Microsoft Entra authentication with the Speech SDK
When using the Speech SDK to access the Speech service, there are three authentication methods available: service keys, a key-based token, and Microsoft Entra ID. This article describes how to configure a Speech resource and create a Speech SDK configuration object to use Microsoft Entra ID for authentication.
This article shows how to use Microsoft Entra authentication with the Speech SDK. You learn how to:
- Create a Speech resource
- Configure the Speech resource for Microsoft Entra authentication
- Get a Microsoft Entra access token
- Create the appropriate SDK configuration object.
To learn more about Microsoft Entra access tokens, including token lifetime, visit Access tokens in the Microsoft identity platform.
Create a Speech resource
To create a Speech resource in the Azure portal, see this quickstart.
Configure the Speech resource for Microsoft Entra authentication
To configure your Speech resource for Microsoft Entra authentication, create a custom domain name and assign roles.
Create a custom domain name
Follow these steps to create a custom subdomain name for Azure AI services for your Speech resource.
Caution
When you turn on a custom domain name, the operation is not reversible. The only way to go back to the regional name is to create a new Speech resource.
If your Speech resource has a lot of associated custom models and projects created via Speech Studio, we strongly recommend trying the configuration with a test resource before you modify the resource used in production.
To create a custom domain name using the Azure portal, follow these steps:
Go to the Azure portal and sign in to your Azure account.
Select the required Speech resource.
In the Resource Management group on the left pane, select Networking.
On the Firewalls and virtual networks tab, select Generate Custom Domain Name. A new right panel appears with instructions to create a unique custom subdomain for your resource.
In the Generate Custom Domain Name panel, enter a custom domain name. Your full custom domain will look like:
https://{your custom name}.cognitiveservices.azure.com
.Remember that after you create a custom domain name, it cannot be changed.
After you've entered your custom domain name, select Save.
After the operation finishes, in the Resource management group, select Keys and Endpoint. Confirm that the new endpoint name of your resource starts this way:
https://{your custom name}.cognitiveservices.azure.com
.
Assign roles
For Microsoft Entra authentication with Speech resources, you need to assign either the Cognitive Services Speech Contributor or Cognitive Services Speech User role.
You can assign roles to the user or application using the Azure portal or PowerShell.
Get a Microsoft Entra access token
To get a Microsoft Entra access token in C#, use the Azure Identity Client Library.
Here's an example of using Azure Identity to get a Microsoft Entra access token from an interactive browser:
TokenRequestContext context = new Azure.Core.TokenRequestContext(new string[] { "https://cognitiveservices.azure.com/.default" });
InteractiveBrowserCredential browserCredential = new InteractiveBrowserCredential();
var browserToken = browserCredential.GetToken(context);
string aadToken = browserToken.Token;
The token context must be set to "https://cognitiveservices.azure.com/.default".
To get a Microsoft Entra access token in C++, use the Azure Identity Client Library.
Here's an example of using Azure Identity to get a Microsoft Entra access token with your tenant ID, client ID, and client secret credentials:
const std::string tenantId = "Your Tenant ID";
const std::string clientId = "Your Client ID";
const std::string clientSecret = "Your Client Secret";
const std::string tokenContext = "https://cognitiveservices.azure.com/.default";
Azure::Identity::ClientSecretCredential cred(tenantId,
clientId,
clientSecret,
Azure::Identity::ClientSecretCredentialOptions());
Azure::Core::Credentials::TokenRequestContext context;
context.Scopes.push_back(tokenContext);
auto token = cred.GetToken(context, Azure::Core::Context());
The token context must be set to "https://cognitiveservices.azure.com/.default".
To get a Microsoft Entra access token in Java, use the Azure Identity Client Library.
Here's an example of using Azure Identity to get a Microsoft Entra access token from a browser:
TokenRequestContext context = new TokenRequestContext();
context.addScopes("https://cognitiveservices.azure.com/.default");
InteractiveBrowserCredentialBuilder builder = new InteractiveBrowserCredentialBuilder();
InteractiveBrowserCredential browserCredential = builder.build();
AccessToken browserToken = browserCredential.getToken(context).block();
String token = browserToken.getToken();
The token context must be set to "https://cognitiveservices.azure.com/.default".
To get a Microsoft Entra access token in Python, use the Azure Identity Client Library.
Here's an example of using Azure Identity to get a Microsoft Entra access token from an interactive browser:
from azure.identity import InteractiveBrowserCredential
ibc = InteractiveBrowserCredential()
aadToken = ibc.get_token("https://cognitiveservices.azure.com/.default")
Find samples that get a Microsoft Entra access token in Microsoft identity platform code samples.
For programming languages where a Microsoft identity platform client library isn't available, you can directly request an access token.
Get the Speech resource ID
You need your Speech resource ID to make SDK calls using Microsoft Entra authentication.
Note
For Intent Recognition use your LUIS Prediction resource ID.
To get the resource ID in the Azure portal:
- Go to the Azure portal and sign in to your Azure account.
- Select a Speech resource.
- In the Resource Management group on the left pane, select Properties.
- Copy the Resource ID
Create the Speech SDK configuration object
With a Microsoft Entra access token, you can now create a Speech SDK configuration object.
The method of providing the token, and the method to construct the corresponding Speech SDK Config
object varies by the object you're using.
SpeechRecognizer, SpeechSynthesizer, IntentRecognizer, ConversationTranscriber
For SpeechRecognizer
, SpeechSynthesizer
, IntentRecognizer
, ConversationTranscriber
objects, build the authorization token from the resource ID and the Microsoft Entra access token and then use it to create a SpeechConfig
object.
string resourceId = "Your Resource ID";
string aadToken = "Your Azure AD access token";
string region = "Your Speech Region";
// You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
var authorizationToken = $"aad#{resourceId}#{aadToken}";
var speechConfig = SpeechConfig.FromAuthorizationToken(authorizationToken, region);
std::string resourceId = "Your Resource ID";
std::string aadToken = "Your Azure AD access token";
std::string region = "Your Speech Region";
// You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
auto authorizationToken = "aad#" + resourceId + "#" + aadToken;
auto speechConfig = SpeechConfig::FromAuthorizationToken(authorizationToken, region);
String resourceId = "Your Resource ID";
String region = "Your Region";
// You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
String authorizationToken = "aad#" + resourceId + "#" + token;
SpeechConfig speechConfig = SpeechConfig.fromAuthorizationToken(authorizationToken, region);
resourceId = "Your Resource ID"
region = "Your Region"
# You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
authorizationToken = "aad#" + resourceId + "#" + aadToken.token
speechConfig = SpeechConfig(auth_token=authorizationToken, region=region)
TranslationRecognizer
For the TranslationRecognizer
, build the authorization token from the resource ID and the Microsoft Entra access token and then use it to create a SpeechTranslationConfig
object.
string resourceId = "Your Resource ID";
string aadToken = "Your Azure AD access token";
string region = "Your Speech Region";
// You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
var authorizationToken = $"aad#{resourceId}#{aadToken}";
var speechConfig = SpeechTranslationConfig.FromAuthorizationToken(authorizationToken, region);
std::string resourceId = "Your Resource ID";
std::string aadToken = "Your Azure AD access token";
std::string region = "Your Speech Region";
// You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
auto authorizationToken = "aad#" + resourceId + "#" + aadToken;
auto speechConfig = SpeechTranslationConfig::FromAuthorizationToken(authorizationToken, region);
String resourceId = "Your Resource ID";
String region = "Your Region";
// You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
String authorizationToken = "aad#" + resourceId + "#" + token;
SpeechTranslationConfig translationConfig = SpeechTranslationConfig.fromAuthorizationToken(authorizationToken, region);
resourceId = "Your Resource ID"
region = "Your Region"
# You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
authorizationToken = "aad#" + resourceId + "#" + aadToken.token
translationConfig = SpeechTranslationConfig(auth_token=authorizationToken, region=region)
DialogServiceConnector
For the DialogServiceConnection
object, build the authorization token from the resource ID and the Microsoft Entra access token and then use it to create a CustomCommandsConfig
or a BotFrameworkConfig
object.
string resourceId = "Your Resource ID";
string aadToken = "Your Azure AD access token";
string region = "Your Speech Region";
string appId = "Your app ID";
// You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
var authorizationToken = $"aad#{resourceId}#{aadToken}";
var customCommandsConfig = CustomCommandsConfig.FromAuthorizationToken(appId, authorizationToken, region);
std::string resourceId = "Your Resource ID";
std::string aadToken = "Your Azure AD access token";
std::string region = "Your Speech Region";
std::string appId = "Your app Id";
// You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
auto authorizationToken = "aad#" + resourceId + "#" + aadToken;
auto customCommandsConfig = CustomCommandsConfig::FromAuthorizationToken(appId, authorizationToken, region);
String resourceId = "Your Resource ID";
String region = "Your Region";
String appId = "Your AppId";
// You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
String authorizationToken = "aad#" + resourceId + "#" + token;
CustomCommandsConfig dialogServiceConfig = CustomCommandsConfig.fromAuthorizationToken(appId, authorizationToken, region);
The DialogServiceConnector is not currently supported in Python
VoiceProfileClient
To use the VoiceProfileClient
with Microsoft Entra authentication, use the custom domain name created above.
string customDomainName = "Your Custom Name";
string hostName = $"https://{customDomainName}.cognitiveservices.azure.com/";
string token = "Your Azure AD access token";
var config = SpeechConfig.FromHost(new Uri(hostName));
// You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
var authorizationToken = $"aad#{resourceId}#{aadToken}";
config.AuthorizationToken = authorizationToken;
std::string customDomainName = "Your Custom Name";
std::string aadToken = "Your Azure AD access token";
auto speechConfig = SpeechConfig::FromHost("https://" + customDomainName + ".cognitiveservices.azure.com/");
// You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
auto authorizationToken = "aad#" + resourceId + "#" + aadToken;
speechConfig->SetAuthorizationToken(authorizationToken);
String aadToken = "Your Azure AD access token";
String customDomainName = "Your Custom Name";
String hostName = "https://" + customDomainName + ".cognitiveservices.azure.com/";
SpeechConfig speechConfig = SpeechConfig.fromHost(new URI(hostName));
// You need to include the "aad#" prefix and the "#" (hash) separator between resource ID and AAD access token.
String authorizationToken = "aad#" + resourceId + "#" + token;
speechConfig.setAuthorizationToken(authorizationToken);
The VoiceProfileClient
isn't available with the Speech SDK for Python.
Note
The ConversationTranslator
doesn't support Microsoft Entra authentication.