How Should App1 Authenticate to a Multi-Service Cognitive Services Resource?
You have an Azure subscription that contains an Azure App Service app named App1. You provision a multi-service Azure Cognitive Services resource named CSAccount1. You need to configure App1 to access CSAccount1. The solution must minimize administrative effort. What should you use to configure App1?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the default authentication mechanism for a multi-service Cognitive Services resource; the trap is assuming that managed identity, OAuth, or a SAS token must be provisioned first, which adds setup effort the question explicitly forbids.
Azure AI Services (Cognitive Services) multi-service resources are consumed by pointing client code at the resource's endpoint URI and authenticating with a subscription key. This page confirms that endpoint URI plus subscription key (D) is the lowest-effort way to wire App1 to CSAccount1.
Choosing a system-assigned managed identity with an X.509 certificate (A) because it sounds like the most secure or most 'cloud-native' option — but it requires creating the identity, assigning a role, and issuing/rotating a certificate, which is more administrative effort, not less.
Community Discussion (9 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A multi-service Azure Cognitive Services (Azure AI Services) resource, such as CSAccount1, is designed to be called directly from an application using two values that are generated automatically at provisioning time: the endpoint URI and one of the resource's subscription keys. App1 only needs those two pieces of configuration in its app settings, so no identity, role assignment, or token plumbing is required — which is exactly what "minimize administrative effort" is asking for. The subscription key is scoped to the resource and Microsoft's own quickstarts for the multi-service resource show the endpoint-plus-key pattern as the default. This makes option D the intended answer, matching the source key and every learner vote recorded on the question.Why the Other Options Are Wrong
Option A (system-assigned managed identity plus X.509 certificate) is a valid and more secure pattern in general, but it requires enabling the identity, granting it a Cognitive Services role, and managing certificate issuance and rotation — clearly more administrative effort. Option B (endpoint URI and an OAuth token) describes the token flow that managed identity or Entra ID authentication ultimately produces; you would still have to configure the identity and token acquisition code first. Option C (endpoint URI and a shared access signature) is wrong because SAS tokens are an Azure Storage concept, not the native credential of a Cognitive Services resource — the resource issues subscription keys instead. Only D uses the credential the resource actually hands you out of the box.Community Comment Notes
Every recorded vote on this question is for D, and the reasoning is consistent. As michaelmorar puts it, "In general, you always need an endpoint and subscription key," and Murtuza notes that supplying the endpoint URI and subscription key lets the app "seamlessly connect to CSAccount1 without additional complexities or setup." syupwsh adds that this method "minimizes administrative effort as it involves using the keys provided when the Cognitive Services resource is created." The one caveat worth remembering comes from JakeCallham, who answered D but warned, verbatim, "i sure hope that nobody uses keys anymore" and recommended managed identities with RBAC instead — a good production-security note, even though it does not change the exam's lowest-effort answer.Official Reference
Exam Strategy
When an AI-102 item says "minimize administrative effort," eliminate any option that requires provisioning an identity, role assignment, certificate, or token service first. Keys and endpoints ship with the resource, so they win whenever the stem does not demand keyless or Entra ID authentication.
Frequently Asked Questions
Why is a system-assigned managed identity with an X.509 certificate wrong here?
It is more secure in production but requires enabling the identity, assigning an RBAC role and managing certificate rotation, which is extra administrative effort the question rules out.
Why is an OAuth token not the answer for CSAccount1?
An OAuth token is the output of Entra ID or managed identity authentication, so you would still configure that identity first; the Cognitive Services resource natively issues subscription keys instead.