You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/communication-services/concepts/authentication.md
+8-14Lines changed: 8 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Authenticate to Azure Communication Services
3
-
titleSuffix: An Azure Communication Services concept document
4
-
description: Learn about the various ways an app or service can authenticate to Communication Services.
3
+
titleSuffix: An Azure Communication Services article
4
+
description: This article describes how you can use an app or service to authenticate to Communication Services.
5
5
author: tophpalmer
6
6
7
7
manager: chpalm
@@ -34,15 +34,15 @@ The following table shows the Azure Communication Services SDKs and their authen
34
34
| Calling | User Access Token |
35
35
| Chat | User Access Token |
36
36
37
-
Each authorization option is briefly described below:
37
+
Each authorization option is briefly described as follows:
38
38
39
39
### Access Key
40
40
41
-
Access key authentication is suitable for service applications running in a trusted service environment. Your access key can be found in the Azure Communication Services portal. The service application uses it as a credential to initialize the corresponding SDKs. See an example of how it is used in the [Identity SDK](../quickstarts/identity/access-tokens.md).
41
+
Access key authentication is suitable for service applications running in a trusted service environment. Your access key can be found in the Azure Communication Services portal. The service application uses it as a credential to initialize the corresponding SDKs. See an example of how it's used in the [Identity SDK](../quickstarts/identity/access-tokens.md).
42
42
43
43
Since the access key is part of the connection string of your resource, authentication with a connection string is equivalent to authentication with an access key.
44
44
45
-
If you wish to call Azure Communication Services' APIs manually using an access key, then you will need to sign the request. Signing the request is explained, in detail, within a [tutorial](../tutorials/hmac-header-tutorial.md).
45
+
If you wish to call Azure Communication Services' APIs manually using an access key, then you need to sign the request. Signing the request is explained, in detail, within a [tutorial](../tutorials/hmac-header-tutorial.md).
46
46
47
47
<aname='azure-ad-authentication'></a>
48
48
@@ -52,23 +52,17 @@ To set up a service principal, [create a registered application from the Azure C
52
52
53
53
Communication services supports Microsoft Entra ID authentication for Communication services resources. You can find more details, about the managed identity support in the [How to use Managed Identity with Azure Communication Services](/azure/communication-services/how-tos/managed-identity).
54
54
55
-
56
-
57
-
58
-
59
55
### Microsoft Entra ID Authentication
60
56
61
57
The Azure platform provides role-based access (Azure RBAC) to control access to resources. Azure RBAC security principal represents a user, group, service principal, or managed identity that is requesting access to Azure resources. Microsoft Entra ID authentication provides superior security and ease of use over other authorization options.
62
58
63
59
-**Managed Identity:**
64
60
- By using managed identity, you avoid having to store your account access key within your code, as you do with Access Key authorization. Managed identity credentials are fully managed, rotated, and protected by the platform, reducing the risk of credential exposure.
65
61
- Managed identities can authenticate to Azure services and resources that support Microsoft Entra ID authentication. This method provides a seamless and secure way to manage credentials.
66
-
- For more information on how to use Managed Identity with Azure Communication Services, refer to [This Guide](/azure/communication-services/how-tos/managed-identity).
67
-
68
-
62
+
- For more information about using Managed Identity with Azure Communication Services, see [Managed Identity](../how-tos/managed-identity.md).
69
63
70
64
-**Service Principal:**
71
-
- To set up a service principal [create a registered application from the Azure CLI](../quickstarts/identity/service-principal.md?pivots=platform-azcli). Then, the endpoint and credentials can be used to authenticate the SDKs.
65
+
- To set up a service principal [create a registered application from the Azure CLI](../quickstarts/identity/service-principal.md?pivots=platform-azcli). Then, you can use the endpoint and credentials to authenticate the SDKs.
72
66
- See examples of how [service principal](../quickstarts/identity/service-principal.md) is used.
73
67
74
68
Communication Services supports Microsoft Entra ID authentication for Communication Services resources, While you can continue to use Access Key authorization with communication services applications, Microsoft recommends moving to Microsoft Entra ID where possible.
@@ -78,7 +72,7 @@ Use our [Trusted authentication service hero sample](../samples/trusted-auth-sam
78
72
79
73
### User Access Tokens
80
74
81
-
User access tokens are generated using the Identity SDK and are associated with users created in the Identity SDK. See an example of how to [create users and generate tokens](../quickstarts/identity/access-tokens.md). Then, user access tokens are used to authenticate participants added to conversations in the Chat or Calling SDK. For more information, see [add chat to your app](../quickstarts/chat/get-started.md). User access token authentication is different compared to access key and Microsoft Entra authentication in that it is used to authenticate a user rather than a secured Azure resource.
75
+
User access tokens are generated using the Identity SDK and are associated with users created in the Identity SDK. See an example of how to [create users and generate tokens](../quickstarts/identity/access-tokens.md). Then, user access tokens are used to authenticate participants added to conversations in the Chat or Calling SDK. For more information, see [add chat to your app](../quickstarts/chat/get-started.md). User access token authentication is different compared to access key and Microsoft Entra authentication in that it's used to authenticate a user rather than a secured Azure resource.
title: European Union Data Boundary compliance for Azure Communication Services
3
-
description: Learn about how Azure Communication Services meets European Union data handling compliance laws
3
+
titleSuffix: An Azure Communication Services article
4
+
description: This article describes how Azure Communication Services meets European Union data handling compliance laws
4
5
author: hrazi
5
6
manager: mharbut
6
7
services: azure-communication-services
@@ -14,47 +15,48 @@ ms.custom: references_regions
14
15
15
16
# European Union Data Boundary (EUDB)
16
17
17
-
Azure Communication Services complies with European Union Data Boundary (EUDB) [announced by Microsoft Dec 15, 2022](https://blogs.microsoft.com/eupolicy/2022/12/15/eu-data-boundary-cloud-rollout/).
18
+
Azure Communication Services complies with European Union Data Boundary (EUDB) [announced by Microsoft December 15, 2022](https://blogs.microsoft.com/eupolicy/2022/12/15/eu-data-boundary-cloud-rollout/).
18
19
19
-
This boundary defines data residency and processing rules for resources based on the data location selected when creating a new communication resource. When a data location for a resource is one of the European countries/regions in scope of EUDB, then all processing and storage of personal data remain within the European Union. The EU Data Boundary consists of the countries/regions in the European Union (EU) and the European Free Trade Association (EFTA). The EU countries/regions are Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden; and the EFTA countries/regions are Liechtenstein, Iceland, Norway, and Switzerland.
20
+
This boundary defines data residency and processing rules for resources based on the data location selected when creating a new communication resource. When a data location for a resource is one of the European countries/regions in scope of EUDB, then all processing and storage of personal data remain within the European Union.
21
+
22
+
The EU Data Boundary consists of the countries/regions in the European Union (EU) and the European Free Trade Association (EFTA). The EU countries/regions are: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden. The EFTA countries/regions are: Liechtenstein, Iceland, Norway, and Switzerland.
20
23
21
24
## Calling
22
25
23
-
Calls and meetings can be established in various ways by various users. We define a few terms:
26
+
Users can establish calls and meetings in various ways. We define a few terms:
24
27
- Organizer: person who created the meeting, for example, set it up using Outlook
25
28
- Initiator: the first person who joins the meeting (the meeting only exists as a calendar item before the first person joins it)
26
-
- Guest: a participant who isn't a member of the tenant of the Organizer. May include a member of a different tenant, PSTN (dial-in) user, etc. (Note that this use of Guest is specific to this description and broader than used within IC3 generally, but useful for the discussion here)
27
-
- Call: refers to a 1:1 call and\or to a Group call to a larger group. For the purposes of this conversation, they should be the same.
28
-
- Real Time Text: RTT is an accessibility compliance requirement for voice and video platforms in the EU. You can find more information about this here: [Directive 2019/882](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L0882)
29
+
- Guest: a participant who isn't a member of the tenant of the Organizer. May include a member of a different tenant, PSTN (dial-in) user, and so on. In this article, *guest*is specific to this description and broader than used within IC3 generally.
30
+
- Call: refers to a 1:1 call and\or to a Group call to a larger group. For the purposes of this conversation, they should be the same.
31
+
- Real Time Text (RTT): is an accessibility compliance requirement for voice and video platforms in the EU. For more information, see: [Directive 2019/882](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L0882).
29
32
30
-
For EU communication resources, when the organizer, initiator, or guests join a call from the EU, processing and storage of personal data will be limited to the EU.
33
+
For EU communication resources, when the organizer, initiator, or guests join a call from the EU, processing and storage of personal data is limited to the EU.
31
34
32
35
## SMS
33
36
34
-
Azure Communication Services guarantees that SMS data within the EUDB is stored in EUDB regions. As of today, we process and store data in the Netherlands, Ireland or Switzerland regions, ensuring no unauthorized data transfer outside the EEA (European Economic Area).
37
+
Azure Communication Services guarantees that SMS data within the EUDB is stored in EUDB regions. As of today, we process and store data in the Netherlands, Ireland, or Switzerland regions, ensuring no unauthorized data transfer outside the EEA (European Economic Area).
35
38
Also, Azure Communication Services employs advanced security measures, including encryption, to protect SMS data both at rest and in transit. Customers can select their preferred data residency within the EUDB, making sure data remains within the designated EU regions.
36
39
37
40
#### SMS EUDB FAQ
38
41
39
42
**What happens with SMS data in the UK?**
40
43
41
-
While the UK is no longer part of the EU, Azure Communication Services processes data for the UK within the EUDB. As of today, data processing and storage occur within the Netherlands, Ireland or Switzerland regions, maintaining compliance with EU regulations.
44
+
While the UK is no longer part of the EU, Azure Communication Services processes data for the UK within the EUDB. As of today, data processing and storage occur within the Netherlands, Ireland, or Switzerland regions, maintaining compliance with EU regulations.
42
45
43
46
**What happens when an SMS recipient is outside the EU?**
44
47
45
-
If an SMS recipient is outside the EU, the core data processing and storage remain within the EUDB (Netherlands, Ireland or Switzerland regions). However, for the SMS to be delivered, it may be routed through networks outside the EU, depending on the recipient's location and carrier, which is necessary for successful message delivery.
48
+
If an SMS recipient is outside the EU, the core data processing and storage remain within the EUDB (Netherlands, Ireland, or Switzerland regions). However, for the SMS to be delivered, it may be routed through networks outside the EU, depending on the recipient's location and carrier, which is necessary for successful message delivery.
46
49
47
50
**Can data be transferred to non-EU regions under any circumstances?**
48
51
49
-
Yes, to deliver SMS to recipients outside the EU, some data routing may occur outside the EUDB, but this is strictly for message delivery purposes. Data processing and storage at rest still comply with the EUDB regulations.
52
+
Yes, to deliver SMS to recipients outside the EU, some data routing may occur outside the EUDB. This routing is strictly for message delivery purposes. Data processing and storage at rest still comply with the EUDB regulations.
50
53
51
54
52
55
## Messaging
53
56
54
-
All threads created from an EU resource will process and storage personal data in the EU.
57
+
All threads created from an EU resource process and store personal data in the EU.
55
58
56
59
57
-
## Other resources
60
+
## Related articles
58
61
59
-
For more information, please refer to the Microsoft documentation on the EUDB:
60
-
-[Microsoft EU Data Boundary Overview](https://www.microsoft.com/en-us/trust-center/privacy/european-data-boundary-eudb)
62
+
For more information, see [Microsoft EU Data Boundary Overview](https://www.microsoft.com/en-us/trust-center/privacy/european-data-boundary-eudb).
Azure Communication Services (ACS) can be used within [Azure Government](https://azure.microsoft.com/global-infrastructure/government/) to provide compliance with US government requirements for cloud services. In addition to enjoying the features and capabilities of Messaging, Voice and Video calling, developers benefit from the following features that are unique to Azure Government:
19
+
You can use Azure Communication Services within [Azure Government](https://azure.microsoft.com/global-infrastructure/government/) to provide compliance with US government requirements for cloud services. In addition to enjoying the features and capabilities of Messaging, Voice and Video calling, developers benefit from the following features that are unique to Azure Government:
22
20
- Your personal data is logically segregated from customer content in the commercial Azure cloud.
23
21
- Your resource’s customer content is stored within the United States.
24
22
- Access to your organization's customer content is restricted to screened Microsoft personnel.
25
23
26
-
Azure Communication Services in Azure Government is currently In Process for the FedRAMP High accreditation as part of the [M365 GCC-High service offering](https://marketplace.fedramp.gov/products/FR1824057433). Once the FedRAMP High certification process is completed and the authorization is granted, Azure Communication Services in the Azure Government cloud will GA and be officially recognized as meeting the requirements set forth by the FedRAMP, providing government customers with the confidence that the service is secure and compliant with federal standards.
24
+
Azure Communication Services in Azure Government is currently In Process for the FedRAMP High accreditation as part of the [Microsoft 365 Government Community Cloud (GCC) - High service offering](https://marketplace.fedramp.gov/products/FR1824057433). Once the FedRAMP High certification process is completed and the authorization is granted, Azure Communication Services in the Azure Government cloud moves to GA. Then the government services officially meet the requirements of FedRAMP. Government customers can then use the service that is secure and compliant with federal standards.
25
+
26
+
## General availability and feature releases
27
27
28
-
## General Availability and Upcoming Feature Releases
29
-
Azure Communication Services for US Government is scheduled for General Availability (GA) in 2025. The initial release will focus on delivering core capabilities, including basic video calling and messaging, to provide government customers with a secure and compliant communication solution.
28
+
Azure Communication Services for US Government is scheduled for General Availability (GA) in 2025. The initial release focuses on delivering core capabilities, including basic video calling and messaging, to provide government customers with a secure and compliant communication solution.
30
29
31
-
Additional advanced features, such as:
30
+
Following GA, we expect to release advanced features such as:
32
31
- Call Logs
33
32
- Call Records
34
33
- Transcriptions
35
34
- Live Captions
36
35
- Email Integration
37
-
will be introduced in a subsequent release later in 2025, following GA. Azure Communication Services is committed to releasing these features as part of its roadmap, ensuring feature parity with Azure Communication Services Commercial within six months of each feature becoming available in the commercial cloud.
38
36
39
-
You can find more information about the Office 365 Government – GCC High offering for US Government customers at [Office 365 Government plans](https://products.office.com/government/compare-office-365-government-plans). Please see [eligibility requirements](https://azure.microsoft.com/global-infrastructure/government/how-to-buy/) for Azure Government.
37
+
Azure Communication Services is committed to releasing these features as part of its roadmap. Regular releases ensure feature parity with Azure Communication Services Commercial within six months of each feature becoming available in the commercial cloud.
38
+
39
+
## Related articles
40
+
41
+
-[Office 365 Government plans](https://www.microsoft.com/en-us/microsoft-365/enterprise/government-plans-and-pricing)
42
+
43
+
-[Office 365 GCC High and DoD](/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc-high-and-dod)
44
+
45
+
-[Eligibility requirements for Azure Government](https://azure.microsoft.com/en-us/explore/global-infrastructure/government/how-to-buy/)
0 commit comments