Scribd
Upload
61 views20 pages

03 Secure Azure AI Services

Secure Azure AI services

Uploaded by

nelajala nelajala
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
61 views20 pages

03 Secure Azure AI Services

Secure Azure AI services

Uploaded by

nelajala nelajala
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 20

Introductio

n
• Azure AI services provides multiple layers of security that you should
consider when implementing a solution.

• After completing this module, you'll learn how to:

• Consider authentication for Azure AI services.

• Manage network security for Azure AI services.


Consider
authentication
• By default, access to Azure AI services resources is restricted by using subscription
keys. Management of access to these keys is a primary consideration for security.

Regenerate keys
• You should regenerate keys regularly to protect against the risk of keys
being shared with or accessed by unauthorized users. You can regenerate
keys using the Azure portal, or using the az cognitiveservices account
keys regenerate Azure command-line interface (CLI) command.

• Each AI service is provided with two keys, enabling you to regenerate keys
without service interruption. To accomplish this:
Consider
authentication
Regenerate keys
• If you're using both keys in production, change your code so that only one
key is in use. For example, configure all production applications to use key
1.
• Regenerate key 2.
• Switch all production applications to use the newly regenerated key 2.
• Regenerate key 1
• Finally, update your production code to use the new key 1.

• For example, to regenerate keys in the Azure portal, you can do the
following:

• In the Azure portal, go to your resource's Keys and Endpoint pane.


• Then select Regenerate Key1 or select Regenerate Key2, depending on
which one you want to regenerate at the time.
Consider
authentication
Protect keys with Azure Key
Vault
• Azure Key Vault is a service that securely stores
secrets like passwords and keys, accessible to
authenticated user identities via Microsoft Entra
ID.

• Administrators can assign these identities to


applications, creating managed identities (service
principals), allowing applications to access secrets
without hard-coding them.

• This approach reduces the risk of compromising


secrets.

• For example, subscription keys for AI services can


be stored in Azure Key Vault, and client
applications can retrieve these keys securely
using managed identities, preventing
unauthorized access.
Consider
authentication
Token-based authentication
• When using the REST interface, some AI services support (or even require)
token-based authentication.

• In these cases, the subscription key is presented in an initial request to


obtain an authentication token, which has a valid period of 10 minutes.
Subsequent requests must present the token to validate that the caller has
been authenticated.
Microsoft Entra ID authentication
• Azure AI services supports Microsoft Entra ID authentication, enabling you
to grant access to specific service principals or managed identities for apps
and services running in Azure.

• There are different ways you can authenticate against Azure AI services
using Microsoft Entra ID, including:
Consider
authentication
Microsoft Entra ID authentication
• Authenticate using service principals
• The overall process to authenticate against Azure AI services using service
principals is as follows:
• Create a custom subdomain

• You can create a custom subdomain in different ways including through


the Azure portal, Azure CLI, or PowerShell.

• For example, you can create a subdomain using PowerShell in the Azure
Cloud Shell.

• To do this, you select your subscription using the following command:


Set-AzContext -SubscriptionName <Your-Subscription-Name>
Consider
authentication
Microsoft Entra ID authentication
• Authenticate using service principals
• Create a custom subdomain
• Then, you create your Azure AI services resource specifying a custom
subdomain by running the following:
$account = New-AzCognitiveServicesAccount -ResourceGroupName
<your-resource-group-name> -name <your-account-name> -Type
<your-account-type> -SkuName <your-sku-type> -Location <your-
region> -CustomSubdomainName <your-unique-subdomain-name>
• Once created, your subdomain name will be returned in the response.
Consider
authentication
Microsoft Entra ID authentication
• Authenticate using service principals
• Assign a role to a service principal
• You've created an Azure AI resource that is linked with a custom
subdomain. Next, you assign a role to a service principal.
• To start, you'll need to register an application. To do this, you run the
following command:
$SecureStringPassword = ConvertTo-SecureString -String <your-
password> -AsPlainText -Force

$app = New-AzureADApplication -DisplayName <your-app-display-


name> -IdentifierUris <your-app-uris> -PasswordCredentials
$SecureStringPassword
• This creates the application resource.
Consider
authentication
Microsoft Entra ID authentication
• Authenticate using service principals
• Assign a role to a service principal
• Then you use the New-AzADServicePrincipal command to create a
service principal and provide your application's ID:

New-AzADServicePrincipal -ApplicationId <app-id>

• Finally, you assign the Cognitive Services Users role to your service
principal by running:

New-AzRoleAssignment -ObjectId <your-service-principal-object-id> -


Scope <account-id> -RoleDefinitionName "Cognitive Services User"
Consider
authentication
Microsoft Entra ID authentication
• Authenticate using managed identities
• Managed identities come in two types:

• System-assigned managed identity: A managed identity is created and


linked to a specific resource, such as a virtual machine that needs to access
Azure AI services. When the resource is deleted, the identity is deleted as
well.

• User-assigned managed identity: The managed identity is created to be


useable by multiple resources instead of being tied to one. It exists
independently of any single resource.

• You can assign each type of managed identity to a resource either during
creation of the resource, or after it has already been created.
Consider
authentication
Microsoft Entra ID authentication
• Authenticate using managed identities

• For example, suppose you have a virtual machine in Azure that you intend to
use for daily access to Azure AI services.

• To enable a system-assigned identity for this virtual machine, first you make
sure your Azure account has the Virtual Machine Contributor role.

• Then you can run the following command using Azure CLI in the Azure Cloud
Shell terminal:

az vm identity assign -g <my-resource-group> -n <my-vm>


Consider
authentication
Microsoft Entra ID authentication
• Authenticate using managed identities
Then you can grant access to Azure AI services in the Azure portal using the
following:

1. Go to the Azure AI services resource you want to grant the virtual machine's
managed identity access.

2. In the overview panel, select Access control (IAM).

3. Select Add, and then select Add role assignment.

4. In the Role tab, select Cognitive Services Contributor.


Consider
authentication
Microsoft Entra ID authentication
• Authenticate using managed identities
Consider
authentication
Microsoft Entra ID authentication
• Authenticate using managed identities

5. In the Members tab,


for the Assign access
to, select Managed
identity. Then,
select + Select
members.
Consider
authentication
Microsoft Entra ID authentication
• Authenticate using managed identities
6. Ensure that your subscription is selected in the Subscription dropdown.
And for Managed identity, select Virtual machine.

7. Select your virtual machine in the list, and select Select.

8. Finally, select Review + assign to review, and then Review +


assign again to finish.
Implement network
•security
Network security is an important measure to ensure unauthorized users
can't reach the services that you are protecting.

• Limiting what users can see is always a great idea, since they can’t
compromise what they can’t see.

Apply network access


restrictions
• By default, Azure AI services are accessible from all networks. Some
individual AI services resources (such as Azure AI Face service, Azure AI
Vision, and others) can be configured to restrict access to specific
network addresses - either public Internet addresses or addresses on
virtual networks.
Implement network
security
• With network restrictions enabled, a
client trying to connect from an IP
address that isn't allowed will
receive an Access Denied error.
Exercise - Manage Azure AI Services
Security
Knowledge check
1. You need to regenerate the primary subscription key for an Azure AI Services
resource that an app uses. What should you do first to minimize service
interruption for the app?

a) Switch the app to use the secondary key


b) Change the resource endpoint
c) Enable a firewall

2. You want to store the subscription keys for an Azure AI Services resource
securely, so that authorized apps can retrieve them when needed. What kind of
Azure resource should you provision.
d) Azure Storage
e) Azure Key Vault
f) Azure App Service
Knowledge check
3. When running code on your computer that connects to Azure AI Services, you
receive an error that access is denied due to Virtual Network/Firewall rules.
What configuration do you need to set in the Azure AI Services instance?

a) In the Networking properties, configure Selected Networks and Private


Endpoints.
b) In Networking properties, add your client IP address to the Firewall
allowed list.
c) In Access control, add your Microsoft Entra ID user account to a role.

You might also like