An organization wants to use Azure AI Language service for sentiment analysis of customer feedback. The security team requires that the service is accessed via a private endpoint and API keys are stored securely. The application runs in Azure App Service with a managed identity. What is the recommended secure configuration?
Select an answer to reveal the explanation.
Short Explanation
You want the setup that ditches API keys entirely. Use a private endpoint with public access disabled, give the App Service managed identity the Cognitive Services User role, and authenticate with Entra ID tokens. That keeps secrets out of the app and locks down the network.
Full Explanation
Use the configuration that disables public network access on Azure AI Language, deploys a private endpoint, grants the App Service managed identity the 'Cognitive Services User' role, and uses token-based authentication. It is most secure because managed identity authentication removes API keys entirely, private networking isolates the service, and the specific role gives least-privilege access. It also keeps secrets out of the application. The option storing the API key in App Service application settings and restricting the Language firewall to App Service outbound IPs is wrong because app settings expose keys through configuration APIs, even with firewall restrictions. The option storing the API key in Key Vault, fetching it via Key Vault reference, and using a private endpoint is wrong because Key Vault is better than app settings but still requires API key management, while managed identity eliminates keys. The option using mutual TLS between App Service and Azure AI Language with certificates in Key Vault is wrong because mutual TLS authenticates transport but does not remove API keys or provide managed identity benefits.