How to Secure Your Azure AI Services with Network Rules?

Azure AI services offer a strong security model. This model lets you safeguard your Azure AI services accounts by limiting access to specific networks. By setting up network rules, only applications that use certain networks are allowed to access the account. You can also control access using filters, allowing requests only from specified IP addresses, IP ranges, or certain subnets in Azure Virtual Networks.

When an application tries to access an Azure AI services resource, it needs permission due to these network rules. Permission can come from Azure Active Directory (Azure AD) credentials or a valid API key.

Azure AI services are powerful tools that can be used to process and analyze data, generate insights, and create intelligent applications. However, like any other cloud service, they are also vulnerable to attack.

Here are some of the reasons why we need to secure Azure AI services:

• To protect sensitive data: Azure AI services can be used to process and analyze sensitive data, such as personal identifiable information (PII) or financial data. It is important to secure these services to protect this data from unauthorized access or disclosure.

• To prevent data loss: Azure AI services can be used to generate and store large amounts of data. It is important to secure these services to prevent data loss due to unauthorized access, malicious attacks, or accidental deletion.

• To protect against cyberattacks: Azure AI services can be targeted by cyberattacks, such as denial-of-service attacks or data breaches. It is important to secure these services to protect them from these attacks.

• To comply with regulations: Azure AI services are subject to a variety of regulations, such as the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA). It is important to secure these services to comply with these regulations.

How to Secure Your Azure AI Services with Network Rules?

Here are some of the possible solutions to secure your Azure AI Services:

1. Change Default Network Access Rules

2. Grant Access from Virtual Network

3. Grant Access from Internet IP Range

4. Use Private Endpoints

Solution 1: Change Default Network Access Rules

By default, Azure AI services resources accept connections from clients on any network. This means that anyone can access your Azure AI services resources, even if they are not authorized to do so.

To limit access to selected networks, you must first change the default action. This can be done by setting the default network rule to deny.

Here are the steps on how to manage default network access rules for Azure AI services resources through the Azure portal:

STEP 1: Go to the Azure portal and sign in to your account.

STEP 2: In the search bar, type "Azure AI services" and select the first result that appears.

STEP 3: Click on the name of the Azure AI services resource that you want to secure.

STEP 4: On the left-hand side of the page, select "Resource Management" and then select "Networking".

STEP 5: Under "Firewalls and virtual networks", select the desired option:

• "Selected Networks and Private Endpoints" to deny access by default and then grant access to specific virtual networks.

• "All networks" to allow traffic from all networks.

STEP 6: Click "Save" to apply your changes.

Once you have changed the default network access rule to deny, you can then create network rules to allow access from specific networks.

If you select "Selected Networks and Private Endpoints", you will need to add the virtual networks that you want to allow access to. You can do this by clicking on the "Add" button and entering the name of the virtual network.

If you select "All networks", all traffic will be allowed to your Azure AI services resource. This is not recommended for production environments.

Note:

• If you change the default network rule to deny, you will need to create specific network rules that grant access to the networks that you want to allow.

• If you do not create any network rules, all traffic will be blocked.

Solution 2: Grant Access from a Virtual Network

Azure AI services resources can be configured to allow access from specific subnets only. This means that only clients that are located in the allowed subnets will be able to access the resources.

To do this, you need to enable a service endpoint for Azure AI services within the virtual network. This will route traffic from the virtual network through an optimal path to the Azure AI services service.

The identities of the subnet and the virtual network are also transmitted with each request. This allows administrators to configure network rules for the Azure AI services resource to allow requests from specific subnets in a virtual network.

To enable a service endpoint for Azure AI services within a virtual network, you need to do the following:

1. Go to the Azure portal and sign in to your account.

2. In the search bar, type "Azure AI services" and select the first result that appears.

3. Click on the name of the Azure AI services resource that you want to secure.

4. On the left-hand side of the page, select "Networking" under "Resource Management".

Under "Firewalls and virtual networks", confirm that you selected "Selected Networks and Private Endpoints".

5. Under "Allow access from", select "Add existing virtual network".

6. In the "Add networks" dialog box, select the virtual network and subnet that you want to allow access to.

7. Click "Enable".

Once the service endpoint is enabled, you can configure network rules for the Azure AI services resource to allow requests from specific subnets in the virtual network.

To do this, you need to do the following:

1. In the "Networking" section, select "Network rules".

2. Click "Add".

3. In the "Add network rule" dialog box, select the "From virtual network" option.

4. Select the virtual network and subnet that you want to allow access from.

5. Click "Save".

Solution 3: Grant Access from an Internet IP range

You can configure Azure AI services resources to allow access from specific public internet IP address ranges. This means that only clients that are located in the allowed IP address ranges will be able to access the resources.

To do this, you need to specify the allowed IP address ranges. You can specify the ranges in CIDR format (RFC 4632), such as 192.168.0.0/16 or 192.168.0.1.

Note:

• Small address ranges that use /31 or /32 prefix sizes are not supported. You need to configure these ranges by using individual IP address rules.

• IP address ranges reserved for private networks are not allowed in IP rules. Private networks include addresses that start with 10., 172.16.-172.31., and 192.168. . For more information, see Private Address Space (RFC 1918): https://tools.ietf.org/html/rfc1918.

• Currently, only IPv4 addresses are supported.

Each Azure AI services resource supports up to 100 IP network rules, which can be combined with virtual network rules. This means that you can also allow access from specific subnets.

To allow access from an internet IP range, you need to do the following:

1. Navigate to Azure AI services resource -> Resource Management -> Networking -> Selected Networks and Private Endpoints.

2. Under "Firewalls and virtual networks", confirm that you selected "Selected Networks and Private Endpoints".

3. Under "Allow access from", select "Add IP address range".

4. In the "Add IP address range" dialog box, enter the IP address range that you want to allow access from.

5. Click "Save".

Solution 4: Use Private Endpoints

Private endpoints for Azure AI services resources allow clients on a virtual network to securely access data over Azure Private Link. This means that the traffic between the clients and the Azure AI services resource is isolated from the public internet.

To use private endpoints, you need to create a private endpoint in your virtual network. The private endpoint will have an IP address from the virtual network address space. This IP address will be used by the clients to connect to the Azure AI services resource.

Once the private endpoint is created, you need to configure the Azure AI services resource to use it. This can be done by setting the firewall to block all connections on the public endpoint for the Azure AI services service.

Using private endpoints for Azure AI services resources can help you to improve the security of your environment. By isolating the traffic from the public internet, you can help to protect your data from unauthorized access.

Here are some of the benefits of using private endpoints for Azure AI services resources:

• Increased security: Private endpoints help to improve the security of your environment by isolating the traffic from the public internet.

• Reduced risk of data exfiltration: Private endpoints can help to reduce the risk of data exfiltration by preventing unauthorized users from accessing your data.

• Improved performance: Private endpoints can improve the performance of your applications by reducing the amount of latency introduced by routing traffic over the public internet.

• Simplified management: Private endpoints can simplify the management of your network infrastructure by providing a single point of entry for your Azure AI services resources.

Conclusion

Securing your Azure AI Services via network rules is a cornerstone of data protection. These rules grant control over account access, allowing only authorized applications from specific sources. Azure AI Services network rules establish a stringent permission framework, demanding authorization through Azure AD or API keys for each access attempt.

Tailored scenarios dictate varied access levels, starting with a default block and progressing to rules enabling specific networks or IP ranges. These measures create a secure boundary for trusted interactions, extending to all communication methods and specialized tools.

Implementing network rules is seamless, and suitable for both existing and new services. Once enacted, these rules form an unwavering shield, ensuring data security remains intact. By adhering to these practices, you harness Azure AI Services with confidence, knowing that your data is under reliable protection.