{"resourceId":"gmu-azure-ai-foundry-shared-responsibility-model-20260930","versions":[{"version":"external-fd14e81439e164c4518585cf595f227fc5009d5529d39d4234b6ed33cc6daa7e","resource":{"id":"gmu-azure-ai-foundry-shared-responsibility-model-20260930","title":"George Mason University publishes an Azure AI Foundry shared-responsibility model: Terraform-provisioned subscriptions in about 8 business days, with departments paying all usage and owning data classification","organization":"George Mason University, Information Technology Services","sector":"Higher education / research computing","geography":"Fairfax, Virginia, United States","publishedAt":"2026-09-30","publicationDate":"2026-09-30","eventDate":"2026-10-20","sourceName":"George Mason University ITS Knowledge Base","sourceLabel":"University IT governance document (Version 1.0)","sourceUrl":"https://its.gmu.edu/knowledge-base/azure-ai-foundry-shared-responsibility-and-governance-model/","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["infrastructure","governance-procurement","data-security","developers-agents"],"finding":"George Mason ITS published a three-way shared-responsibility model (Microsoft, ITS, departments/researchers) for Azure AI Foundry, followed by a launch 'Foundry Day' with Microsoft on Oct. 20. ITS provisions subscriptions with Terraform, configures hub and project structure, logging, monitoring and budget alerts, and targets delivery within 8 business days of a complete, approved request. Departments pay all consumption, including tokens, storage, logging and required security controls (ITS recommends alerts at 80% and 100% of budget), and own data classification, output review, application security and updating configurations when model versions are deprecated. Research under CMMC Level 2 or higher, HIPAA or active Data Use Agreements must contact ITS first, and Restricted or Regulated data must not be submitted without confirming the environment is configured for it. ITS guidance recommends Anthropic Sonnet models for most research tasks and Opus for complex reasoning, delivered through Foundry.","sledRelevance":"A concrete, reusable operating model for a public research university offering Azure AI Foundry centrally, including cost allocation and compliance intake.","evidence":"Institutional governance document (Version 1.0, September 2026) plus an Oct. 14 event bulletin; describes design and responsibilities, not measured outcomes or adoption numbers.","architectureImplications":"Central IT provisions per-department subscriptions via infrastructure as code with baseline logging; researchers must design for model deprecations and service interruptions and avoid dependence on a single model deployment.","governanceImplications":"A clear allocation of responsibilities, with compliance intake for FERPA, HIPAA, CMMC and DUAs, gives other universities a model to adapt.","securityPrivacyImplications":"Researchers are responsible for data classification and credential handling; restricted data requires ITS consultation before use.","caveats":"Self-published by the operator; no adoption, cost or research-outcome data. Model recommendations (Anthropic models via Azure) reflect GMU's choices; Anthropic model specifics belong to the Anthropic stream, while the Azure platform belongs here.","streamIds":["microsoft"],"roles":{"sales":"Frame this as an operating model research universities can adopt, not a technology pitch. GMU's document assigns costs, data classification and output review to departments while ITS provisions governed subscriptions. Discovery should ask how a university funds AI consumption and handles HIPAA or CMMC research. A bounded engagement could help another institution draft a comparable responsibility model and intake process. Do not claim research productivity or cost results; GMU publishes none.","engineering":"Engineers can borrow the pattern: Terraform-provisioned Foundry subscriptions with baseline logging, monitoring and budget alerts, delivered within about eight business days. The model makes researchers responsible for model-version updates, quota limits, error handling and credential hygiene, and tells them to avoid single-model dependencies. For restricted data, configuration must be confirmed before use. A proof of value should test the provisioning pipeline, budget alerting at 80% and 100%, and a model-deprecation drill.","delivery":"Delivery should operationalize the three-way responsibility split. Central IT owns provisioning, baselines and deprecation notices; departments own spending, classification and application maintenance. Build an intake form requiring fund codes and compliance flags, a provisioning service target, and onboarding sessions like GMU's Foundry Day. Track whether researchers actually set budget alerts and act on deprecation notices, because the model depends on users carrying out responsibilities they may not be used to."},"roleDetails":{"sales":{"customerProblem":"Research universities want to offer governed Azure AI access without central IT absorbing open-ended costs or compliance risk.","stakeholders":["University CIO","Research computing director","Vice president for research","Research compliance office"],"discoveryQuestions":["Who pays for AI token consumption today?","How do you handle HIPAA, CMMC or DUA research on cloud AI?","What provisioning time do researchers expect?"],"valueHypothesis":"A documented responsibility model and intake process may speed governed access while keeping costs with funded projects.","potentialEngagement":"Workshop to adapt a shared-responsibility model and intake workflow for Azure AI Foundry.","unsupportedClaims":["Research productivity gains","Cost savings","Adoption levels at GMU"]},"engineering":{"fit":"Universities with Azure tenants offering AI to many research groups.","architectureIntegration":"Per-department Foundry subscriptions provisioned via Terraform with central logging, monitoring and budget alerts.","prerequisites":["Azure enterprise agreement","Infrastructure-as-code pipeline","Data classification policy"],"constraints":["Restricted/Regulated data requires ITS consultation","Departments bear all costs","Model deprecations require user action"],"security":"ITS sets baseline governance controls; researchers handle credentials and data classification.","proofOfValue":["Provision a subscription end to end within the target time","Trigger budget alerts at 80% and 100%","Run a model-deprecation update drill"]},"delivery":{"work":"Stand up a governed Foundry service with intake, provisioning and onboarding.","dependencies":["Fund-code chargeback process","Compliance office coordination","Microsoft deprecation notices"],"ownership":"Central IT cloud team for the platform; departments for their deployments.","skillsAdoption":"Onboarding events and a knowledge base for researchers on cost, models and security.","governanceCheckpoints":["Compliance flag at intake","Budget alert verification","Deprecation communication review"],"acceptanceCriteria":["Proposed: standard requests provisioned within 8 business days","Proposed: all subscriptions have budget alerts configured"],"risks":["Researchers neglecting cost or deprecation duties","Unfunded researchers excluded"]}},"retrievedAt":"2026-10-30T03:08:19Z","enrichedAt":"2026-10-30T03:18:29Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Shifts operational responsibility to researchers, who need skills in cost monitoring, configuration and model lifecycle management.","procurementImplications":"Chargeback to departmental fund codes makes AI costs visible but may limit access for unfunded researchers.","operatingModelImplications":"Central IT acts as provisioner and guide, not payer or operator of departmental deployments.","sourceVerification":{"openedUrl":"https://its.gmu.edu/knowledge-base/azure-ai-foundry-shared-responsibility-and-governance-model/","referenceExcerpt":"Does not pay for departmental AI Foundry usage — all costs are billed to the department.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}