Consultation

AI · Platform

Microsoft Foundry Citadel

Govern your AI agents on Azure from day one, with a proven reference architecture.

What is Citadel?

Citadel is an open-source reference architecture published by Microsoft for governing AI and agents on Azure. It uses a hub-and-spoke model: a central control point enforces the rules, while each team builds its agents in its own environment, inside shared guardrails.

Layered architecture of CitadelApplications and agents pass through a governed AI gateway, above agent operations and identity, on a security foundation, before reaching models, tools and data.Who callsBusiness appsAgentsCopilotsCITADELAI control planeLayer 1 · Governance hubCentral AI gateway (Azure API Management)Access controlPersonal data detectionContent safetyCost and usageRate limitsLayer 2 · Agent operationsPer-team environments (Foundry)TracesEvaluationsRed-teamingLayer 3 · Agent identityManaged identity (Microsoft Entra ID)Human ownerLifecycleLeast privilegeLayer 4 · Security fabricThreat protection and data governanceMicrosoft DefenderMicrosoft PurviewWhat is calledModelsToolsData
The path of a call: nothing reaches a model, tool or dataset without crossing the gateway, and every layer leaves a trace.

Four layers of governance

  1. 1

    Layer 1 — Governance hub

    A central AI gateway on Azure API Management: access control, personal data detection, content safety, cost and usage tracking per team.

  2. 2

    Layer 2 — Agent operations

    Per-team environments on Microsoft Foundry, with execution traces, evaluations and red-teaming.

  3. 3

    Layer 3 — Agent identity

    Each agent gets a managed identity in Microsoft Entra ID, with a human owner and a lifecycle.

  4. 4

    Layer 4 — Security fabric

    Threat protection and data governance with Microsoft Defender and Purview.

Why it matters

Pilots that reach production

Security and compliance blockers are solved once, at platform level, rather than relitigated for every new agent project. This is often what separates a pilot that stays a pilot from a real deployment.

Controlled costs

Every model call is attributed to a specific team and budget, which makes AI costs as visible as any other cloud spend. No more end-of-month surprises on a bill no one can explain.

Autonomy within guardrails

Teams move fast inside shared guardrails, without needing to work around the rules to ship faster. This is what actually reduces shadow AI: offering a fast, legitimate path instead of forbidding without an alternative.

How we help with Citadel

  1. 01

    Readiness assessment

    We assess your Azure landing zone, identity setup, networking, model quotas and governance requirements before recommending a deployment. This assessment avoids unpleasant surprises once the project is under way.

  2. 02

    Design and policies

    We adapt the Citadel architecture to your specific risks: gateway rules, per-team access contracts, and classification of your data. A reference architecture is a starting point, not a solution to apply as-is.

  3. 03

    Deployment and onboarding

    We deploy the governance hub and a first agent environment, working directly alongside your Azure teams rather than instead of them. The goal is to transfer the skill, not to create a dependency on us.

  4. 04

    AI platform resilience

    We apply the same discipline to your AI platform as to your critical systems: cross-region failover, a recovery plan and operating procedures. A governance hub that goes down stops every team that depends on it, not just one application.

Start with the vision questionnaire

Sources

Citadel is a fast-evolving open-source project from Microsoft. FZ Consultation is independent and not affiliated with Microsoft. Microsoft, Azure, Entra, Defender, Purview and Foundry are Microsoft trademarks.