Azure CLI Create Cognitive Services Account for OpenAI with CMK

AI-103 By islever Editorial Last updated

Set up AI solutions in Foundry

Short answer

Select 'OpenAI' for the first option and '--api-properties' for the second option.

Question

HOTSPOT
You have an Azure subscription.
You need to create a new resource that will generate fictional stores in response to user prompts. The solution must ensure that the resource uses a customer-managed key to protect data.
How should you complete the script? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Exhibit: Azure CLI Create Cognitive Services Account for OpenAI with CMK

Key Takeaways

The question requires identifying the specific Azure Cognitive Services resource type for generative text (OpenAI) and the precise CLI parameter ('--api-properties') that accepts JSON payload for Customer Managed Keys.

This scenario tests the Azure CLI commands to provision an Azure OpenAI resource with customer-managed encryption keys. The correct configuration uses 'OpenAI' as the service type and '--api-properties' to define encryption settings.

Common mistake: Learners often confuse the service type (selecting generic 'CognitiveServices' instead of 'OpenAI') or select '--encryption' which is not a valid parameter for this command in the context of passing JSON properties.

Expert Analysis

Why the Answer Is Correct

To generate fictional stores from user prompts, you must use the Azure OpenAI service type, as it handles generative AI workloads. In the Azure CLI az cognitiveservices account create command, the --api-properties parameter is used to pass complex configurations via JSON. This JSON object allows you to specify "keySource": "Microsoft.KeyVault", which enables Customer-Managed Keys (CMK) for data protection.

Why Other Candidate Answers Are Wrong

Generic options like 'CognitiveServices' do not specify the generative AI workload required for text generation. Parameters like '--assign-identity' are for RBAC and managed identities, not encryption. '--encryption' is not a valid standalone flag for setting key sources in this specific command version; the property must be passed within the JSON structure of '--api-properties'.

Community Comment Notes

As Alvarogc noted, 'OpenAI' is the only one that generates free text, and '--encryption' does not receive JSON. Srikantha correctly identified that '--api-properties' is the parameter used to specify the encryption key source and Azure Key Vault properties. AIBoss also confirmed the reference to the official CLI documentation for creating accounts without confirmation but with user-managed encryption.

Official Reference

https://learn.microsoft.com/en-us/cli/azure/cognitiveservices/account?view=azure-cli-latest#az-cognitiveservices-account-create

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the Azure CLI parameters for common AI services. Specifically, know that 'OpenAI' is the service type for generative tasks and that complex JSON configurations like encryption keys are handled via '--api-properties'.

Frequently Asked Questions

Which Azure CLI parameter sets Customer-Managed Keys?

Use '--api-properties' and pass a JSON object containing '"keySource": "Microsoft.KeyVault"'.

What service type is needed for generating text?

You must specify 'OpenAI' as the service type to enable generative text capabilities.

More AI-103 FAQ →

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Alvarogc 👍 3
    First one is OpenAI, is the only one that generates free text. Second one is --encryption, is the property that can receive the JSON on this code; --assign-identity doesn't receive any JSON. Refference: https://learn.microsoft.com/en-us/cli/azure/cognitiveservices/account?view=azure-cli-latest
  2. Srikantha 👍 1
    Why OpenAI is required because the resource must generate fictional stores from user prompts using Azure OpenAI. --api-properties is the parameter used to specify the encryption key source and Azure Key Vault properties. "keySource": "Microsoft.KeyVault" indicates a customer-managed key (CMK) rather than a Microsoft-managed key. ✅ Answer: OpenAI + --api-properties
  3. AIBoss 👍 1
    Yes, Second one is --encryption. https://learn.microsoft.com/en-us/cli/azure/cognitiveservices/account?view=azure-cli-latest#az-cognitiveservices-account-create:~:text=Create%20a%20Text%20Analytics%20Cognitive%20Services%20account%20in%20West%20Europe%20without%20confirmation%20required%20and%20user%20Customer%2Dmanaged%20encryption.
  4. 8ac3742 👍 1
    OpenAI and encryption Why --encryption?The requirement states: "ensure that the resource uses a customer-managed key to protect data." In the az cognitiveservices account create command, the parameter used to specify customer-managed key (CMK) settings backed by Azure Key Vault is --encryption.
  5. mmpurnel 👍 1
    Second one is encryption, not assign-identity. The provided JSON is a customer-managed key (CMK) configuration using Azure Key Vault.
Show 1 more comment
  1. AzureGeek79 👍 1
    Open AI and assign-identity are the correct answers.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which Request Parameters Maximize Foundry Output Stability and Reasoning?

S-grade

Azure Custom Vision: ordered steps to detect factory component faults

S-grade

Improving Agent Response Completeness in Microsoft Foundry

S-grade

Restricting Access to Microsoft Foundry Service via VNet

S-grade

Practice All AI-103 Questions

Access 88 questions with complete answers and detailed explanations.

View Full AI-103 Practice Test →

← Back to AI-103 Study Guide