents; prompts and replies pass Content Safety
5Orchestrator agent → Data agent (connected agent)
5Orchestrator agent → Knowledge agent (connected agent)
5Orchestrator agent → Action agent (connected agent)
6The knowledge agent retrieves grounding passages from Azure AI Search
6The data agent queries governed lakehouse and semantic-model data through a Fabric data agent, as the signed-in user
6The action agent calls approved workflows (ticketing, approvals) in Logic Apps; high-impact actions need human approval

Cost estimate eastus · price list as of 2026-10-02 · indicative — some usage is assumed

$3,640per month

$43,683per year

6/15components priced

7not priced (see below)

Public pay-as-you-go list prices from the Azure Retail Prices API (USD). Excludes taxes, support plans, Reservations, Savings Plans, Spot and enterprise or EA discounts, and data transfer unless a node sets egressGbPerMonth. Free grants are included where the meter has a free tier. Monthly = 730 hours. Not a quote: confirm with the Azure Pricing Calculator.

Usage basis. Illustrative: 50,000 conversations/month, ~4 model calls each (≈3,000 input and 400 output tokens per call), gpt-4o-0806 global deployment. Copilot Studio and Microsoft Fabric use the official Power Platform and Fabric icon sets. Fabric capacity and Copilot Studio messages are not in the Retail Prices API and are not priced.

Show monthly cost on the diagram

By category

AI and agents$2,941 · 81%

Integration$687 · 19%

Security and operations$13.00 · 0%

By component click a row to highlight it on the diagram

Component	Service	Status	$ / month	Line items
Azure OpenAI	Azure OpenAI	estimated	$2,300	2 lines gpt-4o-0806: input tokens (standard, global): 600,000 1K × $0.0025 = $1,500.00 gpt-4o-0806: output tokens (standard, global): 80,000 1K × $0.01 = $800.00 Model matched in the Retail Prices API: gpt-4o-0806. Pay-as-you-go standard global deployment; provisioned throughput (PTU) is not modelled.
API Management	API Management Services	estimated	$687	1 line Standard unit-hours: 730 1 Hour × $0.9407 = $686.711
Azure AI Search	Cognitive Search	estimated	$491	1 line Standard S1 search unit-hours (replicas × partitions): 1,460 1 Hour × $0.336 = $490.56 Semantic ranker, document cracking and agentic retrieval are billed separately and not modelled.
Content Safety	Content Safety	estimated	$150	1 line Text records (1,000 characters each): 400 1K × $0.375 = $150.00
Azure Monitor	Monitor	estimated	$11.50	1 line Data ingestion (GB): 10 1 GB × $0.00 (tiered) = $11.50 Pay-as-you-go ingestion with the monthly free allowance in the tier; commitment tiers are not modelled.
Key Vault	Key Vaults	estimated	$1.50	1 line Secret and key operations: 50 10K × $0.03 = $1.50 Standard tier software-protected keys; HSM keys and certificates are not modelled.

Not priced

Copilot Studio — not-estimated: No cost model for Copilot Studio yet. Supply `usage.monthlyUsd` on the node to include it.
Microsoft Entra ID — no-charge: Entra ID Protection has no direct charge.
Orchestrator agent — not-estimated: No cost model for Foundry Agent Service yet. Supply `usage.monthlyUsd` on the node to include it.
Knowledge agent — not-estimated: No cost model for Foundry Agent Service yet. Supply `usage.monthlyUsd` on the node to include it.
Data agent — not-estimated: No cost model for Foundry Agent Service yet. Supply `usage.monthlyUsd` on the node to include it.
Action agent — not-estimated: No cost model for Foundry Agent Service yet. Supply `usage.monthlyUsd` on the node to include it.
Microsoft Fabric — not-estimated: No cost model for Azure Synapse Analytics yet. Supply `usage.monthlyUsd` on the node to include it.
Logic Apps — not-estimated: No cost model for Logic Apps yet. Supply `usage.monthlyUsd` on the node to include it.

Assumptions 6 defaulted — replace them with your own numbers in each node's `usage`

Component	Assumption	Value	Source
API Management	tier	standard	from spec
API Management	units	1	from spec
Azure OpenAI	model	gpt-4o-0806	from spec
Azure OpenAI	deployment	global	from spec
Azure OpenAI	mode	standard	assumed
Azure OpenAI	inputTokensPerMonth	600000000	from spec
Azure OpenAI	outputTokensPerMonth	80000000	from spec
Azure OpenAI	cachedInputTokensPerMonth	0	assumed
Content Safety	textRecordsPerMonth	400000	from spec
Content Safety	imagesPerMonth	0	assumed
Azure AI Search	sku	standard-s1	from spec
Azure AI Search	searchUnits	2	from spec
Key Vault	operationsPerMonth	500000	from spec
Azure Monitor	ingestGbPerMonth	10	assumed
Azure Monitor	retentionDays	31	assumed
Azure Monitor	retainedGb	10	assumed

Sensitivity & what-if

$3,640at 1× traffic

$8,589at 3× traffic

$25,911at 10× traffic

No what-if options apply to these services.

Price list provenance

Retrieved 2026-10-02T10:01:47.868Z from the public Azure Retail Prices API. Latest price effective dates per service:

API Management 2024-12-01 · Foundry Tools 2026-10-01 · Azure Cognitive Search 2026-09-01 · Key Vault 2022-03-01 · Log Analytics 2018-02-01

Only public pay-as-you-go list prices are used. This is not a quote — confirm in the Azure Pricing Calculator.

Well-Architected review Multi-agent assistant: Copilot Studio, Azure AI Foundry and Microsoft Fabric · 2026-10-02 · mode full

Coverage audit

Azure Well-Architected Framework — 5 pillars, 59 recommendations, from the live documentation index, snapshot 2026-10-02 (0 days old).
Assessed 59 recommendations: 12 with diagram evidence, 47 cannot be determined.
Evidence sources: architecture diagram (services, boundaries, relationships); cost estimate from the Azure Retail Prices API.
Corpus read from a committed snapshot of the live documentation index (not re-fetched during this review). Re-read it with `archify-azure wa corpus --refresh`. Statuses reflect what the diagram and spec show. Process, configuration and runtime evidence are not observable here, so those recommendations are 'Cannot Determine' rather than guessed.

Executive summary

This Azure Well-Architected Framework (with the guidance for AI workloads) review of Multi-agent assistant: Copilot Studio, Azure AI Foundry and Microsoft Fabric (standard criticality) assessed the architecture diagram only. 12 of 59 framework recommendations have diagram evidence; the rest are Cannot Determine because process, configuration and runtime evidence is not in the diagram. It found 0 critical, 1 high, 1 medium and 0 low risks. Estimated run cost is $3,640/month (indicative).

0Critical

1High

1Medium

0Low

3.0provisional maturity (1–5)

12 of 59 recommendations have diagram evidence (20%); among those, 5 implemented, 5 partial, 2 not implemented. Provisional: scores cover evidenced practices only.

Strengths. Data stores are not placed in public subnets; Key management shown; Identity service shown; Observability shown; Content safety shown; Model telemetry destination shown; Agents and excessive agency; Distributed tracing.

Architecture overview

The reviewed architecture is the Diagram tab (15 components, architecture diagram). Hover a finding to highlight the components involved.

Pillar scorecard

Pillar	Score (1–5)	Evidenced recommendations	I · P · N · NA · CD	Strongest area	Main gap
Reliability	—	2/10 (20%)	2 0 0 0 8	—	No gaps evidenced in the diagram
Security	3.0	6/12 (50%)	2 2 2 0 6	Data stores are not placed in public subnets	Internet-facing entry has no WAF / DDoS protection shown
Cost Optimization	—	2/14 (14.3%)	0 2 0 0 12	—	No gaps evidenced in the diagram
Operational Excellence	—	1/11 (9.1%)	1 0 0 0 10	Observability shown	No gaps evidenced in the diagram
Performance Efficiency	—	1/12 (8.3%)	0 1 0 0 11	—	No gaps evidenced in the diagram

Score = 1 + 4 × (implemented + ½ partial) ÷ evidenced recommendations; shown only when ≥ 3 recommendations are evidenced. It reflects evidenced practices, not the whole pillar.

Recommendation ledger 59 recommendations — nothing truncated

ID	Pillar	Best practice	Status	Evidence
RE:01	Reliability	Focus your workload design on simplicity and efficiency.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
RE:02	Reliability	Identify and rate user and system flows.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
RE:03	Reliability	Use failure mode analysis (FMA) to identify potential failures in your workload.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
RE:04	Reliability	Define reliability and recovery targets	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
RE:05	Reliability	Add redundancy at different levels, especially for critical flows	Cannot Determine	Diagram: Single-region model inference. Nodes: aoai, orch, kagent, dagent, aagent. Plan for throttling and quota limits (retries, queuing, provisioned throughput units) and consider global/data-zone deployments, a second region or a fallback model. No on-premises or private-link connectivity is drawn.
RE:06	Reliability	Implement a timely and reliable scaling strategy at the application, data, and infrastructure levels	Cannot Determine	Diagram: Single-region model inference. Nodes: aoai, orch, kagent, dagent, aagent. Plan for throttling and quota limits (retries, queuing, provisioned throughput units) and consider global/data-zone deployments, a second region or a fallback model.
RE:07	Reliability	Strengthen the resiliency of your workload by implementing self-preservation and self-healing measures	Implemented	Diagram: Content safety shown. Nodes: aoai, orch, kagent, dagent, aagent. Apply Azure AI Content Safety (content filters, prompt shields, groundedness detection) to prompts and responses, and add PII handling where needed.
RE:08	Reliability	Test for resiliency and availability scenarios by applying the principles of chaos engineering.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
RE:09	Reliability	Implement structured, tested, and documented disaster recovery (DR) plans	Cannot Determine	Not observable from the architecture diagram; needs process or organizational evidence.
RE:10	Reliability	Continuously measure and track system health using uptime and reliability indicators	Implemented	Diagram: Observability shown. Nodes: mon. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes.
SE:01	Security	Establish a security baseline	Cannot Determine	Diagram: No threat detection or posture management shown. Enable Microsoft Defender for Cloud and Microsoft Sentinel (and Azure Policy) for posture management, threat detection and response; send activity logs to a central workspace.
SE:02	Security	Align secure development lifecycle (SDL) throughout the software development lifecycle	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
SE:03	Security	Classify and consistently apply sensitivity and information type labels	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
SE:04	Security	Create intentional segmentation and perimeters	Partially Implemented	Diagram: Data stores are not placed in public subnets. Least-privilege network placement for stateful services. Diagram: No private endpoints shown for PaaS data services. Disable public network access on PaaS data services and reach them through Azure Private Link private endpoints inside your virtual network.
SE:05	Security	Implement strict, conditional, and auditable identity and access management (IAM)	Implemented	Diagram: Identity service shown. Nodes: idp. Authenticate and authorize every request with Microsoft Entra ID (conditional access, RBAC) and use managed identities instead of stored credentials. Diagram: Agents and excessive agency. Nodes: orch, kagent, dagent, aagent. Give agents least-privilege managed identities and scoped tools, validate tool inputs and outputs, and require human approval for high-impact actions.
SE:06	Security	Isolate, filter, and control network traffic	Not Implemented	Diagram: Internet-facing entry has no WAF / DDoS protection shown. Nodes: apim. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end. Diagram: No private endpoints shown for PaaS data services. Disable public network access on PaaS data services and reach them through Azure Private Link private endpoints inside your virtual network. API Management AI gateway, throttling mediates access to model and tool APIs; per-API authorization is not observable in a diagram.
SE:07	Security	Encrypt data by using modern, industry-standard methods	Implemented	Diagram: Key management shown. Nodes: kv. Encrypt data at rest and in transit; use Azure Key Vault customer-managed keys where you need key rotation, access policy or audit control.
SE:08	Security	Harden all workload components	Not Implemented	Diagram: Internet-facing entry has no WAF / DDoS protection shown. Nodes: apim. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end. Diagram: Content safety shown. Nodes: aoai, orch, kagent, dagent, aagent. Apply Azure AI Content Safety (content filters, prompt shields, groundedness detection) to prompts and responses, and add PII handling where needed. Diagram: Agents and excessive agency. Nodes: orch, kagent, dagent, aagent. Give agents least-privilege managed identities and scoped tools, validate tool inputs and outputs, and require human approval for high-impact actions. Human approval is drawn for flagged outputs/actions (aagent); combine with deterministic policy for high-impact actions.
SE:09	Security	Protect application secrets	Cannot Determine	Not observable from the architecture diagram; needs IaC or configuration evidence.
SE:10	Security	Implement a holistic monitoring strategy	Partially Implemented	Diagram: No threat detection or posture management shown. Enable Microsoft Defender for Cloud and Microsoft Sentinel (and Azure Policy) for posture management, threat detection and response; send activity logs to a central workspace. Diagram: Observability shown. Nodes: mon. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. Diagram: Model telemetry destination shown. Nodes: aoai, orch, kagent, dagent, aagent. Send diagnostic logs, token usage, latency and content-filter events to Azure Monitor / Log Analytics and keep an audit trail; trace agent steps with Application Insights.
SE:11	Security	Establish a comprehensive testing regimen	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
SE:12	Security	Define and test effective incident response procedures	Cannot Determine	Not observable from the architecture diagram; needs process or organizational evidence.
CO:01	Cost Optimization	Create a culture of financial responsibility.	Cannot Determine	Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners.
CO:02	Cost Optimization	Create and maintain a cost model.	Partially Implemented	A design-time cost model was generated from the Azure Retail Prices API: 6 of 13 billable components priced, $3,640.27/month pay-as-you-go (indicative; volumes partly assumed).
CO:03	Cost Optimization	Collect and review cost data.	Cannot Determine	Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners.
CO:04	Cost Optimization	Set spending guardrails.	Cannot Determine	Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners.
CO:05	Cost Optimization	Get the best rates from providers.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:06	Cost Optimization	Align usage to billing increments.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:07	Cost Optimization	Optimize component costs.	Partially Implemented	Diagram: Model cost controls. Nodes: aoai, orch, kagent, dagent, aagent. Choose the smallest model that meets quality targets, use prompt caching and batch deployments where possible, and track tokens and cost per request. gpt-4o-0806 accounts for 63% of the estimated monthly cost ($2,300.00); model right-sizing should be validated against quality targets.
CO:08	Cost Optimization	Optimize environment costs.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:09	Cost Optimization	Optimize flow costs.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:10	Cost Optimization	Optimize data costs.	Cannot Determine	Data transfer (bandwidth) is excluded from the estimate because no node sets egressGbPerMonth; model it before launch.
CO:11	Cost Optimization	Optimize code costs.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:12	Cost Optimization	Optimize scaling costs.	Cannot Determine	Diagram: Model cost controls. Nodes: aoai, orch, kagent, dagent, aagent. Choose the smallest model that meets quality targets, use prompt caching and batch deployments where possible, and track tokens and cost per request.
CO:13	Cost Optimization	Optimize personnel time.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:14	Cost Optimization	Consolidate resources and responsibility.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:01	Operational Excellence	Define your standard practices to develop and operate your workload.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:02	Operational Excellence	Use standardization as a way to make routine, ad-hoc, and emergency operations consistent and predictable.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:03	Operational Excellence	Formalize processes across the full software development lifecycle, from ideation to delivery, and make them transparent to the team and stakeholders.	Cannot Determine	Not observable from the architecture diagram; needs process or organizational evidence.
OE:04	Operational Excellence	Enhance software development and quality assurance	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:05	Operational Excellence	Use a standardized infrastructure as code (IaC) approach to prepare resources and configurations.	Cannot Determine	Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline (GitHub Actions or Azure Pipelines) with small, reversible changes and safe deployment practices.
OE:06	Operational Excellence	Build a workload supply chain that drives changes	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:07	Operational Excellence	Design a monitoring stack	Implemented	Diagram: Observability shown. Nodes: mon. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. Diagram: Model telemetry destination shown. Nodes: aoai, orch, kagent, dagent, aagent. Send diagnostic logs, token usage, latency and content-filter events to Azure Monitor / Log Analytics and keep an audit trail; trace agent steps with Application Insights. Application tracing/telemetry is drawn (mon).
OE:08	Operational Excellence	Establish a clear, structured incident management process	Cannot Determine	Not observable from the architecture diagram; needs process or organizational evidence.
OE:09	Operational Excellence	Enhance the quality of your workload	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:10	Operational Excellence	Design automation to be reliable, secure, and maintainable	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:11	Operational Excellence	Clearly define your workload's safe deployment practices.	Cannot Determine	Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline (GitHub Actions or Azure Pipelines) with small, reversible changes and safe deployment practices.
PE:01	Performance Efficiency	Define performance targets.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:02	Performance Efficiency	Conduct capacity planning.	Cannot Determine	Not observable from the architecture diagram; needs process or organizational evidence.
PE:03	Performance Efficiency	Select the right services.	Cannot Determine	Diagram: No CDN / global edge shown for end users. Serve content and terminate TLS close to users with Azure Front Door or Azure CDN to cut latency. Diagram: Retrieval / grounding data shown. Nodes: search. Ground responses in enterprise data (RAG with Azure AI Search or a vector-enabled database) and measure retrieval quality; version prompts, models and data sources.
PE:04	Performance Efficiency	Establish consistent performance measurement	Partially Implemented	Diagram: Observability shown. Nodes: mon. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. Application tracing/telemetry is drawn (mon).
PE:05	Performance Efficiency	Optimize scaling and partitioning.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:06	Performance Efficiency	Optimize your workload's performance by regularly testing in a production-like environment	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:07	Performance Efficiency	Optimize code and infrastructure.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:08	Performance Efficiency	Optimize data usage.	Cannot Determine	Diagram: Retrieval / grounding data shown. Nodes: search. Ground responses in enterprise data (RAG with Azure AI Search or a vector-enabled database) and measure retrieval quality; version prompts, models and data sources.
PE:09	Performance Efficiency	Prioritize the performance of critical flows.	Cannot Determine	Diagram: No CDN / global edge shown for end users. Serve content and terminate TLS close to users with Azure Front Door or Azure CDN to cut latency.
PE:10	Performance Efficiency	Optimize operational tasks.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:11	Performance Efficiency	Respond to live performance issues.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:12	Performance Efficiency	Continuously optimize performance.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.

Findings

High risk (1)

F-001 High Model inference dominates cost · Cost Optimization · Generative AI Lens · CO:07

Evidence. gpt-4o-0806 accounts for 63% of the estimated monthly cost ($2,300.00); model right-sizing should be validated against quality targets.

Impact × likelihood. Moderate × High → High. Status: Partially Implemented.

Recommendation. Validate that the chosen model is the smallest that meets quality targets; use prompt caching, batch deployments and token budgets.

Priority. Do First · effort Low · owner ML platform team

Medium risk (1)

F-002 Medium Internet-facing entry has no WAF / DDoS protection shown · Security · SE:06, SE:08

Evidence. Diagram: Internet-facing entry has no WAF / DDoS protection shown. Nodes: apim. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end.

Impact × likelihood. Moderate × Medium → Medium. Status: Not Implemented.

Recommendation. Put Azure Web Application Firewall (on Front Door or Application Gateway) and DDoS Protection in front of every internet-facing entry point; start in detection mode, then enforce.

Priority. Delegate · effort Low · owner Security engineering

To confirm not drawn, so not counted as gaps

No private endpoints shown for PaaS data services SE:06, SE:04 — Disable public network access on PaaS data services (Storage, SQL, Cosmos DB, Key Vault) and connect through Azure Private Link private endpoints with private DNS zones.
No threat detection or posture management shown SE:10, SE:01 — Enable Microsoft Defender for Cloud and Microsoft Sentinel, assign Azure Policy initiatives for the baseline, and send activity and diagnostic logs to a central, access-restricted Log Analytics workspace.
No infrastructure-as-code or CI/CD shown OE:05, OE:11 — Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline with small, reversible changes, environment promotion and automated rollback.
No CDN / global edge shown for end users PE:03, PE:09 — Serve content and terminate TLS close to users with Azure Front Door or Azure CDN to reduce latency.
No cost visibility shown CO:03, CO:04, CO:01 — Set Microsoft Cost Management budgets with alert thresholds and enforce cost-allocation tags (Azure Policy) so spend maps to this workload.
Single-region model inference RE:05, RE:06 — Plan for throttling and quota limits (retries, queuing, provisioned throughput units) and consider global or data-zone deployments, a second region or a fallback model.
Model cost controls CO:07, CO:12 — Select the smallest model that meets quality targets; use prompt caching and batch deployments where possible; track cost per request.

Cross-pillar trade-offs

Content safety on model traffic Security ↔ Cost Optimization ↔ Performance Efficiency
Content Safety costs $150.00/month (5% of AI spend) and adds a synchronous screening step to each model call. Resolution: Apply the strictest checks where harm is highest (final responses, PII) and measure per-check value before enabling every check on every call.
Observability volume Operational Excellence ↔ Cost Optimization
Log Analytics is $11.50/month in this estimate, mostly log ingestion; richer telemetry improves detection but ingestion is billed per GB. Resolution: Sample verbose traces, set retention per table (Basic logs for high-volume, low-value data) and keep full-fidelity logs for security and audit sources only.

Eisenhower prioritization

Do First

F-001 Model inference dominates cost

Plan

None

Delegate

F-002 Internet-facing entry has no WAF / DDoS protection shown

Defer