Speech Services- Restrict Outbound Access

[Shikhaghildiyal]

What is Speech Service



The Speech service provides speech to text and text to speech capabilities with a Speech resource



It is one of the types of Cognitive Accounts i.e.- type": "Microsoft.CognitiveServices/accounts and “kind": "SpeechServices",



What is restrictOutboundNetworkAccess property and why do we use it?



restrictOutboundNetworkAccess property is used in speech services to enable data loss prevention. When this property is enabled, the Speech service will connect only to the allowed endpoints as specified in the list of FQDN allowed endpoints. For e.g.-> if you need to transcribe data which comes from a blob, the FQDN of your storage account should be in this list. If this property is not set as true, Speech service won’t be able to access your storage account.

Reference document which explains about this property- Data loss prevention - Azure AI services



How to enable/Disable restrictOutboundNetworkAccess for Speech Services?



You cannot deploy your speech service manually from Azure Portal with “restrictOutboundNetworkAccess” property as true or false.

We can deploy Speech Services using ARM/PowerShell/terraform with property restrictOutboundNetworkAccess set as true or false

Using CLI/powershell, reference:- Data loss prevention - Azure AI services | Microsoft Learn

Using ARM template, reference: Microsoft.CognitiveServices/accounts - Bicep, ARM template & Terraform AzAPI reference | Microsoft Learn



Sample Code for Deploying Speech Service with restrictOutboundNetworkAccess as true and list of allowed FQDN using custom template deployment from Azure Portal



Please note that with restrictOutboundNetworkAccess property, we are also using allowedFqdnList which will include list of URL’s that can be accessible by Speech Services



{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01 deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"cognitiveServiceName": {
"type": "String",
"metadata": {
"description": "Name of the Cognitive Service account"
}
},
"location": {
"defaultValue": "[resourceGroup().location]",
"type": "String",
"metadata": {
"description": "Location for the Cognitive Service account"
}
},
"sku": {
"defaultValue": "F0",
"allowedValues": [
"F0",
"S0"
],
"type": "String",
"metadata": {
"description": "The pricing tier of the Cognitive Service account"
}
}
},
"resources": [
{
"type": "Microsoft.CognitiveServices/accounts",
"apiVersion": "2022-12-01",
"name": "[parameters('cognitiveServiceName')]",
"location": "[parameters('location')]",
"sku": {
"name": "[parameters('sku')]"
},
"kind": "SpeechServices",
"properties": {
"restrictOutboundNetworkAccess": true,
"disableLocalAuth": true,
"allowedFqdnList": [
"microsoft.com"
]
}
}
]
}



Above code will deploy your speech service with restrictOutboundNetworkAccess as “true”



How to check whether restrictOutboundNetworkAccess is enabled/disabled for Speech Services



We can go to JSON view of Deployed Resource and check if the property is set as “true” or “false”







Reference document for Use Cases of testing can be found here - Use Cases for Testing Restrictoutboundnetworkaccess for Speech Service - Microsoft Community Hub

Continue reading...