This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
An AI workload only sends prompts to Azure OpenAI and reads completions. The administrator assigned Cognitive Services OpenAI Contributor to get authentication working quickly. Inference succeeds. What should the administrator do?
Keep Cognitive Services OpenAI Contributor since the workload authenticates and returns completions successfully
Replace with Cognitive Services OpenAI User, which covers inference without granting model deployment or fine-tuning capabilities
Replace with Cognitive Services User to limit access to data-plane operations across all Cognitive Services
A workload running on a Kubernetes cluster outside Azure needs app-only access to Microsoft Graph. The cluster has an OIDC issuer configured. What credential approach should the administrator use?
Create a client secret on the app registration and store it in a Kubernetes secret
Configure workload identity federation using the cluster's OIDC issuer
Enable a managed identity on the Kubernetes cluster
An AI workload authenticates to Azure OpenAI for inference, reads secrets from Key Vault, and writes output to a single storage container. The administrator assigns all three roles at the resource group level for simplicity. What's wrong with this approach?
Resource group scope grants access to every matching resource in the group, not just the three the workload needs
Azure RBAC doesn't support resource group-level role assignments for Key Vault
The workload should use a separate identity for each service to isolate access
Before production, an administrator reviews an AI workload that generates chat completions and reads output logs from a storage container. The identity holds Cognitive Services OpenAI Contributor and Storage Blob Data Owner. Both operations succeed. What should the administrator do?
Downgrade to Cognitive Services OpenAI User and Storage Blob Data Reader scoped to the specific resources the workload uses
Keep the current roles to avoid breaking the workload close to launch
Remove Storage Blob Data Owner but keep Cognitive Services OpenAI Contributor since AI operations need broader access
An administrator rotates a certificate credential but the workload fails to authenticate with the new certificate. The old certificate is still on the app registration. What should the administrator do next?
Remove the old certificate to force the workload to use the new one
Revert the workload to the old certificate and troubleshoot why the new certificate fails
Create a client secret as a temporary fallback until the certificate issue is resolved
You must answer all questions before checking your work.
Was this page helpful?
Need help with this topic?
Want to try using Ask Learn to clarify or guide you through this topic?