Can We Bring Our Own Key to Access Azure AI Services Instead of Using the Microsoft Default Key?

Question

Hi everyone,

I'm looking into using Azure AI services for our projects, and I have a question regarding encryption keys. Is it possible to bring our own key and use it to access the Azure AI services instead of using the default key provided by Microsoft? If so, what are the steps involved in setting this up? Any guidance or documentation links would be greatly appreciated!

Answer 1

You can create or Import Your Key in Azure Key Vault:

• Go to the Azure portal.
• Navigate to Azure Key Vault.
• Create a new key vault if you don't already have one.
• In the key vault, you can either generate a new key or import an existing one.

Then set Up Access Policies:

• In your Key Vault, configure the access policies to grant permissions to the necessary Azure AI services.
• Ensure that the appropriate identities (e.g., service principals, managed identities) have permissions like get, unwrapKey, and wrapKey.

Then configure Azure AI Service to Use the Key:

• When setting up your Azure AI service (e.g., Azure Cognitive Services), configure it to use the key stored in Azure Key Vault.
• During the setup or configuration of the AI service, you will specify the Key Vault URL and the key to be used.

Check the documentation : https://learn.microsoft.com/en-us/azure/key-vault/keys/byok-specification