Plan and manage an Azure AI solution 1.3 Manage, monitor, and secure AI systems
Security policy says every Foundry and Foundry Tools resource in a subscription…
Study guide skill: Configure security, including managed identity, private networking, keyless credentials, and role policies
Question B3-003
Security policy says every Foundry and Foundry Tools resource in a subscription, including resources created later, must accept only Microsoft Entra ID authentication and never API keys. Which two actions should you take? (Choose two.)
Select 2 answers.
Answer: C, E
You can enforce Entra-only access for a group of resources with the built-in Azure Policy that requires key access to be disabled, and you can set disableLocalAuth to true in Bicep or ARM templates when you create resources. The change isn't immediate: the gateway can accept previously valid keys until its cached configuration refreshes, so verify that an old key gets HTTP 401. Setting -DisableLocalAuth to $false re-enables keys, and PowerShell and templates are both supported ways to make this change.
Deep dive
How it works
Foundry and Foundry Tools resources accept two kinds of credentials: keys (local authentication) and Microsoft Entra ID. To make a resource Entra-only, you disable local authentication. Which method fits depends on scope:
- A group of resources, now and later: the built-in Azure Policy "Azure AI Services resources should have key access disabled (disable local authentication)". Assign it at subscription or resource group level, and it enforces the setting for every resource in scope, including new ones.
- Resources you create with infrastructure as code: set the disableLocalAuth property to true in the Bicep or ARM template.
- One existing resource: PowerShell (Set-AzCognitiveServicesAccount).
Don't treat the switch as instant. The gateway can keep accepting previously valid keys until its cached configuration refreshes. That usually takes a few minutes but can take several hours. Before you call it done, send a data-plane request with an old key and confirm you get HTTP 401.
Disabling local auth means every client must use Entra ID, so assign RBAC roles to apps and users before you flip the policy.
The other options, and when you'd use them
- Assume old keys stop immediately: The gateway can accept previously valid keys until its cache refreshes. The guidance is to verify an HTTP 401 with the old key.
- -DisableLocalAuth $false: That's the command to re-enable local authentication, the opposite of what's needed.
- Portal only: Templates and PowerShell are both documented ways to disable local authentication.
Exam tip
Entra-only for a whole subscription = Azure Policy (key access disabled) + disableLocalAuth: true in templates. Then verify: an old key must return 401.
References
Last reviewed: