Step 3: Create the Azure OpenAI Resource (in the Right Region)

Once approval comes through, you'll get an email from Microsoft. Now comes the decisive click: the region.

Azure OpenAI is available in many regions -- East US, West Europe, Sweden Central, Switzerland North, and others. For German SMBs with GDPR requirements:

In the portal: Create a resource → Azure OpenAI → Sweden Central. Assign a resource name (e.g. "kiba-prod-sweden") and choose pricing tier "Standard S0."

Before the final "Create," there's a "Networking" tab. If you want to be really tight, restrict access here -- limit to your own IPs or a Private Endpoint. For starters, "All networks" with the firewall enabled is enough; you can tighten it later.

Step 4: Enable EU Data Boundary

This is the click that separates "GDPR sort of" from "GDPR clean."

Microsoft introduced the EU Data Boundary in 2024: a guarantee that certain data never leaves the EU -- not even for transient processing such as content safety checks. It's not active by default. You have to switch it on.

In the Azure portal → your OpenAI resource → Settings → Data Boundary. Tick "Enable EU Data Boundary." Save.

What changes: even the safety checks (Content Safety) that OpenAI normally runs asynchronously in the US now run inside the EU. Latency goes up by roughly 50 ms. Your data protection posture improves significantly.

Practical tip: take a screenshot of the enabled setting and file it in your DPIA documentation. That's your evidence.

Step 5: Model Deployment

Unlike using OpenAI directly: in Azure, every model you want to use has to be "deployed" individually. That's a second step after the resource is created.

Inside the OpenAI resource: Resource Management → Model deployments → Manage deployments → Create new deployment.

Recommendation for the standard case:

For "Deployment Type," pick Standard to start. Provisioned is for high-load use cases that need guaranteed capacity -- you don't need it unless you're running hundreds of requests per second.

For "Tokens per Minute Rate Limit," set a sensible value for each deployment. The default is high. Reduce it to what you actually need during the pilot -- that protects you from surprises if a script goes off the rails.

Step 6: First API Call

Now the smoke test. In the OpenAI resource: Resource Management → Keys and Endpoint. You need two values:

Endpoint -- looks like https://kiba-prod-sweden.openai.azure.com/

Key 1 -- a long hex string

Test it from the terminal:

curl https://kiba-prod-sweden.openai.azure.com/openai/deployments/gpt-4o-mini/chat/completions?api-version=2024-08-01-preview \
  -H "api-key: YOUR_KEY_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "messages": [
      {"role": "user", "content": "Reply with OK"}
    ]
  }'

If you get a response containing "OK," your setup is done. If 401: wrong key. If 404: wrong deployment name or endpoint (a common mistake -- the deployment name has to match exactly). If 429: rate limit set too low.

What to Put in the DPIA Documentation

Three Common Pitfalls

Wrong region. The most common mistake: East US as the region, EU Data Boundary enabled, and the data protection officer says no anyway. EU Data Boundary only takes effect with an EU region. Sweden Central is mandatory for German compliance.

API version hell. Azure OpenAI carries version strings in the URL ("?api-version=2024-08-01-preview"). Use an old version and you're missing new features. Use one that's too new and you'll hit lingering bugs. Recommendation: check the current stable version in the docs.

Quota traps. Microsoft sets initial quotas conservatively. As your pilot grows, you'll need to request quota increases. That's another application process, taking one to three days. Plan for it.