Public documentation edition. Account, subscription, and environment names are replaced with examples. Raw execution evidence, configuration files, and PDFs are not published here.

Microsoft Discovery — Azure Architecture and Version Dependencies

English · Technical sources checked 2026-09-25 · Documentation revised 2026-10-02 · Cloud service

한국어 · English hands-on guide

Bottom line: Discovery connects Foundry agents/models, the AKS-based Supercomputer, and Bookshelf's knowledge stack. Within Bookshelf, Azure AI Search handles document enrichment, Azure SQL Database stores the knowledge graph/vectors, and Azure Container Apps serves search. Workspaces/Projects use Cosmos DB; file inputs/outputs use linked storage such as Blob Storage.R01 R02 R04 R05 R06

This is a documentation-based reference architecture, not an inventory of an inspected Azure subscription or a fixed internal software BOM. Where public documentation does not specify an exact Kubernetes, database-engine, or service-build dependency, this document does not invent one.

First reading: Overall architecture → Bookshelf indexing/search → Networking and identity. For version reviews, use the distinctions below and change impacts. Shared customer procedures are in guide S00; environment-specific attempts and observations belong to the separate deployment reference, Korean. A component appearing in a diagram does not mean it has been deployed or verified.

1. Separate the meanings of “version”

Tables use D = documented contract/relationship, E = example/configuration, and O = deployment observation required. “Unconfirmed” does not mean “latest” or “unrestricted.”

2. Overall architecture

graph TB
  CLIENT["Discovery Studio / SDK / REST"]
  ENTRA["Microsoft Entra ID<br/>Azure RBAC"]
  DISC["Microsoft Discovery<br/>Workspace / Project / Engine"]
  subgraph MANAGED["Logical managed scopes in the customer subscription"]
    FOUNDRY["Microsoft Foundry<br/>Agent Service + model deployments"]
    APPS["Azure Container Apps<br/>Managed application environments"]
    COSMOS["Azure Cosmos DB<br/>Workspace / Project persistence"]
    BOOK["Bookshelf<br/>AI Search + SQL + Container Apps"]
    HPC["Supercomputer<br/>AKS + Compute VM Scale Sets"]
  end
  BLOB["Azure Blob Storage<br/>Documents / inputs / outputs"]
  ACR["Customer Azure Container Registry<br/>When using custom images"]
  CLIENT -->|"Sign-in"| ENTRA
  CLIENT ==>|"Research and management requests"| DISC
  DISC -->|"Authentication and authorization"| ENTRA
  DISC -->|"Agents and models"| FOUNDRY
  DISC -->|"Delegated app environments"| APPS
  DISC -->|"Managed persistence"| COSMOS
  FOUNDRY -->|"Grounding through Discovery"| BOOK
  FOUNDRY -->|"Tool execution through Discovery"| HPC
  BOOK -->|"Indexing jobs"| HPC
  BOOK -->|"Read source documents"| BLOB
  HPC -->|"Input and output files"| BLOB
  HPC -.->|"Custom-image pull"| ACR
  classDef core fill:#e8f1ff,stroke:#3974a6,color:#18344e
  classDef data fill:#e6f4ed,stroke:#57957c,color:#18344e
  classDef optional fill:#fff2d7,stroke:#ba8b31,color:#18344e
  class DISC,FOUNDRY,APPS,HPC core
  class COSMOS,BOOK,BLOB data
  class ACR optional

Arrows express logical usage/dependency, not exact packet routes, process-call order, or resource counts. Dashed edges are conditional. A conditional customer-owned ACR does not mean a container image is unnecessary. Foundry represents logical service/model deployments, not a claim that inference GPUs reside inside the customer's VNet.

Discovery documentation describes managed resource groups (MRGs) for Workspace, Bookshelf, and Supercomputer. Actual deployments can have additional groups such as an AKS node resource group. Do not infer exact group names, counts, or resource counts from this diagram.R02 R07

3. Bookshelf indexing and querying have different dependencies

graph LR
  subgraph BUILD["Index preparation and execution"]
    INDEX["Bookshelf indexing coordination"]
    ENRICH["Azure AI Search<br/>Text extraction and enrichment"]
    COMPUTE["Supercomputer<br/>Knowledge-graph construction job"]
    EMBED["Foundry / Azure OpenAI<br/>text-embedding-3-small"]
  end
  SOURCE["Azure Blob Storage<br/>Source documents"]
  SQL["Azure SQL Database<br/>Knowledge graph + vector KB"]
  subgraph QUERY["Search and grounded responses"]
    AGENT["Discovery agent"]
    SEARCH["Azure Container Apps<br/>Bookshelf query runtime"]
    LLM["Foundry / Azure OpenAI<br/>gpt-5.2 + gpt-5-mini"]
  end
  INDEX -->|"Use enrichment"| ENRICH
  ENRICH -->|"Read sources"| SOURCE
  INDEX -->|"Compute job"| COMPUTE
  INDEX -->|"Generate embeddings"| EMBED
  INDEX -->|"Store index results"| SQL
  AGENT ==>|"Grounding query"| SEARCH
  SEARCH -->|"Read graph and vectors"| SQL
  SEARCH -->|"Query decomposition and answers"| LLM
  classDef compute fill:#e8f1ff,stroke:#3974a6,color:#18344e
  classDef data fill:#e6f4ed,stroke:#57957c,color:#18344e
  class INDEX,COMPUTE,SEARCH compute
  class SOURCE,SQL data

This is also a logical dependency view. It does not claim that a particular indexing process writes directly to SQL rather than through an intermediate service.R04 R05 R06

• Indexing: Blob sources, extraction/enrichment, embeddings/high-memory computation, and SQL graph/vector storage are linked.
• Querying: Search runtime and models use an existing KB. Check an indexing-pool failure and an existing-KB query failure separately.
• Opening citations: Obtaining a search response and a user opening the source Blob have different access/network paths.
• Do not confuse graph stores: A “knowledge graph” does not imply a mandatory Cosmos DB Gremlin or Neo4j deployment. The cited Bookshelf documentation explicitly places its KB in Azure SQL DB.

4. Azure components, roles and version evidence

“Required” means required within the selected capability, not that every Workspace always creates all these resources in the same counts/SKUs.

Provider registration is not a deployment BOM. Prerequisites include providers such as Microsoft.Web, Microsoft.ContainerInstance, Microsoft.MachineLearningServices, Microsoft.Bing, Microsoft.ResourceGraph, and Microsoft.Insights. Registration alone does not establish that every deployment contains an instance of each service or depends on a particular runtime version. Inspect the actual inventory.R03 R24

5. Which versions are actually specified?

Models and APIs

For example, creating gpt-5.4 under deployment name gpt-5-4 using API 2026-06-01 combines a model name, a deployment name, and an API contract. The effective model revision and upgrade policy still require separate inspection.

Public Bicep example API versions—not product-wide minimum requirements

These are E values read from the public example, not evidence that Discovery internally calls all managed services using the same API versions. The observed file's SHA-256 is 7092563897d47b4870797236d90d84dc65635f2bb87c398591f16174e48b29aa. master is mutable; this is an observed-file checksum, not a commit pin.

6. Conditional security and CMK dependencies

graph TB
  RES["Discovery resources"]
  NET["Azure VNet / delegated subnets<br/>NSP / managed-resource private endpoints"]
  UAMI["Customer UAMI + Azure RBAC"]
  ENTRY["Workspace / Bookshelf<br/>Customer API access"]
  PE["Private Link + Private DNS<br/>Customer private endpoints"]
  CMK["Customer-managed key mode<br/>Selected at creation"]
  KV["Azure Key Vault<br/>Explicit keyVersion"]
  LOG["Log Analytics dedicated cluster<br/>CMK-protected logs"]
  DES["Disk Encryption Set<br/>Supercomputer CMK"]
  ANF["Azure NetApp Files<br/>Selected HPC storage path"]
  RES -->|"Protect managed resources"| NET
  RES -->|"Customer data and tool access"| UAMI
  ENTRY -.->|"Select private API path"| PE
  RES -.->|"When CMK is enabled"| CMK
  CMK -->|"Key dependency"| KV
  CMK -->|"CMK logging dependency"| LOG
  CMK -.->|"For Supercomputer"| DES
  DES -->|"Disk key"| KV
  LOG -->|"Log key"| KV
  RES -.->|"When selecting this storage kind"| ANF
  classDef managed fill:#e8f1ff,stroke:#3974a6,color:#18344e
  classDef conditional fill:#fff2d7,stroke:#ba8b31,color:#18344e
  class RES,NET,UAMI managed
  class PE,CMK,KV,LOG,DES,ANF conditional

There are three identity layers: user Entra ID/RBAC, customer UAMIs for data/image access, and Discovery service principals/internal managed identities for MRG operations. Do not say every Azure call uses one UAMI. Workspace and Supercomputer cluster-identity bindings are documented as immutable after creation; kubelet/workload identities have separate update paths.R02

CMK means more than adding a Key Vault. Workspace/Bookshelf needs key references and a Log Analytics dedicated cluster; Supercomputer additionally needs a Disk Encryption Set. MMK↔CMK switching after creation is documented as unsupported. During rotation, update Workspace/Bookshelf references and the Supercomputer DES through their respective paths, and do not disable an old key until its dependents have been checked.R10

Separate these network controls:

The hardening articles include “zero public exposure” summaries alongside separate public-access/API-server conditions. Therefore inspect actual DNS, publicNetworkAccess, AKS API access profile, outboundType, Blob firewall, and model deployment type independently. The sample Bicep also combines NetworkIsolation=true with customer Storage networkAcls.defaultAction='Allow' and Preview Workbench defaults. Do not treat the sample as a completed security-hardening assessment.R08 R09 R12 R14 R18

7. Cross-service change and failure impacts

These are operational implications derived from documented dependencies, not failure-test results or SLA guarantees. Verify scope and probe each actual path.

Minimum post-change probes: basic agent call → KB search with actual citations → small tool run and readable output → Engine validation → stop/remaining-work/cost checks. Change managed resources only through supported Discovery procedures; do not independently delete, upgrade, or downsize MRG components.R04 R07 R10 R17 R19 R27

8. Inspect an actual deployment's versions/BOM

These are post-deployment examples for authorized read access. This section does not contain actual lookup results. Use actual IDs/MRG names; do not replace null or an access denial with “latest/absent.” Inspect the Workspace/Bookshelf/Supercomputer MRGs and any discovered node resource group separately.

Run the blocks in the same Bash session after setting the first block's variables. Replace every <...> placeholder; the examples do not use az account set to change the default subscription.

Inventory

SUBSCRIPTION_ID='<subscription-id>'
MRG='<actual-managed-resource-group>'
az resource list --subscription "$SUBSCRIPTION_ID" --resource-group "$MRG" \
  --query "[].{id:id,type:type,region:location,sku:sku.name,kind:kind}" \
  --output json

Follow up with the individual resource GET if the list omits SKU/details. Do not dump secrets, keys, or full connection strings.

Discovery model contract and effective Foundry deployments

CHAT_MODEL_ID='<actual-discovery-chatModelDeployment-resource-id>'
az resource show --subscription "$SUBSCRIPTION_ID" --ids "$CHAT_MODEL_ID" \
  --api-version 2026-06-01 \
  --query "{name:name,model:properties.modelName,revision:properties.modelVersion,sku:properties.skuName,capacity:properties.capacity}" \
  --output json

FOUNDRY_NAME='<actual-managed-foundry-account-name>'
az cognitiveservices account deployment list \
  --subscription "$SUBSCRIPTION_ID" --resource-group "$MRG" --name "$FOUNDRY_NAME" \
  --query "[].{name:name,model:properties.model.name,revision:properties.model.version,sku:sku.name,capacity:sku.capacity,upgradePolicy:properties.versionUpgradeOption}" \
  --output json

These inspect different resource representations. Include the automatically provisioned cognition deployment in the actual inventory. An exposed modelVersion property does not authorize arbitrary customer changes to every service-managed model revision.R13 R19 R20 R23

AKS and node pools

AKS_RG='<actual-aks-resource-group>'
AKS_NAME='<actual-aks-cluster-name>'
az aks show --subscription "$SUBSCRIPTION_ID" --resource-group "$AKS_RG" --name "$AKS_NAME" \
  --query "{requestedVersion:kubernetesVersion,runningVersion:currentKubernetesVersion,nodeResourceGroup:nodeResourceGroup}" \
  --output json

az aks nodepool list --subscription "$SUBSCRIPTION_ID" \
  --resource-group "$AKS_RG" --cluster-name "$AKS_NAME" \
  --query "[].{name:name,requestedVersion:orchestratorVersion,runningVersion:currentOrchestratorVersion,nodeImage:nodeImageVersion,vmSize:vmSize}" \
  --output json

Pool metadata alone does not prove every node is identical during a rolling upgrade. Where necessary, an authorized operator verifies per-node runtime/image/driver state. No cluster-admin credential retrieval or upgrade command is included here.R21 R22

Record in the final BOM: Observation time/resource IDs; effective model revisions and policies; Kubernetes/node images; SKUs/capacity; image digests/tool libraries; CMK keyVersion/DES/log bindings; network/identity bindings. Internal service versions not exposed through authorized reads remain questions for Microsoft support/service owners.

9. Sources and evidence boundary

API/model/SKU values were checked against these sources. Examples/recommendations, supported contracts, and actual deployment observations are distinguished. Structure, diagram topology, and row IDs match the Korean edition.