Microsoft Foundry Models

Base inference is stateless and no-training, but abuse review and stateful features can retain content for human access.

Plan Scope

Microsoft Foundry Azure Direct Models, including Azure OpenAI and partner models; stateful APIs and modified abuse-monitoring customers differ.

Prompt Retention

Base inference is stateless, but prompts and completions selected for potential abuse can be stored for authorized human review. Assistants, Responses history, Stored Completions, Batch, and customer data sources intentionally persist content.

Response Retention

Same abuse-monitoring and feature-specific rules as prompts.

Ordinary Logging

Prompts and outputs are evaluated synchronously by safety systems. Usage, resource, security, and billing telemetry is retained; automated review alone does not store content.

Model Training

Microsoft says prompts, completions, embeddings, and fine-tuning data are not used to train, retrain, or improve base models without customer permission or instruction.

Product Improvement

Customer content is excluded from general model improvement absent permission; safety classification and service telemetry remain part of delivery.

Human Or Operator Access

Only content flagged for potential recurring or severe abuse enters the separated review store and can be accessed by authorized Microsoft employees through controlled, request-specific access. Approved modified-monitoring customers avoid this storage and human review.

Subprocessors And Routing

Content stays within the Azure service boundary and selected deployment geography subject to Global or DataZone routing; partner-model licenses and Microsoft subprocessors apply.

Deletion Controls

Stateless model processing stores no model state. Customers manage Assistants, Responses, files, batches, Stored Completions, fine-tuning assets, and data sources; qualified managed customers can request modified abuse monitoring.

Caveat

“Not used for training” does not mean “never retained.” Free or unmanaged access should assume standard abuse monitoring and should avoid sensitive prompts unless the deployment's controls are confirmed.