Azure Policy built-in policy definitions for Azure Cognitive Services
This page is an index of Azure Policy built-in policy definitions for Azure Cognitive Services. For additional Azure Policy built-ins for other services, see Azure Policy built-in definitions.
The name of each built-in policy definition links to the policy definition in the Azure portal. Use the link in the Version column to view the source on the Azure Policy GitHub repo.
Azure Cognitive Services
|Cognitive Services accounts should disable public network access||To improve the security of Cognitive Services accounts, ensure that it isn't exposed to the public internet and can only be accessed from a private endpoint. Disable the public network access property as described in https://go.microsoft.com/fwlink/?linkid=2129800. This option disables access from any public address space outside the Azure IP range, and denies all logins that match IP or virtual network-based firewall rules. This reduces data leakage risks.||Audit, Deny, Disabled||3.0.1|
|Cognitive Services accounts should enable data encryption with a customer-managed key||Customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data stored in Cognitive Services to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more about customer-managed keys at https://go.microsoft.com/fwlink/?linkid=2121321.||Audit, Deny, Disabled||2.0.0|
|Cognitive Services accounts should have local authentication methods disabled||Disabling local authentication methods improves security by ensuring that Cognitive Services accounts require Azure Active Directory identities exclusively for authentication. Learn more at: https://aka.ms/cs/auth.||Audit, Deny, Disabled||1.0.0|
|Cognitive Services accounts should restrict network access||Network access to Cognitive Services accounts should be restricted. Configure network rules so only applications from allowed networks can access the Cognitive Services account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges.||Audit, Deny, Disabled||3.0.0|
|Cognitive Services accounts should use a managed identity||Assigning a managed identity to your Cognitive Service account helps ensure secure authentication. This identity is used by this Cognitive service account to communicate with other Azure services, like Azure Key Vault, in a secure way without you having to manage any credentials.||Audit, Deny, Disabled||1.0.0|
|Cognitive Services accounts should use customer owned storage||Use customer owned storage to control the data stored at rest in Cognitive Services. To learn more about customer owned storage, visit https://aka.ms/cogsvc-cmk.||Audit, Deny, Disabled||2.0.0|
|Cognitive Services should use private link||Azure Private Link lets you connect your virtual networks to Azure services without a public IP address at the source or destination. The Private Link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to Cognitive Services, you'll reduce the potential for data leakage. Learn more about private links at: https://go.microsoft.com/fwlink/?linkid=2129800.||Audit, Disabled||3.0.0|
|Configure Cognitive Services accounts to disable local authentication methods||Disable local authentication methods so that your Cognitive Services accounts require Azure Active Directory identities exclusively for authentication. Learn more at: https://aka.ms/cs/auth.||Modify, Disabled||1.0.0|
|Configure Cognitive Services accounts to disable public network access||Disable public network access for your Cognitive Services resource so that it's not accessible over the public internet. This can reduce data leakage risks. Learn more at: https://go.microsoft.com/fwlink/?linkid=2129800.||Disabled, Modify||3.0.0|
|Configure Cognitive Services accounts with private endpoints||Private endpoints connect your virtual networks to Azure services without a public IP address at the source or destination. By mapping private endpoints to Cognitive Services, you'll reduce the potential for data leakage. Learn more about private links at: https://go.microsoft.com/fwlink/?linkid=2129800.||DeployIfNotExists, Disabled||3.0.0|
- See the built-ins on the Azure Policy GitHub repo.
- Review the Azure Policy definition structure.
- Review Understanding policy effects.
Submit and view feedback for