Connect your Google Vertex AI#

DCAI Model Gateway can send requests to Gemini and the other models you use in Google Vertex AI, in your own Google Cloud project. No key is created or shared. Your own Microsoft Entra tenant issues a short-lived token to the DCA Model Gateway Connector; the gateway exchanges it at Google for a short-lived token of a workload identity pool that you control, and Vertex AI checks your IAM policy on every call. Your provider trusts only tokens from your tenant, so no other organization's connection can reach your project, even one that names your project, pool and provider.

Your project's model usage is billed by Google on your own billing account. DCAI Model Gateway bills its plan and routed tokens through Microsoft Marketplace, the same as with an Azure AI Foundry connection.

What works today#

Step 1: add the connector to your tenant#

Google will trust only tokens that your Microsoft Entra tenant issues to the DCA Model Gateway Connector, so the connector must exist in your tenant. It holds no secrets: only DCAI Model Gateway can act as it. This needs an administrator who may add enterprise applications (Global Administrator, Application Administrator or Cloud Application Administrator).

• Admin consent link. On the portal's Connect your Foundry page, Google Vertex AI tab, select Grant admin consent and accept for your organization. You come back to the page with a confirmation.

• Azure CLI (for example in Azure Cloud Shell):

  bashCopy ⧉

  az ad sp create --id 7154fd27-4506-4cd5-8e3a-b2e5208d0846

If you already connected an Azure AI Foundry, the connector is in your tenant already.

Step 2: let the connector call Vertex AI in your project#

Run once, as someone who can manage IAM in the project (Owner, or Role Administrator, Workload Identity Pool Admin and Project IAM Admin), for example in Cloud Shell. TENANT_ID is your Microsoft Entra tenant: the tenant of the Marketplace subscription, shown on the portal's Connect page. PROVIDER_ID is also shown there: dca-gateway- followed by the first eight characters of your subscription's id. The gateway accepts no other provider name for that subscription, so creating the provider is how your project admits exactly this subscription; another subscription of your organisation needs its own. The last two commands grant a custom role with one permission, aiplatform.endpoints.predict: the gateway can call models and nothing else.

PROJECT_ID=your-project-id
TENANT_ID=your-entra-tenant-id
PROVIDER_ID=dca-gateway-xxxxxxxx      # from the Connect page
PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format='value(projectNumber)')
gcloud services enable aiplatform.googleapis.com sts.googleapis.com iamcredentials.googleapis.com --project $PROJECT_ID
gcloud iam workload-identity-pools create dca-model-gateway --project $PROJECT_ID --location global \
  --display-name "DCA Model Gateway"
gcloud iam workload-identity-pools providers create-oidc $PROVIDER_ID --project $PROJECT_ID --location global \
  --workload-identity-pool dca-model-gateway \
  --issuer-uri "https://sts.windows.net/$TENANT_ID/" \
  --allowed-audiences "api://7154fd27-4506-4cd5-8e3a-b2e5208d0846" \
  --attribute-mapping "google.subject=assertion.appid" \
  --attribute-condition "assertion.appid == '7154fd27-4506-4cd5-8e3a-b2e5208d0846' && assertion.tid == '$TENANT_ID'"
gcloud iam roles create dcaModelGatewayInference --project $PROJECT_ID --title "DCA Model Gateway Inference" \
  --permissions aiplatform.endpoints.predict --stage GA
gcloud projects add-iam-policy-binding $PROJECT_ID --role projects/$PROJECT_ID/roles/dcaModelGatewayInference \
  --member "principal://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/dca-model-gateway/subject/7154fd27-4506-4cd5-8e3a-b2e5208d0846"

The built-in Vertex AI User role (roles/aiplatform.user) also works, but it allows much more than calling models.

What these values are:

Gemini and the managed open-weight models (ids ending in -maas, such as the ones listed above) work as soon as the Vertex AI API is enabled. Llama needs its license accepted in Model Garden first; Mistral models use a different Vertex AI API that the gateway does not call yet. Not every model is offered in every location: the open-weight models above are offered in global; Llama 4 Maverick only in us-east5. For the United States boundary, openai/gpt-oss-120b-maas is offered in us-central1 and the Qwen3 model in us-south1, not in the us multi-region that newer Gemini models need. A route can therefore name its own location (see step 3). If your organization restricts workload identity providers (constraints/iam.workloadIdentityPoolProviders), allow the issuer https://sts.windows.net/<your tenant>/.

Set up before October 18, 2026?#

Earlier versions of this guide had a provider named dca-gateway trust DCAI's tenant and the gateway's managed identity. The gateway no longer presents that token and now accepts only the provider named after your subscription, so that setup no longer works for anyone. Create the new provider, bind it, and remove the old binding (the old provider can be deleted):

gcloud iam workload-identity-pools providers create-oidc $PROVIDER_ID --project $PROJECT_ID --location global \
  --workload-identity-pool dca-model-gateway --issuer-uri "https://sts.windows.net/$TENANT_ID/" --allowed-audiences "api://7154fd27-4506-4cd5-8e3a-b2e5208d0846" \
  --attribute-mapping "google.subject=assertion.appid" \
  --attribute-condition "assertion.appid == '7154fd27-4506-4cd5-8e3a-b2e5208d0846' && assertion.tid == '$TENANT_ID'"
gcloud projects add-iam-policy-binding $PROJECT_ID --role projects/$PROJECT_ID/roles/dcaModelGatewayInference \
  --member "principal://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/dca-model-gateway/subject/7154fd27-4506-4cd5-8e3a-b2e5208d0846"
gcloud projects remove-iam-policy-binding $PROJECT_ID --role projects/$PROJECT_ID/roles/dcaModelGatewayInference \
  --member "principal://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/dca-model-gateway/subject/d1567b77-2a75-49a5-9c0b-2593c8a6488a"

Step 3: connect it on the portal#

1. Open saas.dcassociatesgroup.com, Subscriptions, the subscription's menu, Connect your Foundry, then the Google Vertex AI tab.
2. Enter the project ID and project number. Keep the pool ID from step 2 (dca-model-gateway); the provider ID is fixed for the subscription.
3. Location: global (Google may process the request in any location), the us or eu multi-region, or a region. United States location (optional): us or a US region, used for requests with x-dca-data-boundary: us. Newer Gemini models are offered in global and the multi-regions, not in single regions.
4. Map at least the default route to a Vertex AI model id, for example google/gemini-3.8-flash. A bare Gemini name gets google/ added. A model offered only in a region can carry its own location, location:publisher/model: for example us-east5:meta/llama-4-maverick-17b-128e-instruct-maas on the oss-only route goes to us-east5 while the other routes stay in the connection's location. In the column for the United States boundary, only United States locations are accepted (us-central1:openai/gpt-oss-120b-maas), and a request is never sent outside the United States. Map embeddings to an embedding model such as google/gemini-embedding-001 (offered in global and single regions, not in the us/eu multi-regions: for embeddings under the United States boundary, use a US region such as us-central1 as the United States location). Models for the United States boundary go in the last column.
5. Select Save and test. Every mapped route is called once through the gateway with your own key.

Use it#

Nothing changes in your applications: call https://ai-gateway-east-us1.azure-api.net/gateway/openai/v1 with your gateway key, as in Getting started. Name a model ("model": "google/gemini-3.8-flash"), or pick a route with x-dca-route. Responses carry x-dca-backend: customer-vertex.

Gemini's "thinking" tokens are part of the token count Google reports, so they count as routed tokens. Gemini models are billed on the frontier tier; open models such as Gemma or Llama on the open-weight tier. See Limits and billing.

Change, disconnect, revoke#

• Change: edit the page and select Save and test. A connection is either Azure AI Foundry or Vertex AI; saving one replaces the other.
• Disconnect on the portal stops the gateway at once (409 foundry_not_connected); Reconnect resumes it.
• In your project: remove the role binding (in our tests the gateway was refused about a minute later; Google allows up to seven), or disable the pool. Disabling or deleting only the provider stops new token exchanges, but tokens already issued stay valid until they expire; the gateway exchanges again at least every five minutes, so it loses access within about five minutes.
• In your Microsoft Entra tenant: disabling or deleting the DCA Model Gateway Connector's enterprise application also stops new token exchanges, within about five minutes. With x-dca-data-boundary: us, a connection without a United States location is refused, never sent to the global endpoint.

Errors you may see#