You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Customer-managed keys (CMKs) in [Azure AI Foundry portal](https://ai.azure.com/) provide enhanced control over the encryption of your data. By using CMKs, you can manage your own encryption keys to add an extra layer of protection and meet compliance requirements more effectively.
20
20
21
-
## About encryption in Azure AI Foundry portal
21
+
## About encryption in Azure AI Foundry
22
22
23
-
Azure AI Foundry is a service in the Microsoft Azure cloud, and it also relies on other Azure services. By default, these services use Microsoft-managed encryption keys to encrypt data in transit and at rest.
23
+
Azure AI Foundry is a service in the Microsoft Azure cloud. By default, services use Microsoft-managed encryption keys to encrypt data in transit and at rest.
24
24
25
25
::: zone pivot="hub-project"
26
26
27
27
Hub and [!INCLUDE [hub](../includes/hub-project-name.md)] resources are implementations of the Azure Machine Learning workspace and encrypt data in transit and at rest. For details, see [Data encryption with Azure Machine Learning](../../machine-learning/concept-data-encryption.md).
28
28
29
-
Azure AI services data is encrypted and decrypted using [FIPS 140-2](https://en.wikipedia.org/wiki/FIPS_140-2) compliant [256-bit AES](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) encryption. Encryption and decryption are transparent, meaning encryption and access are managed for you. Your data is secure by default and you don't need to modify your code or applications to take advantage of encryption.
30
-
31
29
::: zone-end
32
30
33
31
::: zone pivot="fdp-project"
34
32
35
-
## Service-side storage of encrypted data when using customer-managed keys
33
+
Data is encrypted and decrypted using [FIPS 140-2](https://en.wikipedia.org/wiki/FIPS_140-2) compliant [256-bit AES](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) encryption. Encryption and decryption are transparent, meaning encryption and access are managed for you. Your data is secure by default and you don't need to modify your code or applications to take advantage of encryption.
34
+
35
+
::: zone-end
36
36
37
-
Customer-managed key encryption can be enabled during project creation through the Azure portal or Bicep template. The encrypted data is stored service-side on Microsoft-managed resources. Metadata is stored in multitenant resources using document-level CMK encryption. Due to its dedicated resource model, its Azure cost is charged in your subscription.
37
+
## Storage of encrypted data when using customer-managed keys
38
+
39
+
Customer-managed key encryption can be enabled during resource creation through the Azure portal or template options. The encrypted data is stored service-side on Microsoft-managed resources using your encryption key.
38
40
39
41
> [!NOTE]
40
-
> When you use server-side encryption, Azure charges will continue to accrue during the soft delete retention period.
42
+
> Due to the dedicated hosting model for certain services when using customer-managed key encrypted data, additional charges may apply.
41
43
42
-
::: zone-end
44
+
> [!NOTE]
45
+
> When you use server-side encryption, Azure charges will continue to accrue during the soft delete retention period.
43
46
44
47
::: zone pivot="hub-project"
45
48
46
-
## Data storage in your subscription when using customer-managed keys
49
+
## Service-side storage of encrypted data when using customer-managed keys with AI hub
47
50
48
-
Hub resources store metadata in your Azure subscription when using customer-managed keys. Data is stored in a Microsoft-managed resource group that includes an Azure Storage account, Azure Cosmos DB resource and Azure AI Search.
51
+
Two architecture options are available when using customer-managed keys:
49
52
50
-
> [!IMPORTANT]
51
-
> When using a customer-managed key, the costs for your subscription will be higher because encrypted data is stored in your subscription. To estimate the cost, use the [Azure pricing calculator](https://azure.microsoft.com/pricing/calculator/).
53
+
***Encrypted data is stored in Microsoft subscription (recommended)**
52
54
53
-
The encryption key you provide when creating a hub is used to encrypt data that is stored on Microsoft-managed resources. All projects using the same hub store data on the resources in a managed resource group identified by the name `azureml-rg-hubworkspacename_GUID`. Projects use Microsoft Entra ID authentication when interacting with these resources. If your hub has a private link endpoint, network access to the managed resources is restricted. The managed resource group is deleted, when the hub is deleted.
55
+
Data is stored service-side on Microsoft-managed resources instead of in managed resources in your subscription. Metadata is stored in multitenant resources using document-level CMK encryption. An Azure AI Search instance is hosted on the Microsoft-side per customer, and for each hub.
54
56
55
-
The following data is stored on the managed resources.
57
+
***Encrypted data is stored in your subscription**
56
58
57
-
|Service|What it's used for|Example|
58
-
|-----|-----|-----|
59
-
|Azure Cosmos DB|Stores metadata for your Azure AI projects and tools|Index names, tags; Flow creation timestamps; deployment tags; evaluation metrics|
60
-
|Azure AI Search|Stores indices that are used to help query your Azure AI Foundry content.|An index based off your model deployment names|
61
-
|Azure Storage Account|Stores instructions for how customization tasks are orchestrated|JSON representation of flows you create in [Azure AI Foundry portal](https://ai.azure.com/)|
59
+
Data is stored in your subscription using a Microsoft-managed resource group that includes an Azure Storage account, Azure Cosmos DB resource and Azure AI Search. The configuration of these resources cannot be modified. Changes to its configurations are not supported.
62
60
63
-
>[!IMPORTANT]
64
-
> Azure AI Foundry uses Azure compute that is managed in the Microsoft subscription, for example when you fine-tune models or or build flows. Its disks are encrypted with Microsoft-managed keys. Compute is ephemeral, meaning after a task is completed the virtual machine is deprovisioned, and the OS disk is deleted. Compute instance machines used for 'Code' experiences are persistant. Azure Disk Encryption isn't supported for the OS disk.
61
+
All projects using the same hub store data on the resources in a managed resource group identified by the name `azureml-rg-hubworkspacename_GUID`. Projects use Microsoft Entra ID authentication when interacting with these resources. If your hub has a private link endpoint, network access to the managed resources is restricted. The managed resource group is deleted, when the hub is deleted.
65
62
66
-
## (Preview) Service-side storage of encrypted data when using customer-managed keys
63
+
The following data is stored on the managed resources.
67
64
68
-
A new architecture for customer-managed key encryption with hubs is available in preview, which resolves the dependency on the managed resource group. In this new model, encrypted data is stored service-side on Microsoft-managed resources instead of in managed resources in your subscription. Metadata is stored in multitenant resources using document-level CMK encryption. An Azure AI Search instance is hosted on the Microsoft-side per customer, and for each hub. Due to its dedicated resource model, its Azure cost is charged in your subscription via the hub resource.
65
+
|Service|What it's used for|Example|
66
+
|-----|-----|-----|
67
+
|Azure Cosmos DB|Stores metadata for your Azure AI projects and tools|Index names, tags; Flow creation timestamps; deployment tags; evaluation metrics|
68
+
|Azure AI Search|Stores indices that are used to help query your Azure AI Foundry content.|An index based off your model deployment names|
69
+
|Azure Storage Account|Stores instructions for how customization tasks are orchestrated|JSON representation of flows you create in [Azure AI Foundry portal](https://ai.azure.com/)|
69
70
70
-
> [!NOTE]
71
-
> - During this preview key rotation and user-assigned identity capabilities are not supported. Service-side encryption is currently not supported in reference to an Azure Key Vault for storing your encryption key that has public network access disabled.
72
-
> - If you are using the preview server-side storage, Azure charges will continue to accrue during the soft delete retention period.
73
71
74
72
::: zone-end
75
73
@@ -95,15 +93,16 @@ To enable customer-managed keys, the key vault containing your keys must meet th
95
93
- If you use the [Key Vault firewall](/azure/key-vault/general/access-behind-firewall), you must allow trusted Microsoft services to access the key vault.
96
94
- You must grant your hub and Azure AI Services resource's system-assigned managed identity the following permissions on your key vault: *get key*, *wrap key*, *unwrap key*.
97
95
98
-
The following limitations hold for Azure AI Services:
96
+
The following limitations hold for Azure AI Foundry:
99
97
- Only Azure Key Vault with [legacy access policies](/azure/key-vault/general/assign-access-policy) are supported.
100
98
- Only RSA and RSA-HSM keys of size 2048 are supported with Azure AI services encryption. For more information about keys, see **Key Vault keys** in [About Azure Key Vault keys, secrets, and certificates](/azure/key-vault/general/about-keys-secrets-certificates).
99
+
- Updates from Customer-Managed keys to Microsoft-managed keys are currently not supported for project sub-resources. Projects will keep referencing your encryption keys if updated.
101
100
102
-
### Enable your Azure AI Services resource's managed identity
101
+
### Enable your Azure AI Foundry resource's managed identity
103
102
104
-
If connecting with Azure AI Services, or variants of Azure AI Services such as Azure OpenAI, you need to enable managed identity as a prerequisite for using customer-managed keys.
103
+
Managed identity must be enabled as a prerequisite for using customer-managed keys.
105
104
106
-
1. Go to your Azure AI services resource.
105
+
1. Go to your Azure AI Foundry resource in Azure portal.
107
106
1. On the left, under **Resource Management**, select **Identity**.
108
107
1. Switch the system-assigned managed identity status to **On**.
109
108
1. Save your changes, and confirm that you want to enable the system-assigned managed identity.
@@ -149,11 +148,9 @@ Alternatively, use infrastructure-as-code options for automation. Example Bicep
149
148
150
149
* The customer-managed key for encryption can only be updated to keys in the same Azure Key Vault instance.
151
150
* After deployment, hubs can't switch from Microsoft-managed keys to Customer-managed keys or vice versa.
152
-
*[Azure AI services Customer-Managed Key Request Form](https://aka.ms/cogsvc-cmk) is required to use customer-managed keys in combination with Azure Speech and Content Moderator capabilities.
153
-
* At the time of creation, you can't provide or modify resources that are created in the Microsoft-managed Azure resource group in your subscription.
154
-
* You can't delete Microsoft-managed resources used for customer-managed keys without also deleting your hub.
155
-
*[Azure AI services Customer-Managed Key Request Form](https://aka.ms/cogsvc-cmk) is still required for Speech and Content Moderator.
156
-
* If you are using the [server-side preview](#preview-service-side-storage-of-encrypted-data-when-using-customer-managed-keys), Azure charges will continue to accrue during the soft delete retention period.
151
+
*[Azure AI Foundry Customer-Managed Key Request Form](https://aka.ms/cogsvc-cmk) is required to use customer-managed keys in combination with Azure Speech and Content Moderator capabilities.
152
+
*[Azure AI Foundry Customer-Managed Key Request Form](https://aka.ms/cogsvc-cmk) is still required for Speech and Content Moderator.
153
+
* If your AI Foundry resource is in a soft-deleted state(#preview-service-side-storage-of-encrypted-data-when-using-customer-managed-keys), any additional Azure charges will continue to accrue during the soft delete retention period.
`AzureOpenAILabelGrader` uses your custom prompt to instruct a model to classify outputs based on labels you define. It returns structured results with explanations for why each label was chosen.
41
41
42
42
> [!NOTE]
43
-
> We recommend using Azure Open AI GPT o3-mini for best results.
43
+
> We recommend using Azure OpenAI GPT o3-mini for best results.
44
44
45
45
Here's an example `data.jsonl` that is used in the following code snippets:
46
46
@@ -262,5 +262,5 @@ Aside from individual data evaluation results, the grader also returns a metric
262
262
263
263
## Related content
264
264
265
-
-[How to run batch evaluation on a dataset](../../how-to/develop/evaluate-sdk.md#local-evaluation-on-datasets)
265
+
-[How to run batch evaluation on a dataset](../../how-to/develop/evaluate-sdk.md#local-evaluation-on-test-datasets-using-evaluate)
266
266
-[How to run batch evaluation on a target](../../how-to/develop/evaluate-sdk.md#local-evaluation-on-a-target)
Copy file name to clipboardExpand all lines: articles/ai-foundry/concepts/evaluation-evaluators/custom-evaluators.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -151,4 +151,5 @@ friendliness_score = friendliness_eval(response="I will not apologize for my beh
151
151
152
152
## Related content
153
153
154
-
- Learn [how to run batch evaluation on a dataset](../../how-to/develop/evaluate-sdk.md#local-evaluation-on-datasets) and [how to run batch evaluation on a target](../../how-to/develop/evaluate-sdk.md#local-evaluation-on-a-target).
154
+
-[How to run batch evaluation on a dataset](../../how-to/develop/evaluate-sdk.md#local-evaluation-on-test-datasets-using-evaluate)
155
+
-[How to run batch evaluation on a target](../../how-to/develop/evaluate-sdk.md#local-evaluation-on-a-target)
Copy file name to clipboardExpand all lines: articles/ai-foundry/concepts/evaluation-evaluators/risk-safety-evaluators.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -485,4 +485,4 @@ The label field returns a boolean true or false based on whether or not either o
485
485
## Related content
486
486
487
487
- Read the [Transparency Note for Safety Evaluators](../safety-evaluations-transparency-note.md) to learn more about its limitations, use cases and how it was evaluated for quality and accuracy.
488
-
- Learn [how to run batch evaluation on a dataset](../../how-to/develop/evaluate-sdk.md#local-evaluation-on-datasets) and [how to run batch evaluation on a target](../../how-to/develop/evaluate-sdk.md#local-evaluation-on-a-target).
488
+
- Learn [how to run batch evaluation on a dataset](../../how-to/develop/evaluate-sdk.md#local-evaluation-on-test-datasets-using-evaluate) and [how to run batch evaluation on a target](../../how-to/develop/evaluate-sdk.md#local-evaluation-on-a-target).
0 commit comments