Gateway sits between your internal applications and Microsoft Foundry, Azure OpenAI and third-party providers — giving platform and FinOps teams centralized authentication, per-team cost control and routing governance in one deployable package.
POST https://gw.northwind.io/v1/chat/completions x-gw-app: internal-copilot x-gw-tags: summarization authorization: Bearer gw_live_3ab8de55…3f52 → policy: auth:entra-id ✓ rate-limit ✓ tokens ✓ → route: Claude Haiku 4 (anthropic/us-east) → 200 OK · 640ms · 3,182 tok · $0.0035 → charged to CC-1002 (Platform Engineering)
Everything a platform team needs to let the business build with AI without losing track of who is calling what, and what it costs.
One Entra ID-backed credential per app, scoped model allow-lists, rate limits and token ceilings enforced at the edge before traffic ever reaches a provider.
Every request is attributed to an app, team and cost center, so FinOps finally gets chargeback-ready numbers instead of a single opaque Azure line item.
Route workloads to the cheapest model that fits, fall back automatically when an upstream degrades, and stop runaway spend with hard budget caps.
Gateway is not another SaaS hop your data has to traverse. You apply a versioned Terraform module into your subscription: API Management, Key Vault, managed identity, Log Analytics and the policy engine, wired in front of Microsoft Foundry and any other model providers you already pay for. Your traffic and telemetry never leave your tenant.
module "ai_gateway" {
source = "northwind/azure-ai-gateway/azurerm"
version = "2.7.1"
resource_group = "rg-ai-gateway-prod"
location = "eastus2"
apim_sku = "Premium_v2"
upstreams = {
foundry = { region = "swedencentral" }
azure_openai = { region = "eastus2" }
anthropic = { via = "private_link" }
}
budgets = { org_monthly_usd = 45000, mode = "soft" }
}Platform licensing only — you keep paying your model providers directly at their rates.
For a first platform team standardizing internal AI access.
For multi-team rollouts that need chargeback and policy control.
For regulated environments with residency and audit requirements.
A 30-minute walkthrough of the console, the Terraform module and what a Foundry-fronted deployment looks like in your tenant.