AzInitiativeAdvertizer

last sync: 2025-Feb-18 18:37:02 UTC

Enforce recommended guardrails for Cognitive Services

Azure Landing Zones (ALZ) Policy Initiative (PolicySet)

Source

Repository Azure Landing Zones (ALZ) GitHub
JSON Enforce-Guardrails-CognitiveServices

Display name

Enforce recommended guardrails for Cognitive Services

Enforce-Guardrails-CognitiveServices

Version

1.2.0
Details on versioning

Category

Cognitive Services

Description

This policy initiative is a group of policies that ensures Cognitive Services is compliant per regulated Landing Zones.

Cloud environments

AzureChinaCloud
AzureCloud
AzureUSGovernment

Type

Custom Azure Landing Zones (ALZ)

Deprecated

False

Preview

False

Policy count

Total Policies: 9
Builtin Policies: 9
Static Policies: 0
ALZ Policies: 0

Policy used

Policy DisplayName	Policy Id	Category	Effect	Roles#	Roles	State	Type	policy in AzUSGov
Azure AI Search service should use a SKU that supports private link	a049bf77-880b-470f-ba6d-9f21c530cf83	Search	Default Audit Allowed Audit, Deny, Disabled	0		GA	BuiltIn	true
Azure AI Search services should have local authentication methods disabled	6300012e-e9a4-4649-b41f-a85f5c43be91	Search	Default Audit Allowed Audit, Deny, Disabled	0		GA	BuiltIn	unknown
Cognitive Services accounts should use a managed identity	fe3fd216-4f83-4fc1-8984-2bbec80a3418	Cognitive Services	Default Audit Allowed Audit, Deny, Disabled	0		GA	BuiltIn	unknown
Cognitive Services accounts should use customer owned storage	46aa9b05-0e60-4eae-a88b-1e9d374fa515	Cognitive Services	Default Audit Allowed Audit, Deny, Disabled	0		GA	BuiltIn	unknown
Configure Azure AI Search services to disable local authentication	4eb216f2-9dba-4979-86e6-5d7e63ce3b75	Search	Default Modify Allowed Modify, Disabled	1	Search Service Contributor	GA	BuiltIn	unknown
Configure Azure AI Search services to disable public network access	9cee519f-d9c1-4fd9-9f79-24ec3449ed30	Search	Default Modify Allowed Modify, Disabled	2	Network Contributor, Search Service Contributor	GA	BuiltIn	unknown
Configure Cognitive Services accounts to disable local authentication methods	14de9e63-1b31-492e-a5a3-c3f7fd57f555	Cognitive Services	Default Modify Allowed Modify, Disabled	1	Contributor	GA	BuiltIn	unknown
Configure Cognitive Services accounts to disable public network access	47ba1dd7-28d9-4b07-a8d5-9813bed64e0c	Cognitive Services	Default Modify Allowed Disabled, Modify	1	Contributor	GA	BuiltIn	unknown
Resource logs in Search services should be enabled	b4330a05-a843-4bc8-bf9a-cacce50c67f4	Search	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	BuiltIn	true

Roles used

Total Roles usage: 5
Total Roles unique usage: 3

Role	Role Id	Policies count	Policies
Contributor	b24988ac-6180-42a0-ab88-20f7382dd24c	2	Configure Cognitive Services accounts to disable local authentication methods, Configure Cognitive Services accounts to disable public network access
Search Service Contributor	7ca78c08-252a-4471-8644-bb5ff32d4ba0	2	Configure Azure AI Search services to disable local authentication, Configure Azure AI Search services to disable public network access
Network Contributor	4d97b98b-1d4f-4787-a291-c67834d212e7	1	Configure Azure AI Search services to disable public network access

History

none

JSON compare

n/a

JSON

EPAC