How to enable Encryption type for Azure AI services multi-service account

Question

I'm not able to enable encryption (Microsoft Managed Keys) for Azure AI services multi-service account into West Europe location with S0 Standard pricing tier.

I receive the following error:

 Code="BringOwnFeatureNotEnabled" Message="Bring your own feature is not enabled for Subscription/SKU/Kind."

I'm using Pulumi's infrastructure as code SDK to provide it (just to share an ARM template/args example):

{
      accountName: "myName",
      kind: "CognitiveServices",
      properties: {
        customSubDomainName: "myName",
        publicNetworkAccess: "Enabled",
        networkAcls: {
          defaultAction: "Allow",
          virtualNetworkRules: [
            { id: mySubnet.id, ignoreMissingVnetServiceEndpoint: false },
          ],
        },
        encryption: {
          keySource: "Microsoft.CognitiveServices",
        },
      },
      resourceGroupName: "myResourceGroupName",
      sku: {
        name: "S0",
      },
      identity: {
        type: "SystemAssigned",
      },
    }

If I use Document intelligence (Form Recognizer) instead of Azure AI services multi-service account, i'm able to enable Encryption (switching kind from "CognitiveServices" to "FormRecognizer"):

{
      accountName: "myName",
      kind: "FormRecognizer",
      properties: {
        customSubDomainName: "myName",
        publicNetworkAccess: "Enabled",
        networkAcls: {
          defaultAction: "Allow",
          virtualNetworkRules: [
            { id: mySubnet.id, ignoreMissingVnetServiceEndpoint: false },
          ],
        },
        encryption: {
          keySource: "Microsoft.CognitiveServices",
        },
      },
      resourceGroupName: "myResourceGroupName",
      sku: {
        name: "S0",
      },
      identity: {
        type: "SystemAssigned",
      },
    }

So, how to enable Encryption type for Azure AI services multi-service account ? Could you share an example or ARM template ?

Thank you

Answer 1

@Eduardo Sciullo I got a confirmation from the Product group team.

Please note that the Microsoft Managed Keys (MMK) is enabled by default for Azure AI services multi-service account level

Using your above template you are enabling the Customer Managed Keys (CMK) and not MMK.

Also note that the CMK, needs to be enabled for individual services (like Document intelligence) in your scenario. You cannot have it at the Azure AI services multi-service account level.

This is the cause for the below error:

Code="BringOwnFeatureNotEnabled" Message="Bring your own feature is not enabled for Subscription/SKU/Kind."

Hope this helps.