Azure Government IL6: AI Inference in Air-Gapped Environments

On February 26, 2025, Microsoft announced general availability of AI inference capabilities in Azure Government Secret (Impact Level 6). This is the first time production-grade large language models can run on classified networks without internet connectivity or external training data flows.

If you work in defense, intelligence, or classified systems, this matters. Here's why—and how to evaluate whether IL6 AI is right for your organization.

What Is Azure Government IL6?

Azure Government is a physically isolated cloud environment built exclusively for U.S. federal, state, and local governments and their partners. It operates in datacenters separate from commercial Azure, with strict access controls and compliance certifications.

Impact Level 6 (IL6) is the classification tier authorized for Secret-level workloads. This includes:

• National security systems
• Intelligence community operations
• Defense mission-critical applications
• Classified R&D programs
• Strategic planning and analysis systems

IL6 environments are air-gapped. Data does not flow to or from the public internet. Personnel access is restricted to U.S. citizens with appropriate clearances and need-to-know. All systems are FedRAMP High authorized and DISA Impact Level 6 compliant.

Until now, running AI in these environments meant one of two approaches:

1. Build your own models from scratch (expensive, time-intensive, requires ML expertise)
2. Settle for rule-based systems (brittle, limited, require constant manual updates)

Neither was ideal. The new IL6 AI inference capability changes that.

What "Inference-Only" Means (And Why It Matters)

Let's clarify terminology, because this distinction is critical.

Training: The process of building an AI model by feeding it massive datasets and iteratively adjusting parameters to improve predictions. Training requires data to flow through the model during development. This is where data leakage risks exist.

Inference: The process of using a pre-trained model to generate predictions, answers, or outputs based on new inputs. The model itself is static. No training data is required. No updates flow back to the model provider.

Azure Government IL6 supports inference only. You get access to pre-trained models—currently GPT-4, GPT-4o, and embedding models—hosted entirely within the air-gapped IL6 environment. Your classified data never leaves your enclave. Microsoft does not see it. The model does not learn from it. No telemetry flows externally.

This is fundamentally different from commercial AI services, where user inputs are often logged, analyzed, and used to improve models over time. In IL6, that cannot happen by design.

What AI Capabilities Are Available in IL6?

As of February 2025, the following models are available for deployment in Azure Government Secret regions:

Large Language Models (LLMs)

• GPT-4 Turbo: Text generation, summarization, analysis, Q&A, document understanding
• GPT-4o: Multimodal capabilities (text, image, structured data), faster inference, optimized for complex reasoning

Embedding Models

• text-embedding-3-large: High-dimensional vector embeddings for semantic search, document retrieval, and similarity analysis
• text-embedding-3-small: Lightweight embeddings for resource-constrained deployments

Deployment Options

• Azure OpenAI Service (IL6): Fully managed inference endpoints with Azure-native integrations (Key Vault, Private Link, Managed Identity)
• Azure Container Instances: Custom containerized deployments for fine-tuned or specialized models (subject to approval)

Not currently available:

• Model fine-tuning (requires training, which is prohibited in IL6)
• Real-time learning or adaptive models
• Open-source LLMs (Llama, Mistral, etc.) unless pre-approved and hosted by Microsoft
• Image generation models (DALL-E, Stable Diffusion)

If you need capabilities beyond what's offered, you'll need to work with Microsoft and your authorizing official to evaluate whether a custom deployment is feasible and compliant.

Use Cases: Where IL6 AI Makes Sense

I've been evaluating IL6 AI deployment scenarios with defense clients since the preview launched in Q4 2024. Here are the use cases where it delivers immediate value:

1. Intelligence Analysis and Summarization

Problem: Analysts manually review thousands of classified reports, signals intelligence (SIGINT) logs, and operational briefings. Correlation across sources is slow. Insights are delayed.

IL6 AI Solution: Deploy GPT-4 Turbo with Retrieval-Augmented Generation (RAG) to:

• Summarize multi-source intelligence into executive briefings
• Identify anomalies across SIGINT and HUMINT data
• Generate natural-language queries against classified databases
• Cross-reference threat indicators in real-time

Result: Analysts spend less time reading, more time acting. Decision timelines compress from hours to minutes.

2. Classified Document Search and Retrieval

Problem: Classified knowledge bases (SharePoint, Confluence, file shares) are siloed and difficult to search. Keyword-based retrieval misses semantic relationships. Finding the right document takes too long.

IL6 AI Solution: Use embedding models to:

• Convert all documents into vector embeddings
• Store embeddings in Azure Cognitive Search (IL6)
• Enable semantic search: "Find all contractor agreements related to hypersonic weapons programs in FY23-24"

Result: Users find relevant documents in seconds, even when exact terminology varies across sources.

3. Automated Report Generation

Problem: Operational reports (SITREPS, intelligence summaries, readiness assessments) follow standard templates but require manual compilation from multiple systems. This is repetitive and error-prone.

IL6 AI Solution: Connect GPT-4 to classified databases via secure APIs:

• Fetch latest data (inventory levels, troop deployments, threat indicators)
• Populate report templates automatically
• Generate natural-language summaries with citations

Result: Reports are generated in minutes instead of hours. Human oversight remains, but the grunt work is automated.

4. Conversational Interfaces for Mission Systems

Problem: Legacy classified systems have command-line or GUI interfaces that require specialized training. New personnel face steep learning curves. Errors are common.

IL6 AI Solution: Build a conversational agent (chatbot) that:

• Translates natural-language queries into system commands
• Provides contextual help and troubleshooting
• Guides users through complex workflows

Result: Operators can interact with mission systems using plain language. Training time decreases. Operational errors drop.

5. Code and Script Analysis

Problem: Classified systems include custom scripts, infrastructure-as-code (IaC), and legacy codebases. Understanding what code does—especially undocumented legacy systems—is time-consuming.

IL6 AI Solution: Use GPT-4 to:

• Analyze PowerShell, Python, or Terraform scripts
• Generate documentation for undocumented code
• Identify security vulnerabilities or compliance violations

Result: Faster onboarding for new developers. Better visibility into what your classified infrastructure is actually doing.

Limitations and Constraints

IL6 AI inference is powerful, but it's not a magic bullet. Here are the constraints you need to understand upfront:

1. No Fine-Tuning

You cannot fine-tune models on classified data within IL6. Fine-tuning requires training, which violates the air-gapped design.

Workaround: Use Retrieval-Augmented Generation (RAG). Instead of training the model on your data, embed your data as vectors and inject relevant context into prompts at inference time. This achieves similar results without training.

2. No Model Updates Without Approval

New model versions (e.g., GPT-5, future updates) will not automatically roll out to IL6. Each new model requires a separate security review and authorization process.

Implication: You may be running older model versions compared to commercial Azure. Plan for lag time between commercial releases and IL6 availability.

3. Limited Multimodal Support

As of February 2025, GPT-4o supports text and image inputs. Video, audio, and real-time speech are not yet available in IL6.

Implication: If your use case requires video analysis or speech-to-text on classified audio, you'll need alternative solutions (e.g., Azure Speech Service in IL5, with appropriate data handling).

4. No External Integrations

IL6 AI cannot call external APIs, connect to public internet services, or integrate with SaaS tools. All integrations must occur within the IL6 boundary.

Implication: If you need to pull data from external threat intelligence feeds or commercial tools, you'll need to ingest that data into IL6 first through approved cross-domain solutions (CDS).

5. U.S. Personnel and Clearance Requirements

All personnel with access to IL6 environments must be U.S. citizens with active Secret clearances and documented need-to-know. Microsoft support staff who can access IL6 infrastructure are similarly vetted.

Implication: Offshore contractors, third-party vendors, and foreign national employees cannot support IL6 AI deployments.

Procurement and Authorization Pathway

Getting IL6 AI into production isn't as simple as signing up for a commercial Azure account. Here's the process:

Step 1: Validate Your Eligibility

You need:

• An active DoD, Intelligence Community, or federal agency contract requiring Secret-level cloud services
• A Mission Owner with authorization to operate (ATO) classified workloads in Azure Government
• A FedRAMP High or DISA IL6 authorization package (or willingness to pursue one)

If you're a defense contractor, you'll need sponsorship from your government customer. You cannot self-authorize IL6 access.

Step 2: Engage Microsoft Azure Government Sales

Azure Government is a managed service with restricted access. You must work with Microsoft's Federal sales team to:

• Complete the Azure Government onboarding process
• Sign appropriate contract vehicles (GSA, SEWP, DoD ESI)
• Establish identity and access controls (Azure AD Government tenancy)

Timeline: 4-8 weeks for initial onboarding, depending on your organization's existing relationship with Microsoft.

Step 3: Design Your IL6 AI Architecture

Work with Microsoft or a certified Azure Government partner to:

• Define your AI use cases and data flows
• Design network topology (VNets, Private Link, ExpressRoute)
• Establish data residency and classification boundaries
• Map integrations with existing IL6 systems

Timeline: 2-6 weeks, depending on complexity.

Step 4: Obtain Authorization to Operate (ATO)

Your Authorizing Official (AO) must approve the AI system for classified operations. This requires:

• A System Security Plan (SSP) documenting controls
• Risk assessment and mitigation strategy
• Continuous monitoring plan

If you're already operating in IL6, you may be able to amend your existing ATO. If not, budget 3-6 months for initial authorization.

Step 5: Deploy and Validate

Once authorized:

• Provision Azure OpenAI Service (IL6) resources
• Configure endpoints, access controls, and logging
• Test inference performance and accuracy
• Train users and document operational procedures

Timeline: 2-4 weeks for initial deployment.

Pricing and Cost Considerations

Azure Government IL6 AI services are priced higher than commercial Azure due to infrastructure isolation, compliance overhead, and restricted access.

Typical pricing (as of Feb 2025):

• GPT-4 Turbo inference: ~$0.03 per 1K input tokens, ~$0.06 per 1K output tokens
• GPT-4o inference: ~$0.025 per 1K input tokens, ~$0.05 per 1K output tokens
• Embedding models: ~$0.0002 per 1K tokens

Additional costs:

• Azure OpenAI Service deployment: ~$2,000-$5,000/month base hosting fee
• Data ingress/egress (via ExpressRoute or cross-domain solutions): Variable
• Azure Cognitive Search (for RAG): ~$500-$2,000/month depending on index size

Budget planning:

• Small pilot (1-2 use cases, <10 users): $10K-$25K initial setup + $3K-$8K/month operational
• Production deployment (multiple use cases, 50+ users): $50K-$150K initial + $15K-$40K/month operational

These are ballpark figures. Actual costs depend on usage volume, data storage, and integration complexity.

My Recommendation: Start Small, Scale Strategically

If you're evaluating IL6 AI for your organization, here's how I'd approach it:

Phase 1: Proof of Concept (3-6 months)

• Pick one high-value, low-risk use case (e.g., document search or report summarization)
• Deploy in a controlled IL6 sandbox environment
• Measure performance, accuracy, and user adoption
• Document lessons learned and operational requirements

Phase 2: Pilot Expansion (6-12 months)

• Expand to 2-3 additional use cases
• Integrate with existing IL6 systems (databases, file shares)
• Establish governance model (who can deploy AI, how prompts are reviewed)
• Train users and build internal AI literacy

Phase 3: Enterprise Rollout (12-24 months)

• Productionize successful pilots
• Establish centralized AI platform team
• Implement monitoring, logging, and compliance reporting
• Scale to additional missions and user groups

Don't try to boil the ocean. IL6 AI is new. The model selection is limited. Start with use cases where inference-only models deliver clear value, and expand as the platform matures.

Final Thoughts

Azure Government IL6 AI inference is a meaningful step forward for classified computing. For the first time, defense and intelligence organizations can leverage state-of-the-art LLMs without compromising data isolation or security posture.

But it's not a drop-in replacement for every AI use case. The constraints are real. Fine-tuning is off the table. Model selection is limited. Procurement takes time.

If you have classified workflows that would benefit from document understanding, semantic search, summarization, or conversational interfaces—and you can work within the inference-only model—this is worth serious evaluation.

If you need real-time model updates, custom fine-tuning, or bleeding-edge multimodal capabilities, you'll need to wait or pursue alternative approaches.

I'm actively working with defense clients to assess IL6 AI feasibility for mission systems. The use cases are compelling. The technology is solid. The authorization process is well-defined.

The question isn't whether IL6 AI will see adoption. It will. The question is whether your organization is ready to move first—and capture the operational advantage.

Amyn Porbanderwala is Director of Innovation at Navaide, where he leads AI strategy and classified systems integration for defense clients. He spent 8 years in the Marine Corps as a Cyber Network Operator and specializes in Azure Government, FedRAMP, and DoD cloud architectures.

Evaluating IL6 AI for your organization? Let's talk.