aoai via entra quickstarts in powershell

Author: eric-urban

articles/ai-services/openai/includes/chatgpt-powershell.md

@@ -85,6 +85,9 @@ For the recommended keyless authentication with Microsoft Entra ID, you need to:
     return $response
    ```
 
+   > [!IMPORTANT]
+   > For production, use a secure way of storing and accessing your credentials like [The PowerShell Secret Management with Azure Key Vault](/powershell/utility-modules/secretmanagement/how-to/using-azure-keyvault). For more information about credential security, see the Azure AI services [security](../../security-features.md) article.
+
 1. Run the script using PowerShell. In this example, we're using the `-Depth` parameter to ensure that the output isn't truncated. 
 
    ```powershell

articles/ai-services/openai/includes/dall-e-powershell.md

@@ -2,11 +2,10 @@
 title: "Quickstart: Generate images with Azure OpenAI Service using PowerShell"
 titleSuffix: Azure OpenAI Service
 description: Learn how to generate images with Azure OpenAI Service by using PowerShell and the endpoint and access keys for your Azure OpenAI resource.
-#services: cognitive-services
 manager: nitinme
 ms.service: azure-ai-openai
 ms.topic: include
-ms.date: 08/29/2023
+ms.date: 3/21/2025
 ---
 
 Use this guide to get started calling the Azure OpenAI Service image generation APIs with PowerShell.
@@ -21,70 +20,79 @@ Use this guide to get started calling the Azure OpenAI Service image generation
 - An Azure OpenAI resource created in a supported region (see [Region availability](/azure/ai-services/openai/concepts/models#model-summary-table-and-region-availability)). For more information, see [Create a resource and deploy a model with Azure OpenAI](../how-to/create-resource.md).
 
 
-## Setup
+### Microsoft Entra ID prerequisites
 
-[!INCLUDE [get-key-endpoint](get-key-endpoint.md)]
+For the recommended keyless authentication with Microsoft Entra ID, you need to:
+- Install the [Azure CLI](/cli/azure/install-azure-cli) used for keyless authentication with Microsoft Entra ID.
+- Assign the `Cognitive Services User` role to your user account. You can assign roles in the Azure portal under **Access control (IAM)** > **Add role assignment**.
 
-[!INCLUDE [environment-variables](environment-variables.md)]
+## Retrieve resource information
 
+[!INCLUDE [resource authentication](resource-authentication.md)]
 
-## Generate images with DALL-E 2
+## Generate images
 
-1. Create a new PowerShell file named _quickstart.ps1_. Open the new file in your preferred editor or IDE.
+1. For the **recommended** keyless authentication with Microsoft Entra ID, sign in to Azure with the following command:
+
+    ```console
+    az login
+    ```
+
+1. Create a new PowerShell file called *quickstart.ps1*. Then open it up in your preferred editor or IDE.
 
 1. Replace the contents of _quickstart.ps1_ with the following code. Enter your endpoint URL and key in the appropriate fields. Change the value of `prompt` to your preferred text.
 
    ```powershell
-   # Azure OpenAI metadata variables
-   $openai = @{
-     api_key     = $Env:AZURE_OPENAI_API_KEY
-     api_base    = $Env:AZURE_OPENAI_ENDPOINT # your endpoint should look like the following https://YOUR_RESOURCE_NAME.openai.azure.com/
-     api_version = '2023-06-01-preview' # this may change in the future
-   }
-
-   # Text to describe image
-   $prompt = 'A painting of a dog'
-
-   # Header for authentication
-   $headers = [ordered]@{
-     'api-key' = $openai.api_key
-   }
-
-   # Adjust these values to fine-tune completions
-   $body = [ordered]@{
-      prompt = $prompt
-      size   = '1024x1024'
-      n      = 1
-   } | ConvertTo-Json
-
+    # Azure OpenAI metadata variables
+    $openai = @{
+        api_base    = $Env:AZURE_OPENAI_ENDPOINT 
+        api_version = '2023-06-01-preview' # This can change in the future.
+    }
+    
+    # Use the recommended keyless authentication via bearer token.
+    $headers = [ordered]@{
+        #'api-key' = $Env:AZURE_OPENAI_API_KEY
+        'Authorization' = "Bearer $($Env:DEFAULT_AZURE_CREDENTIAL_TOKEN)"
+    }
+    
+    # Text to describe image
+    $prompt = 'A painting of a dog'
+    
+    # Adjust these values to fine-tune completions
+    $body = [ordered]@{
+        prompt = $prompt
+        size   = '1024x1024'
+        n      = 1
+    } | ConvertTo-Json
+    
     # Call the API to generate the image and retrieve the response
-   $url = "$($openai.api_base)/openai/images/generations:submit?api-version=$($openai.api_version)"
-
-   $submission = Invoke-RestMethod -Uri $url -Headers $headers -Body $body -Method Post -ContentType 'application/json' -ResponseHeadersVariable submissionHeaders
-
+    $url = "$($openai.api_base)/openai/images/generations:submit?api-version=$($openai.api_version)"
+    
+    $submission = Invoke-RestMethod -Uri $url -Headers $headers -Body $body -Method Post -ContentType 'application/json' -ResponseHeadersVariable submissionHeaders
+    
     $operation_location = $submissionHeaders['operation-location'][0]
     $status = ''
     while ($status -ne 'succeeded') {
         Start-Sleep -Seconds 1
         $response = Invoke-RestMethod -Uri $operation_location -Headers $headers
         $status   = $response.status
     }
-
-   # Set the directory for the stored image
-   $image_dir = Join-Path -Path $pwd -ChildPath 'images'
-
-   # If the directory doesn't exist, create it
-   if (-not(Resolve-Path $image_dir -ErrorAction Ignore)) {
-       New-Item -Path $image_dir -ItemType Directory
-   }
-
-   # Initialize the image path (note the filetype should be png)
-   $image_path = Join-Path -Path $image_dir -ChildPath 'generated_image.png'
-
-   # Retrieve the generated image
-   $image_url = $response.result.data[0].url  # extract image URL from response
-   $generated_image = Invoke-WebRequest -Uri $image_url -OutFile $image_path  # download the image
-   return $image_path
+    
+    # Set the directory for the stored image
+    $image_dir = Join-Path -Path $pwd -ChildPath 'images'
+    
+    # If the directory doesn't exist, create it
+    if (-not(Resolve-Path $image_dir -ErrorAction Ignore)) {
+        New-Item -Path $image_dir -ItemType Directory
+    }
+    
+    # Initialize the image path (note the filetype should be png)
+    $image_path = Join-Path -Path $image_dir -ChildPath 'generated_image.png'
+    
+    # Retrieve the generated image
+    $image_url = $response.result.data[0].url  # extract image URL from response
+    $generated_image = Invoke-WebRequest -Uri $image_url -OutFile $image_path  # download the image
+    return $image_path
    ```
 
    > [!IMPORTANT]