You are developing an app that uses the Azure AI Speech service , and you must ensure the app can authenticate using a Microsoft Entra ID (Azure AD) token , rather than the standard key-based authentication.
According to the official Microsoft documentation :
"To authenticate with a Microsoft Entra token, the Speech resource must have a custom subdomain and use a private endpoint. The Speech service uses custom subdomains with private endpoints only."
- Microsoft Learn: Azure AI Speech service - Role-based access control
Therefore, two prerequisites must be configured for Entra ID token-based authentication:
1. Create (Certify) a Custom Subdomain (Option D)
When you create an Azure AI Speech resource, you can specify a custom subdomain name (e.g., contoso.
cognitiveservices.azure.com).
The custom subdomain ensures that each Speech endpoint has a unique URL.
Microsoft Entra token authentication depends on this subdomain for token validation.
Without a custom subdomain, Entra ID tokens cannot be used for authentication.
Hence, this is required.
2. Create a Private Endpoint (Option B)
For Microsoft Entra ID authentication, the Speech resource must be secured within a private endpoint .
Private endpoints provide a secure, private connection from your virtual network to the Azure AI Speech resource.
The Speech service only supports Entra ID token authentication when the resource is configured with a private endpoint.
Hence, this is required.
Why Not the Other Options:
A). Create a Conditional Access - Conditional Access policies restrict user access but do not configure token authentication for services.
C). Request an X.509 certificate - Certificates are not used for Speech service authentication.
E). Enable a virtual network service endpoint - The Speech service uses private endpoints , not service endpoints, for Entra ID token authentication.