You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Multimodal embeddings APIs enable the _vectorization_ of images and text queries. They convert images to coordinates in a multi-dimensional vector space. Then, incoming text queries can also be converted to vectors, and images can be matched to the text based on semantic closeness. This allows the user to search a set of images using text, without the need to use image tags or other metadata. Semantic closeness often produces better results in search.
21
21
22
-
The `2024-02-01` API includes a multi-lingual model that supports text search in 102 languages. The original English-only model is still available, but it cannot be combined with the new model in the same search index. If you vectorized text and images using the English-only model, these vectors won’t be compatible with multi-lingual text and image vectors.
22
+
The `2024-02-01` API includes a multi-lingual model (model version `2023-04-15`) that supports text search in 102 languages. The original English-only model (version `2022-04-11`) is still available, but it cannot be combined with the new model in the same search index. If you vectorized text and images using the English-only model, these vectors won’t be compatible with multi-lingual text and image vectors.
23
23
24
24
> [!IMPORTANT]
25
25
> These APIs are only available in certain geographic regions. See [Region availability](../overview-image-analysis.md#region-availability).
@@ -87,7 +87,7 @@ The API call returns a **vector** JSON object, which defines the text string's c
Copy file name to clipboardExpand all lines: articles/ai-services/computer-vision/identity-encrypt-data-at-rest.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,5 +26,5 @@ The Face service automatically encrypts your data when it's persisted to the clo
26
26
## Related content
27
27
28
28
* For a full list of services that support CMK, see [Customer-Managed Keys for Azure AI services](../encryption/cognitive-services-encryption-keys-portal.md)
29
-
*[What is Azure Key Vault?](/azure/key-vault/general/overview)?
29
+
*[What is Azure Key Vault?](/azure/key-vault/general/overview)
Copy file name to clipboardExpand all lines: articles/ai-services/computer-vision/overview-identity.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -88,7 +88,7 @@ The goal of liveness detection is to ensure that the system is interacting with
88
88
89
89
The liveness detection solution successfully defends against a variety of spoof types ranging from paper printouts, 2d/3d masks, and spoof presentations on phones and laptops. Liveness detection is an active area of research, with continuous improvements being made to counteract increasingly sophisticated spoofing attacks over time. Continuous improvements will be rolled out to the client and the service components over time as the overall solution gets more robust to new types of attacks.
Copy file name to clipboardExpand all lines: articles/ai-services/content-safety/how-to/encrypt-data-at-rest.md
+3-122Lines changed: 3 additions & 122 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,132 +16,13 @@ ms.author: pafarley
16
16
17
17
Azure AI Content Safety automatically encrypts your data when it's persisted to the cloud. The encryption protects your data and helps you meet your organizational security and compliance commitments. This article covers how Azure AI Content Safety handles encryption of data at rest.
Azure AI Content Safety is part of Azure AI services. Azure AI services data is encrypted and decrypted using [FIPS 140-2](https://en.wikipedia.org/wiki/FIPS_140-2) compliant [256-bit AES](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) encryption. Encryption and decryption are transparent, meaning encryption and access are managed for you. Your data is secure by default and you don't need to modify your code or applications to take advantage of encryption.
22
-
23
-
## About encryption key management
24
-
25
-
By default, your subscription uses Microsoft-managed encryption keys. There's also the option to manage your subscription with your own keys called customer-managed keys (CMK). CMK offers greater flexibility to create, rotate, disable, and revoke access controls. You can also audit the encryption keys used to protect your data.
26
-
27
-
## Customer-managed keys with Azure Key Vault
28
-
29
-
Customer-managed keys (CMK), also known as Bring your own key (BYOK), offer greater flexibility to create, rotate, disable, and revoke access controls. You can also audit the encryption keys used to protect your data.
30
-
31
-
You must use Azure Key Vault to store your customer-managed keys. You can either create your own keys and store them in a key vault, or you can use the Azure Key Vault APIs to generate keys. The Azure AI services resource and the key vault must be in the same region and in the same Microsoft Entra tenant, but they can be in different subscriptions. For more information about Azure Key Vault, see [What is Azure Key Vault?](/azure/key-vault/general/overview).
32
-
33
-
To enable customer-managed keys, you must also enable both the **Soft Delete** and **Do Not Purge** properties on the key vault.
34
-
35
-
Only RSA keys of size 2048 are supported with Azure AI services encryption. For more information about keys, see **Key Vault keys** in [About Azure Key Vault keys, secrets and certificates](/azure/key-vault/general/about-keys-secrets-certificates).
36
-
37
-
38
-
## Enable customer-managed keys for your resource
39
-
40
-
To enable customer-managed keys in the Azure portal, follow these steps:
41
-
42
-
1. Go to your Azure AI services resource.
43
-
2. On the left, select **Encryption**.
44
-
3. Under **Encryption type**, select **Customer Managed Keys**, as shown in the following screenshot.
45
-
46
-
:::image type="content" source="../media/encryption.png" alt-text="Screenshot of encryption tab in Azure portal.":::
47
-
48
-
49
-
## Specify a key
50
-
51
-
After you enable customer-managed keys, you can specify a key to associate with the Azure AI services resource.
52
-
53
-
#### [Specify a key as a URI](#tab/uri)
54
-
55
-
To specify a key as a URI, follow these steps:
56
-
57
-
1. In the Azure portal, go to your key vault.
58
-
59
-
2. Under **Settings**, select **Keys**.
60
-
61
-
3. Select the desired key, and then select the key to view its versions. Select a key version to view the settings for that version.
62
-
63
-
4. Copy the **Key Identifier** value, which provides the URI.
64
-
65
-
66
-
67
-
5. Go back to your Azure AI services resource, and then select **Encryption**.
68
-
69
-
6. Under **Encryption key**, select **Enter key URI**.
70
-
71
-
7. Paste the URI that you copied into the **Key URI** box.
72
-
73
-
74
-
75
-
8. Under **Subscription**, select the subscription that contains the key vault.
76
-
77
-
9. Save your changes.
78
-
79
-
80
-
81
-
#### [Specify a key from a key vault](#tab/vault)
82
-
83
-
To specify a key from a key vault, first make sure that you have a key vault that contains a key. Then follow these steps:
84
-
85
-
1. Go to your Azure AI services resource, and then select **Encryption**.
86
-
87
-
2. Under **Encryption key**, select **Select from Key Vault**.
88
-
89
-
3. Select the key vault that contains the key that you want to use.
90
-
91
-
4. Select the key that you want to use.
92
-
93
-
94
-
95
-
5. Save your changes.
96
-
97
-
---
98
-
99
-
## Update the key version
100
-
101
-
When you create a new version of a key, update the Azure AI services resource to use the new version. Follow these steps:
102
-
103
-
1. Go to your Azure AI services resource, and then select **Encryption**.
104
-
1. Enter the URI for the new key version. Alternately, you can select the key vault and then select the key again to update the version.
105
-
1. Save your changes.
106
-
107
-
108
-
## Use a different key
109
-
110
-
To change the key that you use for encryption, follow these steps:
111
-
112
-
1. Go to your Azure AI services resource, and then select **Encryption**.
113
-
1. Enter the URI for the new key. Alternately, you can select the key vault and then select a new key.
114
-
1. Save your changes.
115
-
116
-
117
-
## Rotate customer-managed keys
118
-
119
-
You can rotate a customer-managed key in Key Vault according to your compliance policies. When the key is rotated, you must update the Azure AI services resource to use the new key URI. To learn how to update the resource to use a new version of the key in the Azure portal, see [Update the key version](../../openai/encrypt-data-at-rest.md#update-the-key-version).
120
-
121
-
Rotating the key doesn't trigger re-encryption of data in the resource. No further action is required from the user.
122
-
123
-
124
-
## Revoke a customer-managed key
125
-
126
-
To revoke access to customer-managed keys, use PowerShell or Azure CLI. For more information, see [Azure Key Vault PowerShell](/powershell/module/az.keyvault//) or [Azure Key Vault CLI](/cli/azure/keyvault). Revoking access effectively blocks access to all data in the Azure AI services resource, because the encryption key is inaccessible by Azure AI services.
127
-
128
-
129
-
## Disable customer-managed keys
130
-
131
-
When you disable customer-managed keys, your Azure AI services resource is then encrypted with Microsoft-managed keys. To disable customer-managed keys, follow these steps:
132
-
133
-
1. Go to your Azure AI services resource, and then select **Encryption**.
When you previously enabled customer managed keys this also enabled a system assigned managed identity, a feature of Microsoft Entra ID. Once the system assigned managed identity is enabled, this resource is registered with Microsoft Entra ID. After being registered, the managed identity will be given access to the Key Vault selected during customer managed key setup. You can learn more about [Managed Identities](/azure/active-directory/managed-identities-azure-resources/overview).
137
24
138
-
> [!IMPORTANT]
139
-
> If you disable system assigned managed identities, access to the key vault will be removed and any data encrypted with the customer keys will no longer be accessible. Any features depended on this data will stop working.
140
-
141
-
> [!IMPORTANT]
142
-
> Managed identities do not currently support cross-directory scenarios. When you configure customer-managed keys in the Azure portal, a managed identity is automatically assigned under the covers. If you later move the subscription, resource group, or resource from one Microsoft Entra directory to another, the managed identity associated with the resource is not transferred to the new tenant, so customer-managed keys may no longer work. For more information, see **Transferring a subscription between Microsoft Entra directories** in [FAQs and known issues with managed identities for Azure resources](/azure/active-directory/managed-identities-azure-resources/known-issues#transferring-a-subscription-between-azure-ad-directories).
0 commit comments