Unable to create CLU project with Azure Language service and Disable Local Auth - true

Question

Hello,

I need some help creating a CLU project with Azure Language service with disabled Local Auth set to true. Here are the steps I followed so far:

1. I created an Azure Language resource with User Managed Identity.
2. I set the Disable Local Auth property to True because of security 360 alerts.
3. I tried to create a CLU project in Azure language studio on this portal, https://language.cognitive.azure.com/clu/projects, but I was not able to create a project with Language resource that we created in Azure portal. When I set Disabled Local Auth to false, I was able to create a CLU project, but that triggers Security 360 alerts.

Can anyone help me create a CLU project with Managed identity, please?

Thank you,

Sumanth

Answer 1

First, make sure that the UMI has the required role assignments for the Azure Language resource:

• Assign the Cognitive Services Contributor role to the UMI in the Azure resource that you created.
• You can do this by navigating to the Azure Portal > Azure Language Resource > Access Control (IAM) > Add Role Assignment, and selecting Cognitive Services Contributor. Ensure that the UMI is added to this role.

Since you are using User Managed Identity, it needs to have the proper API permissions set up. Go to Azure Active Directory > App registrations > Your UMI > API Permissions and ensure that your UMI has the necessary permissions to access the Azure Language resource.

If the API permissions are not listed, you may need to grant them explicitly for the Azure Language Service.

Ensure that Azure RBAC is properly configured since local authentication is disabled. With Disable Local Auth = true, Azure will only allow requests authenticated via Azure Active Directory (such as Managed Identity), and local keys are not valid.

To enforce RBAC, you can review the security settings in the Azure Language Resource and ensure that the UMI has sufficient permissions.

If the portal does not support creating the CLU project due to Disable Local Auth, you might need to use Azure CLI or an SDK to create the CLU project programmatically.

az cognitiveservices account create --name "<your-resource-name>" --resource-group "<your-resource-group>" --kind "Language" --sku F0 --location "<your-location>" --identity-type UserAssigned --user-assigned-identity "<your-umi-id>"

Then, use the CLU SDK or API to create the project. Ensure that the UMI is passed as part of the authentication flow.

Ensure that your Azure subscription has sufficient quota to create the CLU project, and there are no resource limits that might prevent the creation of new projects.

If you’ve followed these steps and the issue persists, it could be a configuration or platform-specific issue. In that case, reaching out to Microsoft Support may help resolve the situation, as they can investigate the security configurations and ensure that Managed Identity is properly integrated with the Language Service.