Entra ID Authentication for Azure AI Language, Translator, and Speech Services

To use Microsoft Entra ID (no keys) with Azure AI Language Detection, Text Translation, and Speech services in an Azure AI Foundry scenario, configure Entra-based auth for each resource and then call them with access tokens instead of API keys.

Below is what is supported in the provided context and how to apply it.

1. General pattern: Entra ID auth for Azure AI services

For Azure AI services (Translator, Speech, etc.), the pattern is:

1. Register an application in Microsoft Entra ID.
2. Add API permissions for Microsoft Cognitive Services.
3. Assign an RBAC role on the specific AI resource (for example, Translator) to that app.
4. Acquire an Entra access token in code using that app registration.
5. Call the service REST endpoint or SDK using the Bearer token instead of a key.

The context provides full detail for Translator and general guidance for Speech.

2. Configure Microsoft Entra ID for Azure Translator (Language Detection & Text Translation)

Language detection and text translation are part of Azure Translator. To enable Entra ID auth:

2.1. Add API permissions for Cognitive Services

In the Entra app registration:

1. Go to API permissions → Add a permission.
2. Select APIs my organization uses.
3. Search for Microsoft Cognitive Services and select it.
4. Under Permissions, choose Delegated permissions.
5. Check Access Cognitive Services API as organization users.
6. Select Add permissions.

This allows the app to access Cognitive Services (including Translator) as an organization user.

2.2. Assign RBAC role on the Translator resource

On the Translator resource in the Azure portal:

1. Open the Translator resource.
2. Select Access control (IAM).
3. Select Add role assignment.
4. Choose the Cognitive Services User role and select Next.
5. Under Assign access to, choose User, group, or service principal.
6. Select Select members, search for the Entra app (for example, text-translation-app), select it, and choose Select.
7. Select Review + assign to complete.

This grants the app permission to call the Translator resource using Entra tokens.

2.3. Call Translator with an Entra access token

After acquiring an Entra access token for Cognitive Services, call Translator using either the global endpoint plus Ocp-Apim-ResourceId or the custom domain endpoint.

Option A – Global endpoint with Resource ID header

1. In the Translator resource:
   • Global endpoint: Resource Management → Keys and Endpoint → Web API → Text translation.
   • Resource ID: Resource Management → Properties (format /subscriptions/<subscriptionId>/resourceGroups/<resourceGroupName>/providers/Microsoft.CognitiveServices/accounts/<resourceName>/).
2. Use curl with the access token and resource ID:

curl -X POST "https://api.cognitive.microsofttranslator.com/translate?api-version=3.0&to=en" \
  -H "Authorization: Bearer {access-token}" \
  -H "Ocp-Apim-ResourceId: {your-resource-ID}" \
  -H "Content-Type: application/json" \
  -d "[{'Text':'Hola'}]"

Option B – Custom domain endpoint

Alternatively, use the custom domain endpoint (based on the resource name) and send the same Authorization: Bearer {access-token} header. The context shows the pattern for a custom domain:

curl -X POST "https://{your-custom-domain}.cognitiveservices.azure.com/translator/text/v3.0/translate?api-version=3.0&to=en" \
  -H "Authorization: Bearer {access-token}" \
  -H "Content-Type: application/json" \
  -d "[{'Text':'Hola'}]"

Language detection and translation both use this Translator endpoint; only the route and parameters differ in the REST API, but the authentication pattern remains the same.

3. Configure Microsoft Entra ID for Speech & Speech Translation

The Speech quickstarts in the context show key-based auth via environment variables, but also explicitly recommend Entra ID with managed identities for production.

3.1. Security guidance

For Speech services:

• Use Microsoft Entra ID authentication with managed identities for Azure resources to avoid storing credentials with applications that run in the cloud.
• If keys are used, they should be stored in Key Vault, but in this scenario key-based auth is disabled, so Entra ID is the recommended path.

The quickstarts describe using environment variables such as SPEECH_KEY, SPEECH_REGION, and ENDPOINT for key-based auth. For Entra ID, replace key-based auth in code with token-based auth using Entra ID and/or managed identities. The context does not provide the exact token acquisition code for Speech, but it establishes that Entra ID is the recommended method.

3.2. Environment setup for Speech SDK (JavaScript/TypeScript/Java)

For JavaScript and TypeScript quickstarts:

1. Create a project folder and initialize package.json:
   • mkdir translation-quickstart && cd translation-quickstart
   • npm init -y
2. Install the Speech SDK:
   • npm install microsoft-cognitiveservices-speech-sdk
3. For TypeScript, also:
   • npm pkg set type=module
   • npm install --save-dev @types/node

For Java quickstarts:

1. Install Apache Maven and verify with mvn -v.
2. Create pom.xml and run:
   • mvn clean dependency:copy-dependencies

These steps prepare the environment to integrate Speech and Speech Translation into the Foundry project. Then, instead of using SPEECH_KEY, configure the SDK to use Entra ID / managed identity (per Speech SDK docs) in line with the recommendation in the context.

4. Summary for Azure AI Foundry integration

Within an Azure AI Foundry project:

• For Language Detection and Text Translation:
  • Use Azure Translator with Entra ID as described above: add Cognitive Services API permissions, assign Cognitive Services User role, obtain an access token, and call Translator with Authorization: Bearer.
• For Speech-to-Text and Speech Translation:
  • Use the Speech SDKs (JavaScript/TypeScript/Java) in the Foundry tools environment.
  • Follow the security guidance to use Microsoft Entra ID authentication with managed identities instead of keys.

This keeps all four services aligned with Entra-only authentication and avoids key-based auth, consistent with the environment configuration.

References:

• Enable Microsoft Entra ID authentication
• Assign the Cognitive Services User role to Azure Translator resource
• Use access token authentication for a REST API request
• Quickstart: Recognize and translate speech to text (programming-language-javascript)
• Quickstart: Recognize and translate speech to text (programming-language-typescript)
• Quickstart: Recognize and translate speech to text (programming-language-java)