Securing Azure AI services and API Management: identity, network, keys, and exposure
This sheet compares Managed identity (Entra ID), Subscription key, Virtual network restriction, Customer-managed keys, Customer Lockbox.
| Criterion | Managed identity (Entra ID) | Subscription key | Virtual network restriction | Customer-managed keys | Customer Lockbox |
|---|---|---|---|---|---|
| Addresses | Authentication to the AI service | Authentication via shared secret | Network origin of calling clients | Encryption at rest beyond 48 hours | Microsoft engineer access approval |
The verdict, the full comparison, 6 rules and 4 traps are part of SC-100 access. Unlock SC-100.