Connect your own storage for Speech and Language services (Preview)

Configure bring-your-own-storage (BYOS) for Speech and Language capabilities in a Foundry resource by setting the userOwnedStorage binding at creation time. This binding routes Speech and Language data to your Azure Storage account while maintaining backward compatibility with earlier standalone resource patterns.

Prerequisites

An Azure account with an active subscription. If you don't have one, create a free Azure account, which includes a free trial subscription.

• An Azure Storage account (Blob) in a region supported by your Foundry resource.
• Resource group permissions: Owner or Contributor role on the resource group containing the Foundry resource.
• Storage account permissions: Storage Blob Data Contributor role on the storage account (assigned to the Foundry resource's managed identity).
• (Optional) Customer-managed keys (CMK) configured on the storage account if you require CMK encryption.

Understand restrictions

Review these constraints before configuring userOwnedStorage:

Configure authentication

Speech and Language support only Azure role-based access control (RBAC) through the resource's managed identity.

1. Ensure the Foundry resource has a system-assigned managed identity.
2. On the storage account, assign the Storage Blob Data Contributor role to the Foundry resource's managed identity.
3. Don't assign the role to individual project identities for this scenario.

API key–based authentication isn't supported.

Assign the role by using Azure CLI

STORAGE_ID=/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<storageName>
FOUNDRY_ID=/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.CognitiveServices/accounts/<foundryName>

# Assign Storage Blob Data Contributor
az role assignment create \
  --assignee-object-id $(az resource show --ids $FOUNDRY_ID --query identity.principalId -o tsv) \
  --assignee-principal-type ServicePrincipal \
  --role "Storage Blob Data Contributor" \
  --scope $STORAGE_ID

If successful, the command returns a JSON object with the role assignment details including principalId and roleDefinitionId.

Reference: az role assignment create | az resource show

Assign the role by using PowerShell

$storage = "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<storageName>"
$foundry = "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.CognitiveServices/accounts/<foundryName>"

$principalId = (Get-AzResource -ResourceId $foundry).Identity.PrincipalId
New-AzRoleAssignment -ObjectId $principalId -RoleDefinitionName "Storage Blob Data Contributor" -Scope $storage

If successful, the command returns a RoleAssignment object with the DisplayName, ObjectId, and Scope properties.

Reference: New-AzRoleAssignment | Get-AzResource

Create a resource with a storage account

Set the userOwnedStorage field during resource creation. Because you can't add or change this binding later, use one of the following infrastructure-as-code templates to create the resource with the binding in a single deployment. The Azure portal and az CLI create flows don't currently support setting userOwnedStorage at creation.

Bicep template snippet

resource storage 'Microsoft.Storage/storageAccounts@2025-08-01' existing = {
  name: storageName
}

resource foundry 'Microsoft.CognitiveServices/accounts@2026-03-01' = {
  name: foundryName
  location: location
  kind: 'AIServices'
  sku: { name: 'S0' }
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    userOwnedStorage: [
      {
        resourceId: storage.id
      }
    ]
  }
}

Reference: Microsoft.CognitiveServices/accounts | Microsoft.Storage/storageAccounts

ARM template snippet

{
  "type": "Microsoft.CognitiveServices/accounts",
  "apiVersion": "2026-03-01",
  "name": "[parameters('foundryName')]",
  "location": "[parameters('location')]",
  "kind": "AIServices",
  "identity": { "type": "SystemAssigned" },
  "sku": { "name": "S0" },
  "properties": {
    "userOwnedStorage": [
      {
        "resourceId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageName'))]"
      }
    ]
  }
}

Reference: Microsoft.CognitiveServices/accounts | ARM template functions

Terraform snippet

Refer to the Terraform cognitive_account documentation.

resource "azurerm_cognitive_account" "foundry" {
  name                = var.foundry_name
  location            = var.location
  resource_group_name = azurerm_resource_group.rg.name
  kind                = "AIServices"
  sku_name            = "S0"

  # userOwnedStorage equivalent
  storage {
    storage_account_id = azurerm_storage_account.speechlang.id
  }

  identity {
    type = "SystemAssigned"
  }
}

Reference: azurerm_cognitive_account | azurerm_storage_account

Deploy the template

Deploy the Bicep or ARM template with the Azure CLI:

az deployment group create \
  --resource-group <resource-group> \
  --template-file main.bicep \
  --parameters foundryName=<foundry-name> storageName=<storage-name> location=<region>

If successful, the command returns a JSON object with provisioningState set to Succeeded and the userOwnedStorage binding in the resource properties.

For Terraform, initialize and apply the configuration:

terraform init
terraform apply

Terraform prints a plan, prompts for confirmation, and reports Apply complete! with the count of created resources.

Sample repository

See the infrastructure examples (including Speech/Language storage) in the Foundry samples repository.

Speech integration details

Speech scenarios (Speech-to-Text batch or real-time, Custom Speech, Text-to-Speech, Custom Voice) conform to the guidance in Bring your own storage (BYOS) Speech resource. When you set userOwnedStorage, those outputs route to the bound storage account containers.

Customer-managed keys (CMK)

If you configure customer-managed keys encryption on the storage account, Speech data written there uses those keys. If you don't set userOwnedStorage, Speech uses Microsoft-managed storage, which isn't covered by your customer-managed key.

Language integration details

The userOwnedStorage binding follows the same lifecycle as the Foundry resource overall: you set the storage account at creation and can't update or replace it later. If you delete or move the storage account, plan lifecycle mitigation accordingly.

Shared storage configuration

Speech and Language share the same storage account. Different container naming conventions keep data logically separated. Because access is at the resource scope, any resource-level user can reach both sets of outputs. For stricter separation, deploy distinct resources.

Verify the configuration

After creating the resource with userOwnedStorage, confirm the binding is active:

1. In the Azure portal, go to your Foundry resource.
2. Select Resource Management > Properties and verify the User Owned Storage field displays your storage account resource ID.
3. Run a test Speech or Language operation (for example, a batch transcription job) and confirm the output appears in a container within your storage account.

If the storage binding isn't visible or operations fail, see the troubleshooting section.

Troubleshooting

Related content

• Connect to your own storage (overview)
• Capability hosts for Agents
• Recover a storage account
• Azure Storage documentation
• Samples: infrastructure setup
• Terraform cognitive_account
• Speech BYOS resource guidance