Skip to content

Commit 454f85a

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #259820 from aahill/aoai-securely
AOAI on your data securely
2 parents 89c2d42 + 7297c0a commit 454f85a

18 files changed

+302
-58
lines changed

‎articles/ai-services/openai/concepts/use-your-data.md

Lines changed: 12 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,6 @@ To get started, [connect your data source](../use-your-data-quickstart.md) using
3131
> [!NOTE]
3232
> To get started, you need to already have been approved for [Azure OpenAI access](../overview.md#how-do-i-get-access-to-azure-openai) and have an [Azure OpenAI Service resource](../how-to/create-resource.md) with either the gpt-35-turbo or the gpt-4 models deployed.
3333
34-
<!--## Data source options
35-
36-
Azure OpenAI on your data uses an [Azure AI Search](/azure/search/search-what-is-azure-search) index to determine what data to retrieve based on user inputs and provided conversation history. We recommend using Azure OpenAI Studio to create your index from a blob storage or local files. See the [quickstart article](../use-your-data-quickstart.md?pivots=programming-language-studio) for more information.-->
37-
3834
## Data formats and file types
3935

4036
Azure OpenAI on your data supports the following filetypes:
@@ -225,25 +221,22 @@ You can modify the following additional settings in the **Data parameters** sect
225221
|**Retrieved documents** | Specifies the number of top-scoring documents from your data index used to generate responses. You might want to increase the value when you have short documents or want to provide more context. The default value is 5. This is the `topNDocuments` parameter in the API. |
226222
| **Strictness** | Sets the threshold to categorize documents as relevant to your queries. Raising the value means a higher threshold for relevance and filters out more less-relevant documents for responses. Setting this value too high might cause the model to fail to generate responses due to limited available documents. The default value is 3. |
227223

228-
## Virtual network support & private endpoint support (Azure AI Search only)
224+
## Azure Role-based access controls (Azure RBAC) for adding data sources
229225

230-
See the following table for scenarios supported by virtual networks and private endpoints **when you bring your own Azure AI Search index**.
226+
To add a new data source to Azure OpenAI on your data, you need the following Azure RBAC roles.
231227

232-
| Network access to the Azure OpenAI Resource | Network access to the Azure AI Search resource | Is vector search enabled? | Azure OpenAI studio | Chat with the model using the API |
233-
|---------------------------------------------|-------------------------------------------------------|---------------------------|---------------------|-----------------------------------|
234-
| Public | Public | Either | Supported | Supported |
235-
| Private | Public | Yes | Not supported | Supported |
236-
| Private | Public | No | Supported | Supported |
237-
| Regardless of resource access allowances | Private | Either | Not supported | Supported |
238228

239-
Additionally, data ingestion has the following configuration support:
240-
241-
| Network access to the Azure OpenAI Resource | Network access to the Azure AI Search resource | Azure OpenAI studio support | [Ingestion API](../reference.md#start-an-ingestion-job) support |
242-
|---------------------------------------------|-------------------------------------------------------|-----------------------------|-----------------------------------------------------------------|
243-
| Public | Public | Supported | Supported |
244-
| Private | Regardless of resource access allowances. | Not supported | Not supported |
245-
| Public | Private | Not supported | Not supported |
229+
|Azure RBAC role | Which resource needs this role? | Needed when |
230+
|---------|---------|---------|
231+
| [Cognitive Services OpenAI Contributor](../how-to/role-based-access-control.md#cognitive-services-openai-contributor) | The Azure AI Search resource, to access Azure OpenAI resource. | You want to use Azure OpenAI on your data. |
232+
|[Search Index Data Reader](/azure/role-based-access-control/built-in-roles#search-index-data-reader) | The Azure OpenAI resource, to access the Azure AI Search resource. | You want to use Azure OpenAI on your data. |
233+
|[Search Service Contributor](/azure/role-based-access-control/built-in-roles#search-service-contributor) | The Azure OpenAI resource, to access the Azure AI Search resource. | You plan to create a new Azure AI Search index. |
234+
|[Storage Blob Data Contributor](/azure/role-based-access-control/built-in-roles#storage-blob-data-contributor) | You have an existing Blob storage container that you want to use, instead of creating a new one. | The Azure AI Search and Azure OpenAI resources, to access the storage account. |
235+
| [Cognitive Services OpenAI User](../how-to/role-based-access-control.md#cognitive-services-openai-user) | The web app, to access the Azure OpenAI resource. | You want to deploy a web app. |
236+
| [Contributor](/azure/role-based-access-control/built-in-roles#contributor) | Your subscription, to access Azure Resource Manager. | You want to deploy a web app. |
237+
| [Cognitive Services Contributor Role](/azure/role-based-access-control/built-in-roles#cognitive-services-contributor) | The Azure AI Search resource, to access Azure OpenAI resource. | You want to deploy a [web app](#using-the-web-app). |
246238

239+
## Virtual network support & private endpoint support (Azure AI Search only)
247240

248241

249242
### Azure OpenAI resources
@@ -260,45 +253,6 @@ Learn more about the [manual approval workflow](/azure/private-link/private-endp
260253

261254
After you approve the request in your search service, you can start using the [chat completions extensions API](/azure/ai-services/openai/reference#completions-extensions). Public network access can be disabled for that search service.
262255

263-
### Storage accounts
264-
265-
Storage accounts in virtual networks, firewalls, and private endpoints are supported by Azure OpenAI on your data. To use a storage account in a private network:
266-
267-
1. Ensure you have the system assigned managed identity principal enabled for your Azure OpenAI and Azure AI Search resources.
268-
1. Using the Azure portal, navigate to your resource, and select **Identity** from the navigation menu on the left side of the screen.
269-
1. Set **Status** to **On**.
270-
1. Perform these steps for both of your Azure OpenAI and Azure AI Search resources.
271-
272-
:::image type="content" source="../media/use-your-data/managed-identity.png" alt-text="A screenshot showing managed identity settings in the Azure portal." lightbox="../media/use-your-data/managed-identity.png":::
273-
274-
1. Navigate back to your storage account. Select **Access Control (IAM)** for your resource. Select **Add**, then **Add role assignment**. In the window that appears, add the **Storage Data Contributor** role to the storage resource for your Azure OpenAI and search resource's managed identity.
275-
1. Assign access to **Managed Identity**.
276-
1. If you have multiple search resources, Perform this step for each search resource.
277-
278-
:::image type="content" source="../media/use-your-data/add-role-assignment.png" alt-text="A screenshot showing the role assignment option in the Azure portal." lightbox="../media/use-your-data/add-role-assignment.png":::
279-
280-
1. If your storage account hasn't already been network restricted, go to networking tab and select **Enabled from selected virtual networks and IP addresses**.
281-
282-
:::image type="content" source="../media/use-your-data/enable-virtual-network.png" alt-text="A screenshot showing the option for enabling virtual networks in the Azure portal." lightbox="../media/use-your-data/enable-virtual-network.png":::
283-
284-
## Azure Role-based access controls (Azure RBAC)
285-
286-
To add a new data source to your Azure OpenAI resource, you need the following Azure RBAC roles.
287-
288-
289-
|Azure RBAC role | Which resource needs this role? | Needed when |
290-
|---------|---------|---------|
291-
| [Cognitive Services OpenAI Contributor](../how-to/role-based-access-control.md#cognitive-services-openai-contributor) | The Azure AI Search resource, to access Azure OpenAI resource. | You want to use Azure OpenAI on your data. |
292-
|[Search Index Data Reader](/azure/role-based-access-control/built-in-roles#search-index-data-reader) | The Azure OpenAI resource, to access the Azure AI Search resource. | You want to use Azure OpenAI on your data. |
293-
|[Search Service Contributor](/azure/role-based-access-control/built-in-roles#search-service-contributor) | The Azure OpenAI resource, to access the Azure AI Search resource. | You plan to create a new Azure AI Search index. |
294-
|[Storage Blob Data Contributor](/azure/role-based-access-control/built-in-roles#storage-blob-data-contributor) | You have an existing Blob storage container that you want to use, instead of creating a new one. | The Azure AI Search and Azure OpenAI resources, to access the storage account. |
295-
| [Cognitive Services OpenAI User](../how-to/role-based-access-control.md#cognitive-services-openai-user) | The web app, to access the Azure OpenAI resource. | You want to deploy a web app. |
296-
| [Contributor](/azure/role-based-access-control/built-in-roles#contributor) | Your subscription, to access Azure Resource Manager. | You want to deploy a web app. |
297-
| [Cognitive Services Contributor Role](/azure/role-based-access-control/built-in-roles#cognitive-services-contributor) | The Azure AI Search resource, to access Azure OpenAI resource. | You want to deploy a [web app](#using-the-web-app). |
298-
299-
300-
301-
302256
## Document-level access control (Azure AI Search only)
303257

304258
Azure OpenAI on your data lets you restrict the documents that can be used in responses for different users with Azure AI Search [security filters](/azure/search/search-security-trimming-for-azure-search-with-aad). When you enable document level access, the search results returned from Azure AI Search and used to generate a response will be trimmed based on user Microsoft Entra group membership. You can only enable document-level access on existing Azure AI Search indexes. To enable document-level access:

0 commit comments

Comments
 (0)