You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/applied-ai-services/form-recognizer/managed-identities.md
+22-13Lines changed: 22 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ manager: nitinme
7
7
ms.service: applied-ai-services
8
8
ms.subservice: forms-recognizer
9
9
ms.topic: how-to
10
-
ms.date: 01/26/2022
10
+
ms.date: 02/22/2022
11
11
ms.author: lajanuar
12
12
ms.custom: ignite-fall-2021
13
13
---
@@ -17,17 +17,22 @@ ms.custom: ignite-fall-2021
17
17
> [!IMPORTANT]
18
18
> Azure RBAC (Azure role-based access control) assignment is currently in preview and not recommended for production workloads. Certain features may not be supported or have constrained capabilities. Azure RBAC assignments are used to grant permissions for managed identity.
19
19
20
-
## What is managed identity?
20
+
## What are managed identities?
21
21
22
-
Azure managed identity is a service principal. It creates an Azure Active Directory (Azure AD) identity and specific permissions for Azure managed resources. You can use a managed identity to grant access to any resource that supports Azure AD authentication. To grant access, assign a role to a managed identity using [Azure RBAC](../../role-based-access-control/overview.md) (Azure role-based access control). There's no added cost to use managed identity in Azure.
22
+
* Managed identities for Azure resources are service principals that create an Azure Active Directory (Azure AD) identity and specific permissions for Azure managed resources.
23
23
24
-
Managed identity supports both privately and publicly accessible Azure blob storage accounts. For storage accounts with public access, you can opt to use a shared access signature (SAS) to grant limited access. In this article, you'll learn to enable a system-assigned managed identity for your Form Recognizer instance.
24
+
* You can use managed identities **instead of a shared access signature (SAS) token** to grant access to any resource that supports Azure AD authentication. To grant access, assign a role to a managed identity using [Azure role-based access control (Azure RBAC)](../../role-based-access-control/overview.md).
25
+
26
+
* There's no added cost to use managed identity in Azure.
27
+
28
+
> [!TIP]
29
+
> Managed identities eliminate the need for you to manage credentials, including Shared Access Signature (SAS) tokens. Managed identities are a safer way to grant access to data without having credentials in your code.
25
30
26
31
## Private storage account access
32
+
27
33
> [!NOTE]
28
34
>
29
-
> Form Recognizer only supports system-assigned managed identities today. User-assigned managed identities is on the roadmap and will be enabled in the near future.
30
-
35
+
> Form Recognizer only supports system-assigned managed identities today. User-assigned managed identities is on the feature road map and will be enabled in the near future.
31
36
32
37
Private Azure storage account access and authentication are supported by [managed identities for Azure resources](../../active-directory/managed-identities-azure-resources/overview.md). If you have an Azure storage account, protected by a Virtual Network (VNet) or firewall, Form Recognizer can't directly access your storage account data. However, once a managed identity is enabled, Form Recognizer can access your storage account using an assigned managed identity credential.
33
38
@@ -82,6 +87,10 @@ In the following steps, we'll enable a system-assigned managed identity and gran
82
87
83
88
1. In the main window, toggle the **System assigned Status** tab to **On**.
84
89
90
+
## Grant access to your storage account
91
+
92
+
You need to grant Form Recognizer access to your storage account before it can create, read, or delete blobs. Now that you enabled Form Recognizer with a system-assigned managed identity, you can use Azure role-based access control (Azure RBAC), to give a managed identity (Form Recognizer) access to another resource (Azure storage)—just like any security principal. The **Storage Blob Data Reader** role gives Form Recognizer (represented by the system-assigned managed identity) read and list access to the blob container and data.
93
+
85
94
1. Under **Permissions** select **Azure role assignments**:
@@ -94,14 +103,14 @@ In the following steps, we'll enable a system-assigned managed identity and gran
94
103
>
95
104
> If you're unable to assign a role in the Azure portal because the Add > Add role assignment option is disabled or you get the permissions error, "you do not have permissions to add role assignment at this scope", check that you're currently signed in as a user with an assigned a role that has Microsoft.Authorization/roleAssignments/write permissions such as Owner or User Access Administrator at the Storage scope for the storage resource.
96
105
97
-
7. Next, you're going to assign a **Storage Blob Data Reader** role to your Form Recognizer service resource. In the **Add role assignment** pop-up window complete the fields as follows and select **Save**:
106
+
1. Next, you're going to assign a **Storage Blob Data Reader** role to your Form Recognizer service resource. In the **Add role assignment** pop-up window complete the fields as follows and select **Save**:
98
107
99
108
| Field | Value|
100
109
|------|--------|
101
-
|**Scope**|***Storage***|
102
-
|**Subscription**|***The subscription associated with your storage resource***.|
103
-
|**Resource**|***The name of your storage resource***|
104
-
|**Role**|***Storage Blob Data Reader***—allows for read access to Azure Storage blob containers and data.|
110
+
|**Scope**|**_Storage_**|
111
+
|**Subscription**|**_The subscription associated with your storage resource_**.|
112
+
|**Resource**|**_The name of your storage resource_**|
113
+
|**Role**|**_Storage Blob Data Reader_**—allows for read access to Azure Storage blob containers and data.|
105
114
106
115
:::image type="content" source="media/managed-identities/add-role-assignment-window.png" alt-text="Screenshot: add role assignments page in the Azure portal.":::
107
116
@@ -113,9 +122,9 @@ In the following steps, we'll enable a system-assigned managed identity and gran
113
122
114
123
:::image type="content" source="media/managed-identities/assigned-roles-window.png" alt-text="Screenshot: Azure role assignments window.":::
115
124
116
-
That's it! You've completed the steps to enable a system-assigned managed identity. With this identity credential, you can grant Form Recognizer-specific access rights to documents and files stored in your BYOS account.
125
+
That's it! You've completed the steps to enable a system-assigned managed identity. With managed identity and Azure RBAC, you granted Form Recognizerspecific access rights to documents and files stored in your storage resource without having to manage credentials, such as SAS tokens.
> [Access Azure Storage form a web app using managed identities](/azure/app-service/scenario-secure-app-access-storage?toc=/azure/applied-ai-services/form-recognizer/toc.json&bc=/azure/applied-ai-services/form-recognizer/breadcrumb/toc.json)
Copy file name to clipboardExpand all lines: articles/cognitive-services/Translator/document-translation/managed-identity.md
+28-22Lines changed: 28 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,27 +1,32 @@
1
1
---
2
-
title: Create and use managed identity
2
+
title: Create and use managed identities
3
3
titleSuffix: Azure Cognitive Services
4
-
description: Understand how to create and use managed identity in the Azure portal
4
+
description: Understand how to create and use managed identities in the Azure portal
5
5
author: laujan
6
6
manager: nitinme
7
7
ms.service: cognitive-services
8
8
ms.subservice: translator-text
9
9
ms.topic: how-to
10
-
ms.date: 09/09/2021
10
+
ms.date: 02/22/2022
11
11
ms.author: lajanuar
12
12
---
13
13
14
-
# Create and use managed identity
14
+
# Create and use managed identities
15
15
16
16
> [!IMPORTANT]
17
17
>
18
-
> Managed identity for Document Translation is currently unavailable in the global region. If you intend to use managed identity for Document Translation operations, [create your Translator resource](https://portal.azure.com/#create/Microsoft.CognitiveServicesTextTranslation) in a non-global Azure region.
18
+
> Managed identities for Azure resources is currently unavailable for Document Translation service in the global region. If you intend to use managed identities for Document Translation operations, [create your Translator resource](https://portal.azure.com/#create/Microsoft.CognitiveServicesTextTranslation) in a non-global Azure region.
19
19
20
-
## What is managed identity?
20
+
## What are managed identities?
21
21
22
-
Azure managed identity is a service principal that creates an Azure Active Directory (Azure AD) identity and specific permissions for Azure managed resources. You can use a managed identity to grant access to any resource that supports Azure AD authentication. To grant access, assign a role to a managed identity using [Azure role-based access control](../../../role-based-access-control/overview.md) (Azure RBAC). There is no added cost to use managed identity in Azure.
22
+
* Managed identities for Azure resources are service principals that create an Azure Active Directory (Azure AD) identity and specific permissions for Azure managed resources.
23
23
24
-
Managed identity supports both privately and publicly accessible Azure blob storage accounts. For storage accounts **with public access**, you can opt to use a shared access signature (SAS) to grant limited access. In this article, we will examine how to manage access to translation documents in your Azure blob storage account using system-assigned managed identity.
24
+
* You can use managed identities **instead of a shared access signature (SAS) tokey** to grant access to any resource that supports Azure AD authentication, including your own applications. To grant access, assign a role to a managed identity using [Azure role-based access control (Azure RBAC)](../../../role-based-access-control/overview.md).
25
+
26
+
* There's no added cost to use managed identities in Azure.
27
+
28
+
> [!TIP]
29
+
> Managed identities eliminate the need for you to manage credentials, including Shared Access Signature (SAS) tokens. Managed identities are a safer way to grant access to data without having credentials in your code.
25
30
26
31
## Prerequisites
27
32
@@ -43,17 +48,17 @@ To get started, you'll need:
43
48
* In the main window, select **Allow access from Selected networks**.
44
49
:::image type="content" source="../media/managed-identities/firewalls-and-virtual-networks.png" alt-text="Screenshot: Selected networks radio button selected.":::
45
50
46
-
* On the selected networks page navigate to the **Exceptions** category and make certain that the [**Allow Azure services on the trusted services list to access this storage account**](../../../storage/common/storage-network-security.md?tabs=azure-portal#manage-exceptions) checkbox is enabled.
51
+
* On the selected networks page, navigate to the **Exceptions** category and make certain that the [**Allow Azure services on the trusted services list to access this storage account**](../../../storage/common/storage-network-security.md?tabs=azure-portal#manage-exceptions) checkbox is enabled.
There are two types of managed identity: **system-assigned** and **user-assigned**. Currently, Document Translation is supported by system-assigned managed identity. A system-assigned managed identity is **enabled** directly on a service instance. It is not enabled by default; you must go to your resource and update the identity setting. The system-assigned managed identity is tied to your resource throughout its lifecycle. If you delete your resource, the managed identity will be deleted as well.
57
+
There are two types of managed identities: **system-assigned** and **user-assigned**. Currently, Document Translation is supported by system-assigned managed identities. A system-assigned managed identity is **enabled** directly on a service instance. It isn't enabled by default; you must go to your resource and update the identity setting. The system-assigned managed identity is tied to your resource throughout its lifecycle. If you delete your resource, the managed identity will be deleted as well.
53
58
54
59
In the following steps, we'll enable a system-assigned managed identity and grant your Translator resource limited access to your Azure blob storage account.
55
60
56
-
## Enable a system-assigned managed identity using the Azure portal
61
+
## Enable a system-assigned managed identity
57
62
58
63
>[!IMPORTANT]
59
64
>
@@ -69,6 +74,10 @@ In the following steps, we'll enable a system-assigned managed identity and gran
69
74
70
75
1. In the main window, toggle the **System assigned Status** tab to **On**.
71
76
77
+
## Grant access to your storage account
78
+
79
+
You need to grant Translator access to your storage account before it can create, read, or delete blobs. Now that you enabled Translator with a system-assigned managed identity, you can use Azure role-based access control (Azure RBAC), to give a managed identity (Translator) access to another resource (Azure storage), just like any security principal. The **Storage Blob Data Contributor** role gives Translator (represented by the system-assigned managed identity) read, write, and delete access to the blob container and data.
80
+
72
81
1. Under **Permissions** select **Azure role assignments**:
@@ -85,27 +94,24 @@ In the following steps, we'll enable a system-assigned managed identity and gran
85
94
86
95
| Field | Value|
87
96
|------|--------|
88
-
|**Scope**|***Storage***.|
89
-
|**Subscription**|***The subscription associated with your storage resource***.|
90
-
|**Resource**|***The name of your storage resource***.|
91
-
|**Role**|***Storage Blob Data Contributor***.|
97
+
|**Scope**|**_Storage_**.|
98
+
|**Subscription**|**_The subscription associated with your storage resource_**.|
99
+
|**Resource**|**_The name of your storage resource_**.|
100
+
|**Role**|**_Storage Blob Data Contributor_**.|
92
101
93
102
:::image type="content" source="../media/managed-identities/add-role-assignment-window.png" alt-text="Screenshot: add role assignments page in the Azure portal.":::
94
103
95
-
1. After you've received the _Added Role assignment_ confirmation message, refresh the page to see the added role assignment.
104
+
1. After you've received the _Added Role assignment_ confirmation message, refresh the page to see the added role assignment.
96
105
97
106
:::image type="content" source="../media/managed-identities/add-role-assignment-confirmation.png" alt-text="Screenshot: Added role assignment confirmation pop-up message.":::
98
107
99
108
1. If you don't see the change right away, wait and try refreshing the page once more. When you assign or remove role assignments, it can take up to 30 minutes for changes to take effect.
100
109
101
110
:::image type="content" source="../media/managed-identities/assigned-roles-window.png" alt-text="Screenshot: Azure role assignments window.":::
102
111
103
-
Great! You have completed the steps to enable a system-assigned managed identity. With this identity credential, you can grant Translator specific access rights to your storage resource.
112
+
Great! You've completed the steps to enable a system-assigned managed identity. With managed identity and Azure RBAC, you granted Translator specific access rights to your storage resource without having to manage credentials such as SAS tokens.
104
113
105
114
## Next steps
106
115
107
116
> [!div class="nextstepaction"]
108
-
> [Managed identities for Azure resources: frequently asked questions](../../../active-directory/managed-identities-azure-resources/managed-identities-faq.md)
109
-
110
-
> [!div class="nextstepaction"]
111
-
>[Use managed identities to acquire an access token](../../../app-service/overview-managed-identity.md?tabs=dotnet#configure-target-resource)
117
+
> [Access Azure Storage from a web app using managed identities](/azure/app-service/scenario-secure-app-access-storage?toc=/azure/cognitive-services/translator/toc.json&bc=/azure/cognitive-services/translator/breadcrumb/toc.json)
0 commit comments