An organization wants to use Azure AI Language service for sentiment analysis of customer feedback. The security team requires that the service is accessed via a private endpoint and API keys are stored securely. The application runs in Azure App Service with a managed identity. What is the recommended secure configuration?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the most secure configuration eliminates API key usage entirely by using managed identity authentication (Entra ID token-based), disabling public network access and using a private endpoint for network isolation, and granting the specific 'Cognitive Services User' RBAC role for least-privilege access. This approach removes secrets from the application entirely.
Full explanation below image
Full Explanation
B is correct because the most secure configuration eliminates API key usage entirely by using managed identity authentication (Entra ID token-based), disabling public network access and using a private endpoint for network isolation, and granting the specific 'Cognitive Services User' RBAC role for least-privilege access. This approach removes secrets from the application entirely. C is incorrect because storing API keys in Key Vault is more secure than application settings but still involves API key management; managed identity authentication is preferred as it eliminates keys entirely. A is incorrect because storing API keys in App Service application settings (even with firewall restrictions) is the least secure option as keys can be exposed through App Service configuration APIs. D is incorrect because mutual TLS provides transport authentication but does not eliminate API key usage or provide managed identity benefits.