You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/applied-ai-services/form-recognizer/managed-identities-secured-access.md
+13-14Lines changed: 13 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ manager: nitinme
7
7
ms.service: applied-ai-services
8
8
ms.subservice: forms-recognizer
9
9
ms.topic: how-to
10
-
ms.date: 01/18/2023
10
+
ms.date: 02/28/2023
11
11
ms.author: vikurpad
12
12
monikerRange: '>=form-recog-2.1.0'
13
13
recommendations: false
@@ -17,29 +17,29 @@ recommendations: false
17
17
18
18
[!INCLUDE [applies to v3.0 and v2.1](includes/applies-to-v3-0-and-v2-1.md)]
19
19
20
-
This how-to guide will walk you through the process of enabling secure connections for your Form Recognizer resource. You can secure the following connections:
20
+
This how-to guide walks you through the process of enabling secure connections for your Form Recognizer resource. You can secure the following connections:
21
21
22
22
* Communication between a client application within a Virtual Network (VNET) and your Form Recognizer Resource.
23
23
24
24
* Communication between Form Recognizer Studio and your Form Recognizer resource.
25
25
26
26
* Communication between your Form Recognizer resource and a storage account (needed when training a custom model).
27
27
28
-
You'll be setting up your environment to secure the resources:
28
+
You're setting up your environment to secure the resources:
29
29
30
30
:::image type="content" source="media/managed-identities/secure-config.png" alt-text="Screenshot of secure configuration with managed identity and private endpoints.":::
31
31
32
32
## Prerequisites
33
33
34
-
To get started, you'll need:
34
+
To get started, you need:
35
35
36
36
* An active [**Azure account**](https://azure.microsoft.com/free/cognitive-services/)—if you don't have one, you can [**create a free account**](https://azure.microsoft.com/free/).
37
37
38
38
* A [**Form Recognizer**](https://portal.azure.com/#create/Microsoft.CognitiveServicesTextTranslation) or [**Cognitive Services**](https://portal.azure.com/#create/Microsoft.CognitiveServicesAllInOne) resource in the Azure portal. For detailed steps, _see_[Create a Cognitive Services resource using the Azure portal](../../cognitive-services/cognitive-services-apis-create-account.md?tabs=multiservice%2cwindows).
39
39
40
-
* An [**Azure blob storage account**](https://portal.azure.com/#create/Microsoft.StorageAccount-ARM) in the same region as your Form Recognizer resource. You'll create containers to store and organize your blob data within your storage account.
40
+
* An [**Azure blob storage account**](https://portal.azure.com/#create/Microsoft.StorageAccount-ARM) in the same region as your Form Recognizer resource. Create containers to store and organize your blob data within your storage account.
41
41
42
-
* An [**Azure virtual network**](https://portal.azure.com/#create/Microsoft.VirtualNetwork-ARM) in the same region as your Form Recognizer resource. You'll create a virtual network to deploy your application resources to train models and analyze documents.
42
+
* An [**Azure virtual network**](https://portal.azure.com/#create/Microsoft.VirtualNetwork-ARM) in the same region as your Form Recognizer resource. Create a virtual network to deploy your application resources to train models and analyze documents.
43
43
44
44
* An **Azure data science VM** for [**Windows**](../../machine-learning/data-science-virtual-machine/provision-vm.md) or [**Linux/Ubuntu**](../../machine-learning/data-science-virtual-machine/dsvm-ubuntu-intro.md) to optionally deploy a data science VM in the virtual network to test the secure connections being established.
45
45
@@ -49,23 +49,23 @@ Configure each of the resources to ensure that the resources can communicate wit
49
49
50
50
* Configure the Form Recognizer Studio to use the newly created Form Recognizer resource by accessing the settings page and selecting the resource.
51
51
52
-
* Validate that the configuration works by selecting the Read API and analyzing a sample document. If the resource was configured correctly, the request will successfully complete.
52
+
* Validate that the configuration works by selecting the Read API and analyzing a sample document. If the resource was configured correctly, the request successfully completes.
53
53
54
54
* Add a training dataset to a container in the Storage account you created.
55
55
56
56
* Select the custom model tile to create a custom project. Ensure that you select the same Form Recognizer resource and the storage account you created in the previous step.
57
57
58
58
* Select the container with the training dataset you uploaded in the previous step. Ensure that if the training dataset is within a folder, the folder path is set appropriately.
59
59
60
-
* If you have the required permissions, the Studio will set the CORS setting required to access the storage account. If you don't have the permissions, you'll need to ensure that the CORS settings are configured on the Storage account before you can proceed.
60
+
* If you have the required permissions, the Studio sets the CORS setting required to access the storage account. If you don't have the permissions, you need to ensure that the CORS settings are configured on the Storage account before you can proceed.
61
61
62
62
* Validate that the Studio is configured to access your training data, if you can see your documents in the labeling experience, all the required connections have been established.
63
63
64
64
You now have a working implementation of all the components needed to build a Form Recognizer solution with the default security model:
65
65
66
66
:::image type="content" source="media/managed-identities/default-config.png" alt-text="Screenshot of default security configuration.":::
67
67
68
-
Next, you'll complete the following steps:
68
+
Next, complete the following steps:
69
69
70
70
* Setup managed identity on the Form Recognizer resource.
71
71
@@ -105,7 +105,7 @@ Start configuring secure communications by navigating to the **Networking** tab
105
105
106
106
## Enable access to storage from Form Recognizer
107
107
108
-
To ensure that the Form Recognizer resource can access the training dataset, you'll need to add a role assignment for the managed identity that was created earlier.
108
+
To ensure that the Form Recognizer resource can access the training dataset, you need to add a role assignment for your [managed identity](#setup-managed-identity-for-form-recognizer).
109
109
110
110
1. Staying on the storage account window in the Azure portal, navigate to the **Access Control (IAM)** tab in the left navigation bar.
111
111
@@ -142,9 +142,9 @@ Great! You've configured your Form Recognizer resource to use a managed identity
142
142
143
143
## Configure private endpoints for access from VNETs
144
144
145
-
When you connect to resources from a virtual network, adding private endpoints will ensure both the storage account and the Form Recognizer resource are accessible from the virtual network.
145
+
When you connect to resources from a virtual network, adding private endpoints ensures both the storage account, and the Form Recognizer resource are accessible from the virtual network.
146
146
147
-
Next, you'll configure the virtual network to ensure only resources within the virtual network or traffic router through the network will have access to the Form Recognizer resource and the storage account.
147
+
Next, configure the virtual network to ensure only resources within the virtual network or traffic router through the network have access to the Form Recognizer resource and the storage account.
148
148
149
149
### Enable your virtual network and private endpoints
150
150
@@ -162,8 +162,7 @@ Next, you'll configure the virtual network to ensure only resources within the v
162
162
163
163
### Configure your private endpoint
164
164
165
-
1. Navigate to the **Private endpoint connections** tab and select the **+ Private endpoint**. You'll be
166
-
navigated to the **Create a private endpoint** dialog page.
165
+
1. Navigate to the **Private endpoint connections** tab and select the **+ Private endpoint**. You're navigated to the **Create a private endpoint** dialog page.
167
166
168
167
1. On the **Create private endpoint** dialog page, select the following options:
0 commit comments