Security & Authentication

Security terms you must know

All of these appear in exam questions. Learn them before the concepts below use them.

Three layers of security you need to understand

Azure AI security works in three independent layers. The exam tests all three separately and in combination. Understand each layer clearly before diving into the details.

Four ways to authenticate to an Azure AI service

The exam presents scenarios and asks which authentication method is most appropriate. Each method has a specific use case. Learn the pattern for each.

Python code for each authentication method

# Import modules (from Topic 1 and Topic 2)
import os
from azure.ai.textanalytics import TextAnalyticsClient
from azure.core.credentials import AzureKeyCredential

# Read key and endpoint from environment variables (never hard-code!)
key      = os.environ.get("LANGUAGE_KEY")
endpoint = os.environ.get("LANGUAGE_ENDPOINT")

# AzureKeyCredential wraps your key into the format Azure expects
credential = AzureKeyCredential(key)

# Create the client using API key authentication
client = TextAnalyticsClient(endpoint=endpoint, credential=credential)

print("Authenticated with API Key ✅")

# azure-identity provides credential classes for all Entra ID-based authentication
# Install with: pip install azure-identity
from azure.identity import DefaultAzureCredential

# The Language SDK — same as before
from azure.ai.textanalytics import TextAnalyticsClient
import os

endpoint = os.environ.get("LANGUAGE_ENDPOINT")

# DefaultAzureCredential is a "smart" credential that tries multiple methods
# in order until one works:
# 1. Environment variables (for service principal)
# 2. Managed Identity (when running inside Azure)
# 3. Azure CLI credentials (when running locally as a developer)
# This makes it work in both development (your laptop) AND production (Azure)
credential = DefaultAzureCredential()

# Pass the credential to the client — the SDK handles getting the token automatically
# No key needed — Azure fetches and refreshes the token behind the scenes
client = TextAnalyticsClient(endpoint=endpoint, credential=credential)

print("Authenticated with Managed Identity / DefaultAzureCredential ✅")

# ── For EXPLICIT managed identity (user-assigned) ─────────────────────
from azure.identity import ManagedIdentityCredential

# If you have a user-assigned managed identity, specify its client ID
# client_id is the unique identifier of the user-assigned managed identity
# (found in Azure portal → Managed Identities → your identity → Overview)
user_assigned_credential = ManagedIdentityCredential(
    client_id="your-managed-identity-client-id-here"
)

client_explicit = TextAnalyticsClient(endpoint=endpoint, credential=user_assigned_credential)
print("Authenticated with User-Assigned Managed Identity ✅")

# This example shows how Entra ID tokens work at the HTTP level
# The SDK does all this automatically — but the exam may show raw HTTP requests

import requests  # HTTP library — install with: pip install requests

# ── Step 1: Get a token from Microsoft Entra ID ───────────────────────

# Your Azure tenant ID — found in Azure portal → Entra ID → Overview
tenant_id = "your-tenant-id"

# The token endpoint for your tenant — this is always this format
token_url = f"https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token"

# The "scope" tells Entra ID which Azure service you want to access
# For Azure Cognitive Services / AI Services, the scope is always this URL
token_data = {
    "grant_type": "client_credentials",   # We're authenticating as an app, not a user
    "client_id": "your-service-principal-client-id",
    "client_secret": "your-service-principal-secret",
    "scope": "https://cognitiveservices.azure.com/.default"
}

# POST request to get the token — Entra ID responds with a JSON object
token_response = requests.post(token_url, data=token_data)

# Extract the access_token from the JSON response
# .json() converts the response body from text into a Python dictionary
# ["access_token"] retrieves the value stored under that key in the dictionary
access_token = token_response.json()["access_token"]


# ── Step 2: Use the token in an API call ──────────────────────────────

# The token goes in the "Authorization" header with the word "Bearer " before it
# "Bearer" is a token type — it just means "the holder of this token is authorised"
headers = {
    "Authorization": f"Bearer {access_token}",
    "Content-Type": "application/json"
}

# Now make the actual API call with the token in the header
endpoint = "https://your-resource.cognitiveservices.azure.com/"
response = requests.post(
    f"{endpoint}text/analytics/v3.1/languages",
    headers=headers,
    json={"documents": [{"id": "1", "text": "Hello world"}]}
)

print(response.json())  # Print the API response

import os
from azure.identity import ClientSecretCredential
from azure.ai.textanalytics import TextAnalyticsClient

# Three pieces of information identify a service principal:

# 1. tenant_id — the unique ID of your Azure organisation (tenant)
#    Found in: Azure portal → Microsoft Entra ID → Overview → Tenant ID
tenant_id = os.environ.get("AZURE_TENANT_ID")

# 2. client_id — the unique ID of the registered application (service principal)
#    Found in: Azure portal → Entra ID → App Registrations → your app → Application ID
client_id = os.environ.get("AZURE_CLIENT_ID")

# 3. client_secret — a password generated for the service principal
#    Found in: App Registrations → your app → Certificates & secrets
#    ⚠️ Store this in an environment variable or Key Vault — never in code!
client_secret = os.environ.get("AZURE_CLIENT_SECRET")

endpoint = os.environ.get("LANGUAGE_ENDPOINT")

# ClientSecretCredential uses the three values to get an Entra ID token automatically
credential = ClientSecretCredential(
    tenant_id=tenant_id,
    client_id=client_id,
    client_secret=client_secret
)

# Pass the credential to the client — same as managed identity from here on
client = TextAnalyticsClient(endpoint=endpoint, credential=credential)

print("Authenticated with Service Principal ✅")

Who can do what — the role table

Once someone is authenticated, RBAC determines what they're allowed to do. The exam tests specific roles for Azure AI resources — especially the critical trap around Owner and Contributor.

Storing and retrieving secrets securely

In Topic 2, you learned to store your API key in an environment variable. For production, the better approach is Azure Key Vault — a dedicated cloud service for storing secrets, keys, and certificates.

Key Vault concepts you must know

Python — Reading a secret from Key Vault

A new Python concept here: chaining methods. When you call client.get_secret("name"), it returns an object. You then use .value on that object to get the actual secret text. This is explained in the code comments.
Requires: pip install azure-keyvault-secrets azure-identity

# Install these first:
# pip install azure-keyvault-secrets azure-identity

import os
from azure.keyvault.secrets import SecretClient   # SDK for reading Key Vault secrets
from azure.identity import DefaultAzureCredential  # From Topic 3 Section 3


# ── Your Key Vault URL ────────────────────────────────────────────────
# Format is always: https://YOUR-VAULT-NAME.vault.azure.net/
# Found in: Azure portal → Key Vault → Overview → Vault URI
vault_url = os.environ.get("KEY_VAULT_URL")  # e.g. "https://myvault.vault.azure.net/"


# ── Authenticate using Managed Identity (no credentials in code!) ─────
# DefaultAzureCredential automatically uses the managed identity of the
# Azure resource this code is running on (App Service, VM, Function, etc.)
credential = DefaultAzureCredential()


# ── Create the Key Vault client ───────────────────────────────────────
# SecretClient is specifically for reading/writing secrets (not keys or certs)
# vault_url tells it which Key Vault to connect to
# credential tells it how to prove it has access
secret_client = SecretClient(vault_url=vault_url, credential=credential)


# ── Retrieve a secret ─────────────────────────────────────────────────
# get_secret("name") fetches the secret object from Key Vault
# The name must match the secret name you created in Key Vault
secret_object = secret_client.get_secret("language-api-key")

# The secret object has a .value property that holds the actual secret text
# (The object also has .name, .id, .properties for metadata — but we want .value)
api_key = secret_object.value

print(f"Secret retrieved successfully. Key starts with: {api_key[:4]}...")
# We only print the first 4 characters — never print a full key!


# ── Now use the key to call the AI service ────────────────────────────
from azure.ai.textanalytics import TextAnalyticsClient
from azure.core.credentials import AzureKeyCredential

endpoint = os.environ.get("LANGUAGE_ENDPOINT")

# Use the key we retrieved from Key Vault — not from an env variable
ai_credential = AzureKeyCredential(api_key)
ai_client = TextAnalyticsClient(endpoint=endpoint, credential=ai_credential)

print("AI client created using key from Key Vault ✅")

Customer-Managed Keys (CMK) — what the exam tests

By default Azure encrypts your data with Microsoft-managed keys. Customer-Managed Keys let you use your own keys stored in Key Vault. The exam tests the configuration requirements — not the Python code.

Controlling where your AI service can be accessed from

Even with authentication and RBAC in place, you can add a third layer of security by restricting which networks can even reach your service. Think of this as controlling the physical perimeter.

Three network access modes

Zero-downtime key rotation

API keys should be rotated regularly — replaced with a new key to limit the damage if a key is ever compromised. Azure gives you two keys (Key1 and Key2) specifically to enable this without any downtime.

Regenerating a key via the REST API (what the exam shows)

The exam sometimes shows a raw HTTP request for key regeneration and asks what it does. Know this pattern:

# This is a REST API call (not Python) — it regenerates a key via the Azure Management API
# The exam may show this pattern and ask what "keyName: Key2" does

POST https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{rg}/providers/
Microsoft.CognitiveServices/accounts/{resource-name}/regenerateKey?api-version=2023-05-01

Body:
{
    "keyName": "Key2"    # Specifies WHICH key to regenerate (Key1 or Key2)
}

# Result: Key2 is regenerated (a new value is created)
# Key1 is NOT affected
# This is the secondary subscription key being reset — not both keys

Choosing the right security approach for any scenario

Security questions — what to watch for

Test your understanding

6 questions. Select an answer to see the explanation immediately.