Creating new project with AI search generating S360KPI violation

Question

Creating new project with AI search generating S360KPI violation

Yue Han 20 Microsoft Employee

When creating a new AI project with AI search, a storage account was created accordingly, and the storage account violates S360 KPI -- Disable local auth for NonProd cognitiveservices~accounts.
I already deleted this account for compliance, but still needs to use the AI search and storage. How to fix the issue?

navba-MSFT 27,550 Reputation points Microsoft Employee Moderator

2024-07-23T05:06:27.29+00:00

@Yue Han Welcome to Microsoft Q&A Forum, Thank you for posting your query here!.

Since you are internal to Microsoft, please share me your contact details, over private chat and I will reach out to you to gather more information.
navba-MSFT 27,550 Reputation points Microsoft Employee Moderator

2024-07-24T03:31:52.1533333+00:00
@Yue Han To resolve the issue and continue using AI Search and storage while complying with the S360 KPI, you can follow these steps:

Ensure that your storage account has local authentication disabled.

Use Managed Identity for Authentication:

Configure your AI Search and storage to use Managed Identity for authentication. This ensures that you are not using local authentication methods, which is a requirement for compliance. . .

Disable Local Authentication and Enable Managed Identity:

Run the below CLI commands:
az cognitiveservices account update --name <your-cognitive-services-account-name> --resource-group <your-resource-group> --set disableLocalAuth=true

az cognitiveservices account identity assign --name <your-cognitive-services-account-name> --resource-group <your-resource-group>

Create a Private Endpoint for Your Storage Account

In the Azure portal, navigate to your storage account.

Select “Networking” and then “Private endpoint connections”.

Click on “Add” to create a new private endpoint.

Follow the prompts to configure the private endpoint, selecting the appropriate virtual network and subnet.

Enable Firewall If creating the Private endpoint is not feasible, you can enable the firewall on the storage account.

Workaround:
Since it is internal to Microsoft, I have shared this with you offline.

Hope this helps.

Your answer

navba-MSFT 27,550 Reputation points Microsoft Employee Moderator

2024-07-23T05:06:27.29+00:00

@Yue Han Welcome to Microsoft Q&A Forum, Thank you for posting your query here!.

Since you are internal to Microsoft, please share me your contact details, over private chat and I will reach out to you to gather more information.
navba-MSFT 27,550 Reputation points Microsoft Employee Moderator

2024-07-24T03:31:52.1533333+00:00

@Yue Han To resolve the issue and continue using AI Search and storage while complying with the S360 KPI, you can follow these steps:

Ensure that your storage account has local authentication disabled.

Use Managed Identity for Authentication:

Configure your AI Search and storage to use Managed Identity for authentication. This ensures that you are not using local authentication methods, which is a requirement for compliance. . .

Disable Local Authentication and Enable Managed Identity:

Run the below CLI commands:
az cognitiveservices account update --name <your-cognitive-services-account-name> --resource-group <your-resource-group> --set disableLocalAuth=true

az cognitiveservices account identity assign --name <your-cognitive-services-account-name> --resource-group <your-resource-group>

Create a Private Endpoint for Your Storage Account

In the Azure portal, navigate to your storage account.

Select “Networking” and then “Private endpoint connections”.

Click on “Add” to create a new private endpoint.

Follow the prompts to configure the private endpoint, selecting the appropriate virtual network and subnet.

Enable Firewall If creating the Private endpoint is not feasible, you can enable the firewall on the storage account.

Workaround:
Since it is internal to Microsoft, I have shared this with you offline.

Hope this helps.

Share via

Creating new project with AI search generating S360KPI violation

Your answer