Azure OpenAI and Dome

1. 01

   Add the deployment

   The provider id is azure_openai. Endpoint, deployment and api_version are all required: Azure picks the model from the deployment.

   $ dome models add gpt-azure-eu \
     --provider azure_openai \
     --model gpt-6-sol \
     --provider-config '{"endpoint":"https://contoso-eu.openai.azure.com","deployment":"gpt-6-sol","api_version":"2024-10-21"}' \
     --api-key "$AZURE_OPENAI_API_KEY" \
     --attributes '{"region":"eu"}' \
     --gateway prod-gateway

2. 02

   Pool it with OpenAI

   The EU deployment goes first and OpenAI second. Agents address gpt-6-sol, the pool.

   $ dome models pool create gpt-6-sol \
     --failover-max all --gateway prod-gateway
    
   $ dome models pool member add gpt-6-sol gpt-azure-eu --priority 0
   $ dome models pool member add gpt-6-sol gpt-openai --priority 1

3. 03

   Point your agent at the Gateway

   Use the standard OpenAI SDK, not the Azure client. The agent's Dome key replaces the Azure key.

   from openai import OpenAI
    
   client = OpenAI(base_url=f"{GATEWAY_URL}/v1", api_key=DOME_AGENT_KEY)
   client.chat.completions.create(
       model="gpt-6-sol",
       messages=[{"role": "user", "content": "Summarize this policy for a new hire."}],
   )

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Azure OpenAI itself, see Microsoft's documentation.

forbid (principal, action == Dome::Action::"llm:invoke", resource is Dome::LLMModel)
when {
  principal has act_as &&
  principal.act_as.groups.contains("eu-staff")
}
unless { resource has region && resource.region == "eu" };