Configure Cognitive Services accounts to disable local authentication methods

Azure BuiltIn Policy definition

Alias

Namespace

ResourceType

Path

PathIsDefault

DefaultPath

Modifiable

Microsoft.CognitiveServices/accounts/disableLocalAuth

Microsoft.CognitiveServices

accounts

properties.disableLocalAuth

True

Alias

Namespace

ResourceType

Path

PathIsDefault

DefaultPath

Modifiable

Microsoft.CognitiveServices/accounts/disableLocalAuth

Microsoft.CognitiveServices

accounts

properties.disableLocalAuth

True

Rows: 1-2 / 2

Records:

Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi

Page of 1

Initiative DisplayName

Initiative Id

Initiative Category

State

Type

polSet in AzUSGov

Enforce recommended guardrails for Cognitive Services

Enforce-Guardrails-CognitiveServices

Cognitive Services

ALZ

Enforce recommended guardrails for Open AI (Cognitive Service)

Enforce-Guardrails-OpenAI

Cognitive Services

ALZ

Date/Time (UTC ymd) (i)

Change type

Change detail

2021-06-02 22:44:52

add

14de9e63-1b31-492e-a5a3-c3f7fd57f555

{

displayName: "Configure Cognitive Services accounts to disable local authentication methods",
policyType: "BuiltIn",
mode: "Indexed",
description: "Disable local authentication methods so that your Cognitive Services accounts require Azure Active Directory identities exclusively for authentication. Learn more at: https://aka.ms/cs/auth.",
metadata: {2 items
- version: "1.0.0",
- category: "Cognitive Services"
},
parameters: {1 item
- effect: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect",
    - description: "Enable or disable the execution of the policy"
    },
  - allowedValues: [2 items
    - "Modify",
    - "Disabled"
    ],
  - defaultValue: "Modify"
  }
},
policyRule: {2 items
- if: {1 item
  - allOf: [2 items
    - {2 items
      - field: "type",
      - equals: "Microsoft.CognitiveServices/accounts"
      },
    - {2 items
      - field: "Microsoft.CognitiveServices/accounts/disableLocalAuth",
      - notEquals: true
      }
    ]
  },
- then: {2 items
  - effect: "[parameters('effect')]",
  - details: {3 items
    - roleDefinitionIds: [1 item
      - "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" Contributor
      ],
    - conflictEffect: "audit",
    - operations: [1 item
      - {4 items
        condition: 🔍"[ greaterOrEquals( requestContext().apiVersion, '2021-04-30' ) ]",
        operation: "addOrReplace",
        field: "Microsoft.CognitiveServices/accounts/disableLocalAuth",
        value: true
        }
      ]
    }
  }
}

}