Networking, Security and Responsible AI

This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production.

See the section bibliography for the reference material consulted while preparing these pages.

This page targets Azure CLI 2.90.0 and the Microsoft.CognitiveServices/accounts API version 2025-06-01, checked on 2026-10-06. It builds on the foundry-bookshelf resource from Resources, Endpoints and Authentication and the vnet-bookshelf network from Virtual Networks.

A Foundry resource is reachable from the public internet by default. Anyone with a key or a valid token can call it. This page closes that down in three layers: who can reach the endpoint (network rules and private endpoints), how data is protected at rest (customer-managed keys, residency and retention), and which features need extra approval because of their potential for harm (Limited Access).

Network rules

Network rules are the first, cheapest layer. They work on the resource’s public endpoint:

  • Default action Deny blocks every caller not explicitly allowed.

  • Virtual network rules allow subnets that have the Microsoft.CognitiveServices service endpoint enabled.

  • IP rules allow public IPv4 addresses or CIDR ranges, for example your office egress IP.

  • Trusted Azure services (--bypass AzureServices) lets services such as Azure AI Search or Foundry Agent Service reach the resource with their managed identities.

Network rules require a custom subdomain. They apply to every tool on the resource, including Azure OpenAI.

In the Azure portal

  1. Open foundry-bookshelf → Resource Management → Networking.

  2. On Firewalls and virtual networks, select Selected Networks and Private Endpoints.

  3. Under Virtual networks, select Add existing virtual network, then choose vnet-bookshelf and the snet-apps subnet. The portal offers to enable the service endpoint.

  4. Under Firewall, add your client IP if you still use the Foundry portal from outside the network.

  5. Under Exceptions, keep Allow Azure services on the trusted services list to access this cognitive services account selected.

  6. Save.

With the Azure CLI

az network vnet subnet update \
  --resource-group "$RG" --vnet-name vnet-bookshelf --name snet-apps \
  --service-endpoints Microsoft.CognitiveServices

az cognitiveservices account network-rule add \
  --name "$FOUNDRY" --resource-group "$RG" \
  --vnet-name vnet-bookshelf --subnet snet-apps

az cognitiveservices account network-rule add \
  --name "$FOUNDRY" --resource-group "$RG" --ip-address 203.0.113.10

az resource update \
  --ids "$(az cognitiveservices account show --name "$FOUNDRY" --resource-group "$RG" --query id -o tsv)" \
  --set properties.networkAcls.defaultAction=Deny properties.networkAcls.bypass=AzureServices

Source: Configure virtual networks for Foundry Tools

Private endpoints

A private endpoint gives the resource a private IP in your subnet, so traffic never leaves the Microsoft network. Combine it with publicNetworkAccess: Disabled to remove the public endpoint completely.

A Foundry resource uses three privatelink DNS zones. Link all three to the virtual network:

Private DNS zone Resolves

privatelink.cognitiveservices.azure.com

The tool endpoint: Language, Vision, Document Intelligence, Content Understanding, Content Safety, Translator (custom endpoint) and Speech.

privatelink.openai.azure.com

The Azure OpenAI endpoint of the same resource.

privatelink.services.ai.azure.com

The project endpoint and Voice Live.

Speech is special. With a private endpoint, the Speech SDK and REST calls must use the custom-subdomain endpoint, not the regional stt.speech.microsoft.com hosts. Some Speech features need extra steps: Speech Studio from inside the network, and batch transcription reading from a Blob container that is itself behind a private endpoint (use a managed identity and trusted-service access on the storage account).

Portal access. With public access disabled, the Foundry portal and Speech Studio work only from a machine that resolves the private DNS names, for example a jump box or VPN client in vnet-bookshelf (VPN Gateway and Hybrid Connectivity).

Bookshelf: foundry-bookshelf behind a private endpoint

FOUNDRY_ID=$(az cognitiveservices account show --name "$FOUNDRY" --resource-group "$RG" --query id -o tsv)

az network private-endpoint create \
  --resource-group "$RG" --name pe-foundry-bookshelf \
  --vnet-name vnet-bookshelf --subnet snet-data \
  --private-connection-resource-id "$FOUNDRY_ID" \
  --group-id account \
  --connection-name foundry-bookshelf-conn

for zone in privatelink.cognitiveservices.azure.com privatelink.openai.azure.com privatelink.services.ai.azure.com; do
  az network private-dns zone create --resource-group "$RG" --name "$zone"
  az network private-dns link vnet create --resource-group "$RG" --zone-name "$zone" \
    --name "link-$zone" --virtual-network vnet-bookshelf --registration-enabled false
done

az network private-endpoint dns-zone-group create \
  --resource-group "$RG" --endpoint-name pe-foundry-bookshelf --name default \
  --private-dns-zone privatelink.cognitiveservices.azure.com --zone-name cognitiveservices

az network private-endpoint dns-zone-group add \
  --resource-group "$RG" --endpoint-name pe-foundry-bookshelf --name default \
  --private-dns-zone privatelink.openai.azure.com --zone-name openai

az network private-endpoint dns-zone-group add \
  --resource-group "$RG" --endpoint-name pe-foundry-bookshelf --name default \
  --private-dns-zone privatelink.services.ai.azure.com --zone-name services-ai

az resource update --ids "$FOUNDRY_ID" \
  --set properties.publicNetworkAccess=Disabled

Source: Configure a private link for Microsoft Foundry

From a container in cae-bookshelf, nslookup foundry-bookshelf.cognitiveservices.azure.com now returns a 10.x address. From outside, calls fail with 403 Public access is disabled.

The same check from application code, in Python and C#, confirms the call goes through:

from azure.ai.contentsafety import ContentSafetyClient
from azure.ai.contentsafety.models import AnalyzeTextOptions
from azure.identity import DefaultAzureCredential

client = ContentSafetyClient(
    "https://foundry-bookshelf.cognitiveservices.azure.com/", DefaultAzureCredential()
)
print(client.analyze_text(AnalyzeTextOptions(text="connectivity check")).categories_analysis)

Source: Content Safety text quickstart

using Azure.AI.ContentSafety;
using Azure.Identity;

var client = new ContentSafetyClient(
    new Uri("https://foundry-bookshelf.cognitiveservices.azure.com/"), new DefaultAzureCredential());
var result = client.AnalyzeText(new AnalyzeTextOptions("connectivity check"));
Console.WriteLine(result.Value.CategoriesAnalysis.Count);

Source: Content Safety text quickstart

Data protection

Customer-managed keys

Data at rest is encrypted with Microsoft-managed keys by default. With customer-managed keys (CMK) you supply the key from Key Vault:

  • the vault needs soft delete and purge protection

  • the resource’s managed identity needs the Key Vault Crypto Service Encryption User role on the key

  • the resource and the vault must be in the same tenant, and in the same region for some tools

az cognitiveservices account update \
  --name "$FOUNDRY" --resource-group "$RG" \
  --encryption-key-source Microsoft.KeyVault \
  --encryption-key-vault "https://kv-bookshelf.vault.azure.net/" \
  --encryption-key-name cmk-foundry \
  --encryption-key-version ""

Source: Customer-managed keys for Foundry Tools

An empty key version enables automatic rotation to the latest version.

Data residency and retention

A Foundry resource processes data in the region you create it in, with exceptions you must check per tool and per model deployment type (Global and Data Zone model deployments can process in other regions). Per-tool retention, as described in each tool’s data-privacy page, includes:

Tool What is kept

Document Intelligence, Language summarization and other async APIs

Analysis results are kept for 24 hours so you can poll for them, then deleted.

Speech batch transcription

Results are kept until their time to live expires (timeToLiveHours, up to 31 days) or you delete them.

Translator text

No text is stored. Document translation keeps files only in your own Blob containers.

Content Safety, Language sync APIs, Vision

Inputs are not stored after the response.

Custom models (custom speech, custom NER, custom Document Intelligence)

Training data stays in your storage; trained models stay in your resource’s region.

Source: Data, privacy and security for Document Intelligence

Limited Access

Some features have a high potential for misuse, so Microsoft gates them behind the Limited Access program. You apply with an intake form, describe your use case, and wait for approval (typically about 10 business days).

Feature Notes

Face identification, verification, find similar, group and liveness with verification

Available only to Microsoft-managed customers and partners, for approved use cases.

Custom voice (professional voice fine-tuning) and personal voice

Needs speaker consent recorded in the service.

Custom text-to-speech avatar

Needs consent from the actor.

Celebrity recognition (Image Analysis 3.2)

Retires with Image Analysis on 2028-09-25.

Face restrictions apply to everyone:

  • the emotion, gender, age, smile, facial hair, hair and makeup attributes were retired from detection

  • Face must not be used by or for a police department in the United States for facial recognition

  • real-time identification in uncontrolled public spaces is not an approved use case

Source: Limited Access features for Foundry Tools

Transparency notes and responsible AI

Every tool has a transparency note that describes its intended uses, its limitations and how its accuracy varies across languages, accents and image conditions. Read it before you design a feature around the tool, and link it from your own documentation. The practices on Responsible AI Practices (impact assessment, human review, disclosure) apply to Foundry Tools as much as to LLMs.

Source: Responsible AI for Microsoft Foundry

Clean up

FOUNDRY_ID=$(az cognitiveservices account show --name "$FOUNDRY" --resource-group "$RG" --query id -o tsv)
az resource update --ids "$FOUNDRY_ID" \
  --set properties.publicNetworkAccess=Enabled properties.networkAcls.defaultAction=Allow
az network private-endpoint delete --resource-group "$RG" --name pe-foundry-bookshelf
for zone in privatelink.cognitiveservices.azure.com privatelink.openai.azure.com privatelink.services.ai.azure.com; do
  az network private-dns link vnet delete --resource-group "$RG" --zone-name "$zone" --name "link-$zone" --yes
  az network private-dns zone delete --resource-group "$RG" --name "$zone" --yes
done

Source: Azure CLI reference — az network private-endpoint delete

Related pages

References