You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/ai-foundry/foundry-models/how-to/configure-entra-id.md
+5-2Lines changed: 5 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Configure key-less authentication with Microsoft Entra ID
3
3
titleSuffix: Azure AI Foundry
4
-
description: Learn how to configure key-less authorization to use Azure AI Foundry Models with Microsoft Entra ID.
4
+
description: Learn how to configure key-less authorization to use Azure AI Foundry Models with Microsoft Entra ID and enhance security.
5
5
ms.service: azure-ai-foundry
6
6
ms.subservice: azure-ai-foundry-model-inference
7
7
ms.topic: how-to
@@ -13,6 +13,9 @@ recommendations: false
13
13
zone_pivot_groups: azure-ai-models-deployment
14
14
ms.reviewer: fasantia
15
15
reviewer: santiagxf
16
+
ai-usage: ai-assisted
17
+
18
+
#CustomerIntent: As a developer, I want to configure keyless authentication with Microsoft Entra ID for Azure AI Foundry Models so that I can secure my AI model deployments without relying on API keys and leverage role-based access control for better security and compliance.
16
19
---
17
20
18
21
# Configure key-less authentication with Microsoft Entra ID
> Notice that this template can take the parameter `allowKeys`which, when `false`will disable the use of keys in the resource. This configuration is optional.
51
+
> This template accepts the `allowKeys`parameter. Set it to `false`to disable key access in the resource. This configuration is optional.
52
52
53
-
2. Use the template `modules/role-assignment-template.bicep` to describe a role assignment in Azure:
53
+
1. Use the template `modules/role-assignment-template.bicep` to describe a role assignment in Azure:
54
54
55
55
__modules/role-assignment-template.bicep__
56
56
@@ -66,36 +66,36 @@ In your console, follow these steps:
7. The template outputs the Azure AI Foundry Models endpoint that you can use to consume any of the model deployments you have created.
93
+
1. The template outputs the Azure AI Foundry Models endpoint that you can use to consume any of the model deployments you created.
94
94
95
95
96
96
## Use Microsoft Entra ID in your code
97
97
98
-
Once you configured Microsoft Entra ID in your resource, you need to update your code to use it when consuming the inference endpoint. The following example shows how to use a chat completions model:
98
+
After you configure Microsoft Entra ID in your resource, update your code to use it when consuming the inference endpoint. The following example shows how to use a chat completions model:
@@ -107,7 +107,7 @@ Once you configured Microsoft Entra ID in your resource, you need to update your
107
107
108
108
## Disable key-based authentication in the resource
109
109
110
-
Disabling key-based authentication is advisable when you implemented Microsoft Entra ID and fully addressed compatibility or fallback concerns in all the applications that consume the service. You can achieve it by changing the property `disableLocalAuth`:
110
+
We advise that you disable key-based authentication when you implement Microsoft Entra ID and fully address compatibility or fallback concerns in all the applications that consume the service. Change the `disableLocalAuth` property to disable key-based authentication:
* Your Azure AI Foundry (formerly known Azure AI Services) resource name.
21
21
22
-
* The resource group where the Azure AI Foundry (formerly known Azure AI Services) resource is deployed.
22
+
* The resource group where you deployed the Azure AI Foundry resource (formerly known Azure AI Services resource).
23
23
24
24
25
25
## Configure Microsoft Entra ID for inference
26
26
27
27
Follow these steps to configure Microsoft Entra ID for inference:
28
28
29
29
30
-
1.Log in into your Azure subscription:
30
+
1.Sign in to your Azure subscription:
31
31
32
32
```azurecli
33
33
az login
34
34
```
35
35
36
-
2. If you have more than one subscription, select the subscription where your resource is located:
36
+
1. If you have more than one subscription, select the subscription where your resource is located:
37
37
38
38
```azurecli
39
39
az account set --subscription "<subscription-id>"
40
40
```
41
41
42
-
3. Set the following environment variables with the name of the Azure AI Foundry (formerly known Azure AI Services) resource you plan to use and resource group.
42
+
1. Set the following environment variables with the name of the Azure AI Foundry (formerly known Azure AI Services) resource you plan to use and resource group.
43
43
44
44
```azurecli
45
45
ACCOUNT_NAME="<ai-services-resource-name>"
46
46
RESOURCE_GROUP="<resource-group>"
47
47
```
48
48
49
-
4. Get the full name of your resource:
49
+
1. Get the full name of your resource:
50
50
51
51
```azurecli
52
-
RESOURCE_ID=$(az resource show -g $RESOURCE_GROUP -n $ACCOUNT_NAME --resource-type "Microsoft.CognitiveServices/accounts")
52
+
RESOURCE_ID=$(az resource show -g $RESOURCE_GROUP -n $ACCOUNT_NAME --resource-type "Microsoft.CognitiveServices/accounts" --query id --output tsv)
53
53
```
54
54
55
-
5. Get the object ID of the security principal you want to assign permissions to. The following example shows how to get the object ID associated with:
55
+
1. Get the object ID of the security principal you want to assign permissions to. The following example shows how to get the object ID associated with:
56
56
57
-
__Your own logged in account:__
57
+
**Your own signed in account:**
58
58
59
59
```azurecli
60
60
OBJECT_ID=$(az ad signed-in-user show --query id --output tsv)
61
61
```
62
62
63
-
__A security group:__
63
+
**A security group:**
64
64
65
65
```azurecli
66
66
OBJECT_ID=$(az ad group show --group "<group-name>" --query id --output tsv)
67
67
```
68
68
69
-
__A service principal:__
69
+
**A service principal:**
70
70
71
71
```azurecli
72
72
OBJECT_ID=$(az ad sp show --id "<service-principal-guid>" --query id --output tsv)
73
73
```
74
74
75
-
6. Assign the **Cognitive Services User** role to the service principal (scoped to the resource). By assigning a role, you're granting service principal access to this resource.
75
+
1. Assign the **Cognitive Services User** role to the service principal (scoped to the resource). By assigning a role, you grant the service principal access to this resource.
76
76
77
77
```azurecli
78
78
az role assignment create --assignee-object-id $OBJECT_ID --role "Cognitive Services User" --scope $RESOURCE_ID
79
79
```
80
80
81
-
8. The selected user can now use Microsoft Entra ID for inference.
81
+
1. The selected user can now use Microsoft Entra ID for inference.
82
82
83
83
> [!TIP]
84
-
> Keep in mind that Azure role assignments may take up to five minutes to propagate. Adding or removing users from a security group propagates immediately.
84
+
> Keep in mind that Azure role assignments can take up to five minutes to propagate. Adding or removing users from a security group propagates immediately.
85
85
86
86
87
87
## Use Microsoft Entra ID in your code
88
88
89
-
Once Microsoft Entra ID is configured in your resource, you need to update your code to use it when consuming the inference endpoint. The following example shows how to use a chat completions model:
89
+
After you configure Microsoft Entra ID in your resource, update your code to use it when consuming the inference endpoint. The following example shows how to use a chat completions model:
Copy file name to clipboardExpand all lines: articles/ai-foundry/foundry-models/includes/configure-entra-id/intro.md
+6-7Lines changed: 6 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,17 +4,17 @@ author: santiagxf
4
4
ms.author: fasantia
5
5
ms.service: azure-ai-foundry
6
6
ms.subservice: azure-ai-foundry-model-inference
7
-
ms.date: 01/23/2025
7
+
ms.date: 08/29/2025
8
8
ms.topic: include
9
9
---
10
10
11
-
Azure AI Foundry Models support key-less authorization using Microsoft Entra ID. Key-less authorization enhances security, simplifies the user experience, reduces operational complexity, and provides robust compliance support for modern development. It makes it a strong choice for organizations adopting secure and scalable identity management solutions.
11
+
Azure AI Foundry Models support keyless authorization with Microsoft Entra ID. Keyless authorization enhances security, simplifies the user experience, reduces operational complexity, and provides robust compliance support for modern development. Keyless authorization is a strong choice for organizations adopting secure and scalable identity management solutions.
12
12
13
13
This article explains how to configure Microsoft Entra ID for inference in Azure AI Foundry Models.
14
14
15
15
## Understand roles in the context of resource in Azure
16
16
17
-
Microsoft Entra ID uses the idea of Role-based Access Control (RBAC) for authorization. Roles are central to managing access to your cloud resources. A role is essentially a collection of permissions that define what actions can be performed on specific Azure resources. By assigning roles to users, groups, service principals, or managed identities—collectively known as security principals—you control their access within your Azure environment to specific resources.
17
+
Microsoft Entra ID uses the idea of role-based access control (RBAC) for authorization. Roles are central to managing access to your cloud resources. A role is essentially a collection of permissions that define what actions can be performed on specific Azure resources. By assigning roles to users, groups, service principals, or managed identities—collectively known as security principals—you control their access within your Azure environment to specific resources.
18
18
19
19
When you assign a role, you specify the security principal, the role definition, and the scope. This combination is known as a role assignment. Azure AI Foundry Models is a capability of the Azure AI Services resources, and hence, roles assigned to that particular resource control the access for inference.
20
20
@@ -27,9 +27,8 @@ You identify two different types of access to the resources:
27
27
In Azure, administration operations are always performed using Microsoft Entra ID. Roles like **Cognitive Services Contributor** allow you to perform those operations. On the other hand, developer operations can be performed using either access keys or/and Microsoft Entra ID. Roles like **Cognitive Services User** allow you to perform those operations.
28
28
29
29
> [!IMPORTANT]
30
-
> Having administration access to a resource doesn't necessarily grants developer access to it. Explicit access by granting roles is still required. It's analogous to how database servers work. Having administrator access to the database server doesn't mean you can read the data inside of a database.
30
+
> Having administration access to a resource doesn't necessarily grant developer access to it. Explicit access by granting roles is still required. It's analogous to how database servers work. Having administrator access to the database server doesn't mean you can read the data inside of a database.
31
31
32
-
Follow these steps to configure developer access to Azure AI Foundry Models for inference.
33
32
34
33
## Prerequisites
35
34
@@ -41,11 +40,11 @@ To complete this article, you need:
41
40
42
41
* To assign a role, you must specify three elements:
43
42
44
-
* Security principal: e.g. your user account.
43
+
* Security principal: your user account.
45
44
* Role definition: the *Cognitive Services User* role.
46
45
* Scope: the Azure AI Services resource.
47
46
48
-
* If you want to create a custom role definition instead of using *Cognitive Services User* role, ensure the role has the following permissions:
47
+
* If you want to create a custom role definition instead of using the *Cognitive Services User* role, ensure the role has the following permissions:
0 commit comments