Hugging Face Models on Foundry Managed Compute

At Microsoft Build 2026, we announced Foundry Managed Compute and Hugging Face models on Foundry — a curated catalog of open-weight models from the Hugging Face ecosystem, refreshed weekly, deployable in one click onto Foundry Managed Compute. Weights are pre-staged in Azure, runtimes are built and scanned by Microsoft, and every model in the Collection ships with the same enterprise security, governance, observability, and billing that applies to every other model on Foundry.

The Platform: Microsoft Foundry and Managed Compute

Microsoft Foundry is a platform for building and operating agentic AI applications. Foundry starts with the widest model selection on any cloud — models from Microsoft, OpenAI, Anthropic, Meta, Mistral, DeepSeek, Hugging Face, and others, spanning frontier, open-source, and custom weights — all accessible through a single endpoint and a single set of SDKs in Python, C#, JavaScript, and Java.

On top of those models sits the Foundry Agent Service: multi-agent orchestration with built-in memory, knowledge grounding through Foundry IQ, and a catalog of connectable tools via agentic protocols, so agents can work with enterprise data. Once agents are running, Foundry provides end-to-end tracing, real-time monitoring, continuous evaluations, and a prompt optimizer that improves agent behavior based on eval results — observability and quality loops that are part of the platform.

Alongside that, developers get access to:

• Content safety filters
• Task-adherence guardrails
• An AI Red Teaming Agent for adversarial testing
• Unified RBAC
• Private networking
• Azure Policy integration directly within the platform

Alongside pay-per-token (lowest-friction path to get started) and provisioned throughput (predictable, high-performance production workloads on frontier models), Foundry Managed Compute is the third deployment option in Foundry: a managed GPU platform-as-a-service for open-source and custom models.

You deploy a model instance described by the things that matter to your workload — parameter count, context length, and whether you want to optimize for latency or throughput — and Foundry handles the GPU topology underneath, whether the instance lands on one accelerator or several, so you think and plan in model terms.

Microsoft takes care of the machine: container updates, runtime upgrades, and security patches happen automatically on the supported runtimes — vLLM, SGLang, TensorRT-LLM, NIM, TEI, llama.cpp — without redeploying your model, while model configuration, deployment behavior, and routing stay with you.

That consistency carries through the developer surface — pay-per-token, provisioned throughput, and Managed Compute share:

• A single endpoint
• The same SDKs
• The same authentication
• The same observability
• A single bill

Open-source models integrate with Foundry Agents the same way frontier models do, so you can mix model types in a single agent without a separate integration path.

Managed Compute offers:

• Global deployments — broadest capacity and best pricing
• Data Zone deployments — residency and sovereignty

Same code, same workflow. Quota is aligned to accelerator families, so a plan built on the H100 family today carries forward as new hardware generations come online.

Why Hugging Face

Hugging Face is the public square of open AI: 15 million builders, 400,000 organizations, and over 3 million open models published, with new frontier capabilities — agentic coding, video segmentation, speech, embeddings — landing weekly. It’s the GitHub of open models, where the community publishes weights, writes model cards, compares evaluations, and pulls models for experimentation.

Open models have closed the gap with proprietary models on benchmark after benchmark, and they unlock things proprietary endpoints can’t:

• State-of-the-art is now open. Leading open-weight models are competitive with the top closed frontier models on the most widely used benchmarks.
• Deep customization. Full weights make it possible to fine-tune, distill, quantize, and adapt with LoRA — tailoring models to your domain, your data, and your latency and cost targets.
• Your model, your hosting. Weights run in your tenant on infrastructure you control, behind your inference endpoint, with your identity and network boundaries.
• Cost shaping. Pay for accelerators by the hour, scale to zero when idle, and right-size GPUs to the specific model — useful for steady, high-volume, or latency-sensitive workloads where per-token pricing is harder to predict.
• Version control. Pin a specific model version, evaluate it, deploy it, and move forward or roll back on your own release cadence.

The catch has always been the operational layer: discovery, license review, security screening, runtime selection, GPU sizing, image building, CVE patching, and standing the model up behind an enterprise-grade endpoint. Hugging Face, by itself, is not an enterprise serving platform. Hugging Face models on Foundry is that operational layer, run by Microsoft.

Hugging Face Models on Foundry

The Hugging Face Collection brings a curated subset of models directly into the Foundry Model Catalog:

• Refreshed weekly — trending models from the Hugging Face ecosystem are added continuously as the community publishes them.
• Every modality — text, vision, audio, and multimodal: LLMs and VLMs for chat and agents, ASR and speech translation, embeddings, segmentation, image generation.
• Safetensors only, no untrusted code — every model in the Collection is security-screened and ships in the SafeTensors weight format, with no trust_remote_code execution paths unless rigorously reviewed.
• The right runtime for the model — vLLM and SGLang for LLMs, TensorRT-LLM and NIM where applicable, TEI for embeddings, llama.cpp for CPU — Foundry picks the engine that matches the model.

From your side, an open-weight model in the Hugging Face Collection looks and behaves like any other model in the Foundry Model Catalog, and every model in the Collection has been put through a multi-stage publishing pipeline before it ever shows up there.

The Curation Pipeline

Hugging Face and Microsoft work together to bring the most popular open-weight models from the Hugging Face ecosystem to Microsoft Foundry — production-ready for enterprise environments — through a systematic curation process:

1. Identify trending models in the Hugging Face ecosystem — based on community signals, partner requests, and customer demand — and select candidates for enterprise readiness.
2. Screen for compliance and security — model licenses are reviewed against Microsoft’s enterprise distribution policy (with license metadata captured and preserved on the catalog model card), and repositories are inspected for trust_remote_code patterns and custom executable code; any model that would require executing third-party Python at load time is either remediated or excluded.
3. Build, scan, and publish runtimes — Microsoft builds inference container images on supported runtimes (vLLM, SGLang, TensorRT-LLM, NIM, TEI, llama.cpp), scans them for CVEs, and signs and publishes them to a Microsoft-managed container registry.
4. Upload weights to secure Azure storage — model weights are pulled from Hugging Face once, validated against the published model card, and stored in Microsoft-managed Azure storage in the regions where the model is served.
5. Validate and publish to the catalog — every model + runtime + accelerator combination is tested for API conformance (chat completions, embeddings, rerank, etc.) and performance (latency, throughput, time-to-first-token, inter-token decode time), then the validated model — with its templates, runtime images, and weights — is published to the Foundry Model Catalog with a one-click deploy path onto Managed Compute.

Because weights are pre-staged in Azure storage and runtime images live in a Microsoft-managed registry, your deployments won’t need outbound network access to Hugging Face Hub — you can deploy to production inside a private network.

Model Runtimes

Hugging Face models on Foundry are powered by a versatile collection of community-built, open-source inference runtimes — each selected and tuned for Foundry Managed Compute, and matched to the model architectures it serves best. Across all runtimes, the systematic curation process means new versions and patches land on Foundry quickly, and existing model deployments are upgraded automatically — without requiring you to redeploy.

• vLLM — the default high-throughput serving engine for open large language models, tuned for production GPU workloads. Because Hugging Face is a direct contributor to vLLM, any model in the Transformers library can run on vLLM out of the box — so when a new model lands on Hugging Face, it can be served on Foundry the same day, with no waiting on a custom integration.

• SGLang — a serving engine for language and multi-modal models, with strong support for structured outputs (JSON, regex, grammar-constrained generation) that agentic and tool-using workloads depend on. Hugging Face and the SGLang team have built a Transformers backend integration for SGLang, so any model in the Transformers library runs on SGLang out of the box — and reaches Foundry the same day it lands on Hugging Face.

• Text Embeddings Inference (TEI) — the runtime for embedding, reranker, and sequence-classification models. Accelerator-specific images ship with kernels compiled for each GPU and CPU family Foundry supports, keeping the embedding hot path lean for RAG and semantic-search workloads.

• llama.cpp — the CPU and small-GPU path for GGUF-quantized models. Useful for cost-optimized deployments, smaller models, and CPU-only regions, with the same OpenAI-compatible API as vLLM and SGLang.

• TensorRT-LLM and NIM — used on NVIDIA hardware where NVIDIA’s optimized kernels and Triton-based serving deliver meaningfully better latency or throughput for specific model families.

• hf-serve — Hugging Face’s own multi-model inference server, used for model architectures outside the LLM and embedding fast paths (vision, audio, segmentation, and other Transformers-native pipelines) so the Collection can cover every modality with a consistent serving layer.

Deploying and Scoring an Open-Weight Model

The Hugging Face Collection in the Foundry Model Catalog is where you start, and deployment is five steps:

1. Browse the catalog and pick a model — the deploy wizard also surfaces the model id, deployment template id, and acceleratorType you’ll need if you’re scripting the deploy via SDK or REST.
2. Choose a deployment template — latency- vs throughput-optimized, accelerator family, context length, quantization.
3. Configure instance count — scale throughput by adding model instances.
4. Deploy — from the portal, CLI, SDK, or REST.
5. Score via the unified Foundry endpoint with the SDK you already use.

Deployment Templates

A deployment template is the unit of choice in step 2: a named, versioned asset that pins the runtime, the accelerator family and count, the context length, and the runtime-specific tuning needed to serve the model well — so picking a template is the only knob you turn for “how do I want this model to run.”

qwen3-32b, for example, ships with four templates the deploy wizard exposes side by side:

Each template arrives pre-tuned for the model — runtime settings, tool-call and reasoning parsers, scoring path, health probes, request concurrency, and any model-specific context-extension settings are all set by Microsoft, with any trade-offs called out inline in the template description. When you script the deploy, you reference the template and Foundry handles the rest.

Deploy — Python SDK

from azure.identity import DefaultAzureCredential
from azure.mgmt.cognitiveservices import CognitiveServicesManagementClient

client = CognitiveServicesManagementClient(DefaultAzureCredential(), SUBSCRIPTION_ID)

deployment = client.managed_compute_deployments.begin_create_or_update(
    resource_group_name=RESOURCE_GROUP,
    account_name=ACCOUNT_NAME,
    deployment_name="qwen3-32b",
    resource={
        "sku": {"name": "GlobalManagedCompute", "capacity": 1},
        "properties": {
            "model": "azureml://registries/azure-huggingface/models/qwen--qwen3-32b/versions/1",
            "deploymentTemplate": "azureml://registries/azure-huggingface/deploymenttemplates/qwen--qwen3-32b--40k-nvidia-h100/labels/latest",
            "acceleratorType": "H100_80GB",
        },
    },
).result()

Score — OpenAI SDK

The deployment is reachable through the unified Foundry endpoint with the OpenAI SDK — the `model` field takes the deployment name you just created:

from openai import OpenAI

api_key  = client.accounts.list_keys(RESOURCE_GROUP, ACCOUNT_NAME).key1
endpoint = f"https://{ACCOUNT_NAME}.services.ai.azure.com/openai/v1"

openai_client = OpenAI(base_url=endpoint, api_key=api_key)

completion = openai_client.chat.completions.create(
    model=deployment.name,
    messages=[{"role": "user", "content": "What is the capital of France?"}],
)

print(completion.choices[0].message)

Use It in an Agent

A chat-completions model from the Collection slots into Foundry Agents as an admin-connected model and is callable through the Foundry Responses API with the same OpenAI SDK — same auth, same endpoint, same observability.

What’s Available Today

Available now in preview: the Hugging Face Collection in the Microsoft Foundry Model Catalog — thousands of models across every modality, refreshed weekly, deployable onto Foundry Managed Compute with NVIDIA A100, NVIDIA H100, or AMD MI300X accelerators in Global and Data Zone scopes, behind a unified Foundry endpoint with Playground support, first-class Azure Monitor metrics, per-deployment billing tags, and curated runtime upgrades and CVE patching applied automatically to your deployments.

On the roadmap: broader coverage of the Hugging Face ecosystem, additional accelerator families, and Bring Your Own Weights for fine-tuned and proprietary variants deployed through the same templates and governance as Collection models.

Hugging Face is where open models are published and discovered. Microsoft Foundry is where enterprises operationalize them — on curated, license-screened, security-screened weights hosted in Azure; on community-built and CVE-scanned runtimes; behind a single endpoint with enterprise identity, networking, observability, and agent integration on top. The breadth of the open-source ecosystem, with the operational layer Microsoft runs underneath. For a deep dive on Foundry Managed Compute — pricing, accelerator SKUs, data residency, enterprise readiness, observability, and the full Responses API + memory pattern — see the Managed Compute launch blog.