unable to access features of Speech studio after disabling key based authentication

Question

unable to access features of Speech studio after disabling key based authentication

Jyotsna Ravi 51 Microsoft Employee

I disabled key based authentication of speech resource and enabled system assigned managed identity. I also defined a custom domain. However, once this is done, I cannot access the features of Speech studio based on Entra ID authentication. Are there any specific steps to do this? Please guide me on the step-by step process to get this done.

Jerald Felix 11,550 Reputation points Volunteer Moderator

2025-11-16T16:54:31.92+00:00
Hello Jyotsna Ravi,

Disabling key-based authentication on your Azure AI Speech resource in favor of system-assigned managed identity (with custom domain) is a secure move, but Speech Studio currently relies on key or direct Entra ID browser auth for UI features like custom voice training and testing—managed identity is app/code-only, so the portal falls back to unauthenticated access, causing the "network/proxy/ad blocker" error (masking the auth failure). To regain Studio access, you'll need to temporarily re-enable keys for portal use while keeping managed identity for SDK/apps. Here's the step-by-step process:

Step-by-Step Fix and Configuration

Re-Enable Key-Based Authentication (Temporary for Studio):

Portal > Your Speech resource > Keys and Endpoint > If "Key access disabled," you can't regenerate—go to Configuration > Set "Disable local authentication" to Off > Save (takes ~5 mins).

Regenerate keys: Keys and Endpoint > Regenerate Key 1/Key 2 > Copy for Studio use.

Test Studio: Go to speech.azure.com > Sign in with Entra ID > Select resource > Verify features (e.g., Speech to text) load with key in config if prompted.

Configure Managed Identity for SDK/Apps (Primary Auth):

Resource > Identity > System assigned > Status: On > Save (auto-generates principal ID).

Assign roles: Identity > Role assignments > Add role > "Cognitive Services Speech User" (or Contributor) > Scope: Speech resource > Assign to the managed identity principal.

For custom domain (required for Entra): Resource > Configuration > Custom subdomain name: Set (e.g., "my-speech-domain") > Save.

SDK Example (C# with Azure.Identity):
using Azure.Identity; using Microsoft.CognitiveServices.Speech; var credential = new DefaultAzureCredential(); // Uses managed identity var config = SpeechConfig.FromSubscription("unused-key", "unused-region"); // Placeholder config.EndpointId = "https://my-speech-domain.cognitiveservices.azure.com/"; // Custom domain config.AuthorizationToken = await credential.GetTokenAsync(new TokenRequestContext(new[] { "https://cognitiveservices.azure.com/.default" })); var recognizer = new SpeechRecognizer(config);

Python: Use DefaultAzureCredential() + SpeechConfig(host_name="https://my-speech-domain.cognitiveservices.azure.com/").

Hybrid Access for Studio:

Studio supports key auth post-disable, but for full Entra ID browser flow: Ensure your Entra app registration has API permissions ("Cognitive Services" > User Impersonation) > Consent as admin.

If managed identity blocks: Create a user-assigned identity > Assign to resource > Use in Studio via Entra sign-in (preview feature as of 2025).

Troubleshoot and Secure:

Error Persists: Clear browser cache, incognito mode, disable ad blockers/VPN—check Network tab for 401/403 on auth endpoints.

Role Propagation: Wait 5-10 mins after assignments; test SDK call (e.g., Speech to text recognition).

Re-Disable Keys Later: Once apps on managed identity, re-disable in Configuration > Off > Save (Studio may need keys for some tools like custom models).

Policy: Apply Azure Policy "Azure AI Services resources should have key access disabled" at subscription level for enforcement.

This setup allows Studio access (keys) while securing runtime (identity)—test SDK first. For full keyless Studio (future), monitor 2026 updates. If helpful, accept the answer.

Best Regards,

Jerald Felix

1 answer

Your answer

Answer 1

Hi Jyotsna,
I understand that configuring the Speech SDK with Entra ID can be a bit challenging, so I’m sharing the relevant documentation to guide you:

https://learn.microsoft.com/en-us/azure/ai-services/speech-service/how-to-configure-azure-ad-auth?tabs=portal&pivots=programming-language-python

Please ensure that the correct roles are assigned if you are using Blob or other Azure services. I hope this helps, and feel free to reach out if you need further assistance — I’m happy to help.
If you are only using portal then please make sure to clear cookies and browser history.

Thank you for reaching out to the Microsoft Q&A Portal.

Share via

unable to access features of Speech studio after disabling key based authentication

Step-by-Step Fix and Configuration

1 answer

Your answer