Meeting Foundry project creation requirements: DLP and No Local Authentication

Question

Meeting Foundry project creation requirements: DLP and No Local Authentication

Mathew Taylor 0

I'm trying to create my first Azure Foundry project via the wizard. I have been told I must meet DLP requirements and disable Local Authentication to do so, but neither the old nor new wizard UI seems to let me set the needed configuration during project creation. Is there a way to do that, or must I create the project manually via Bicep/ARM template? If the latter, what would that template contain? Thank you!

0 comments

3 answers

Your answer

Answer 1

Hi Mathew Taylor,

Thank you for your question.

Based on the current Foundry project creation experience, the project creation wizard does not expose settings for Data Loss Prevention (DLP) or Local Authentication during project creation. As a result, if your organization requires these controls, they typically need to be configured at the underlying Azure AI Services / Foundry resource level before or after the project is created.

For Local Authentication, the supported approach is to create or update the Azure AI Services resource with local authentication disabled (disableLocalAuth=true) and use Microsoft Entra ID authentication instead. The project can then be created under that resource. The resource must also be configured for project management if you intend to create Foundry projects beneath it.

Regarding DLP requirements, these are generally enforced through your organization's governance and policy controls rather than through an individual Foundry project setting. If your subscription is subject to Azure Policy requirements, you may need to deploy the resource using infrastructure-as-code (ARM/Bicep) or other administrative deployment methods that satisfy those policies before creating the project.

If the portal wizard is blocked by policy validation, could you share the exact error message or policy compliance message being displayed? That would help determine whether the requirement is related to local authentication, Azure Policy enforcement, or another prerequisite.

Hope this helps clarify the current behavior.

Answer 2

kagiyama yutaka 5,330

I think Foundry projects have no DLP or local‑auth settings, and the account supports disableLocalAuth=true. Create the account with that flag by ARM/Bicep/CLI and then add the project. DLP is applied through Azure Policy, not through the project resource.

0 comments

Answer 3

For a new Foundry project, the documented CLI flow supports creating the Foundry resource and project, but it does not include a project-creation setting for DLP or a wizard option to disable local authentication during project creation.

What is supported:

Create the Foundry resource first.
- If using Azure CLI, create the resource with --allow-project-management enabled.
- This flag is required for project management and cannot be changed after the resource is created.
Create the project under that resource.
- Use az cognitiveservices account project create after the resource exists.
Disable local authentication on the Foundry resource separately.
- This is supported through Azure Policy, ARM/Bicep property disableLocalAuth: true, or PowerShell with Set-AzCognitiveServicesAccount -DisableLocalAuth $true.
- The classic guidance also states this cannot currently be done through the Azure portal for Foundry Tools; use PowerShell instead.
If organizational requirements such as security controls, naming, tags, or policy compliance must be applied at creation time, use Azure portal advanced configuration or template-based deployment.
- The Foundry project creation guidance explicitly says that if the organization requires customized Azure configurations, security controls, or cost tags, Azure portal or template options might be needed to comply with Azure Policy requirements.

A supported manual path is:

resource foundry 'Microsoft.CognitiveServices/accounts@2023-10-01' = {
  name: 'my-foundry-resource'
  location: 'eastus'
  kind: 'AIServices'
  sku: {
    name: 'S0'
  }
  properties: {
    customSubDomainName: 'my-foundry-resource'
    disableLocalAuth: true
    allowProjectManagement: true
  }
}

Supported facts for that template:

disableLocalAuth: true is the documented property for disabling local authentication in ARM/Bicep.
allowProjectManagement must be enabled when creating the Foundry resource if projects will be created under it.

If using CLI instead of Bicep, the equivalent resource creation pattern is:

az cognitiveservices account create \
  --name my-foundry-resource \
  --resource-group my-foundry-rg \
  --kind AIServices \
  --sku S0 \
  --location eastus \
  --custom-domain my-foundry-resource \
  --allow-project-management

Then create the project:

az cognitiveservices account project create \
  --name my-foundry-resource \
  --resource-group my-foundry-rg \
  --project-name my-foundry-project \
  --location eastus

Important constraints:

--allow-project-management cannot be changed after the resource is created.
The custom domain must be globally unique.
Creating resources requires Contributor, Owner, or a custom role with Microsoft.CognitiveServices/accounts/write.
If local authentication is disabled, use Microsoft Entra authentication.

The provided material does not include a Foundry-project ARM/Bicep template definition for DLP settings specifically. It supports disabling local authentication at the resource level and using template-based deployment when policy/security requirements must be enforced during creation.

References: