Skip to content

Conversation

@segraef
Copy link
Contributor

@segraef segraef commented Jan 9, 2026

This pull request updates the customer-managed keys (CMK) and user-assigned identity setup for AI Foundry in Azure. The main improvements clarify the prerequisites and deployment steps, fixes the construction and output of the Key Vault URI, and provide clearer instructions for parameter usage and key version extraction.

Documentation and Deployment Improvements:

  • Clarified prerequisites to specify that the Azure Key Vault must have a CMK RSA-2048 key already created, and the User-Assigned Managed Identity must have the Key Vault Crypto User role assigned.
  • Updated parameter documentation to note that the Key Vault URI is constructed automatically and that the Key Vault and CMK key must exist before deployment.
  • Added a note to the key version extraction step, instructing users to extract the last segment after the final '/' from the key's kid.

Key Vault URI Automation:

  • Fixed the cmk-encryption.bicep module to construct the Key Vault URI using environment().suffixes.keyvaultDns and output it as keyVaultUri. [1] [2]
  • Updated the main Bicep template to output the constructed keyVaultUri for downstream use.

This was producing a wrong Uri

var keyVaultUri = 'https://${keyVaultName}.${environment().suffixes.keyvaultDns}/'

adjusted it to

var keyVaultUri = 'https://${keyVaultName}${environment().suffixes.keyvaultDns}/'

@segraef
Copy link
Contributor Author

segraef commented Jan 9, 2026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant