AzInitiativeAdvertizer

last sync: 2025-Oct-30 18:22:48 UTC

Enforce recommended guardrails for Cognitive Services

Azure Landing Zones (ALZ) Policy Initiative (PolicySet)

Source Repository Azure Landing Zones (ALZ) GitHub
JSON Enforce-Guardrails-CognitiveServices
Display nameEnforce recommended guardrails for Cognitive Services
IdEnforce-Guardrails-CognitiveServices
Version1.2.0
Details on versioning
CategoryCognitive Services
DescriptionThis policy initiative is a group of policies that ensures Cognitive Services is compliant per regulated Landing Zones.
Cloud environments AzureChinaCloud
AzureCloud
AzureUSGovernment
TypeCustom Azure Landing Zones (ALZ)
DeprecatedFalse
PreviewFalse
Policy-used summary
Policy types Policy states Policy categories
Total Policies: 9
Builtin Policies: 9
Static Policies: 0
ALZ Policies: 0
GA: 9
2 categories:
Cognitive Services: 4
Search: 5
Policy-used
Policy DisplayName Policy Id Category Effect Roles# Roles State Type policy in AzUSGov
Azure AI Search service should use a SKU that supports private link a049bf77-880b-470f-ba6d-9f21c530cf83 Search Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA BuiltIn true
Azure AI Search services should have local authentication methods disabled 6300012e-e9a4-4649-b41f-a85f5c43be91 Search Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA BuiltIn unknown
Cognitive Services accounts should use a managed identity fe3fd216-4f83-4fc1-8984-2bbec80a3418 Cognitive Services Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA BuiltIn unknown
Cognitive Services accounts should use customer owned storage 46aa9b05-0e60-4eae-a88b-1e9d374fa515 Cognitive Services Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA BuiltIn unknown
Configure Azure AI Search services to disable local authentication 4eb216f2-9dba-4979-86e6-5d7e63ce3b75 Search Default
Modify
Allowed
Modify, Disabled		 1 Search Service Contributor GA BuiltIn unknown
Configure Azure AI Search services to disable public network access 9cee519f-d9c1-4fd9-9f79-24ec3449ed30 Search Default
Modify
Allowed
Modify, Disabled		 2 Network Contributor, Search Service Contributor GA BuiltIn unknown
Configure Cognitive Services accounts to disable local authentication methods 14de9e63-1b31-492e-a5a3-c3f7fd57f555 Cognitive Services Default
Modify
Allowed
Modify, Disabled		 1 Contributor GA BuiltIn unknown
Configure Cognitive Services accounts to disable public network access 47ba1dd7-28d9-4b07-a8d5-9813bed64e0c Cognitive Services Default
Modify
Allowed
Disabled, Modify		 1 Contributor GA BuiltIn unknown
Resource logs in Search services should be enabled b4330a05-a843-4bc8-bf9a-cacce50c67f4 Search Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA BuiltIn true
Roles used
History none
JSON compare n/a
JSON
EPAC