Plan and manage an Azure AI solution 1.3 Manage, monitor, and secure AI systems
A Python web app hosted on Azure App Service must call an Azure OpenAI deployment without…
Study guide skill: Configure security, including managed identity, private networking, keyless credentials, and role policies
Question B1-006
A Python web app hosted on Azure App Service must call an Azure OpenAI deployment without storing any API keys. The same code should also work on developers' laptops after they run az login. What should you do?
Select one answer.
Answer: B
With Microsoft Entra ID, the app requests a short-lived token for an identity that holds a role such as Cognitive Services OpenAI User. DefaultAzureCredential uses the az login session locally and the managed identity in Azure, so the same code works in both places. Reader on the resource group doesn't grant inference data actions, and keys or SAS tokens aren't keyless.
Deep dive
How it works
Microsoft Entra ID lets you call an Azure OpenAI resource without storing an API key. Instead of a key, your code requests a short-lived access token for an identity that you've granted a role on the resource. A managed identity is one kind of Entra identity: Azure creates it, assigns it to a resource such as a web app, and rotates its credentials for you, so there's no secret to store or rotate.
For inference calls, assign the Cognitive Services OpenAI User or Cognitive Services OpenAI Contributor role on the Azure OpenAI resource, to developers and to the app's managed identity. Then use DefaultAzureCredential from the Azure Identity library. It tries a chain of credentials in order and uses the first one it finds: on a laptop it picks up the az login session, and on an Azure host it picks up the managed identity. That's why the same code works in both places.
Two practical details: Entra ID authentication needs a custom subdomain on the resource, and role assignments can take up to five minutes to take effect, so a 403 right after assigning a role may just need a retry.
The other options, and when you'd use them
- Reader role plus the client ID as the api-key header: The roles the docs name for inference calls are Cognitive Services OpenAI User or Contributor. With Entra ID, the client sends a bearer token in the Authorization header, and no API key is created, stored or transmitted.
- A SAS token generated from the resource keys: This still depends on keys, which is what the requirement rules out. Entra ID's point is calling the resource without storing an API key.
- API key in an app setting, rotated monthly: This still stores a key. A service principal is the identity for CI/CD pipelines and non-Azure hosts, but even then you rotate a client secret or certificate.
Exam tip
"No keys" plus "same code locally and in Azure" means managed identity, an OpenAI User role and DefaultAzureCredential. Use system-assigned for one resource, and user-assigned when several resources share one identity.
References
Last reviewed: