Speech Service- RestrictOutboundNetworkAccess

What is Voice Service?

The Speech service provides the ability to convert speech to text and text to speech using speech resources.

This is one of the Cognitive Accounts types, i.e. type”: “Microsoft.CognitiveServices/accounts” and “kind”: “SpeechServices”.

What is the restrictOutboundNetworkAccess property and why would I use it?

The restrictOutboundNetworkAccess property is used to enable data loss prevention in the Speech service. When this property is enabled, the Speech service will only connect to the allowed endpoints specified in the FQDN allowed endpoints list. For example -> If you need to transcribe data coming from a Blob, the FQDN of the storage account must be in this list. If this property is not set to true, the Speech service will not be able to access the storage account.

Reference documentation describing this property – https://learn.microsoft.com/en-us/azure/ai-services/cognitive-services-data-loss-prevention?tabs=azu…

How do I enable/disable restrictOutboundNetworkAccess for voice services?

You cannot manually deploy the Speech service by setting the “restrictOutboundNetworkAccess” property to true or false in the Azure portal.

You can deploy the Speech service using ARM/PowerShell/terraform by setting the property restrictOutboundNetworkAccess to true or false.

CLI/powershell usage reference:- Data Loss Prevention – Azure AI Services | Microsoft Learn

Using ARM templates, see: Microsoft.CognitiveServices/accounts – Bicep, ARM Templates, and Terraform AzAPI Reference | Microsoft L…

Sample code to deploy a Speech service using a custom template deployment in the Azure Portal with restrictOutboundNetworkAccess set to true and a list of allowed FQDNs

Please note the following: Outbound network access restrictions Real Estate, We Use It Too List of allowed Fqdns This contains a list of URLs that can be accessed by the voice service.

{
“$schema”: “https://schema.management.azure.com/schemas/2019-04-01 deploymenttemplate.json#”,
“Content Version”: “1.0.0.0”,
“parameters”: {
“cognitive service name”: {
“type”: “string”,
“metadata”: {
“description”: “Cognitive Service Account Name”
}
},
“location”: {
“Default”: “[resourceGroup().location]”,
“type”: “string”,
“metadata”: {
“Description”: “Location of the cognitive services account”
}
},
“SKU”: {
“default”: “F0”,
“Accepted values”: [
                “F0”,
                “S0”
            ],
“type”: “string”,
“metadata”: {
“Description”: “Pricing Tier for Cognitive Service Accounts”
}
}
},
“resources”: [
        {
            “type”: “Microsoft.CognitiveServices/accounts”,
            “apiVersion”: “2022-12-01”,
            “name”: “[parameters(‘cognitiveServiceName’)]”,
“location”: “[parameters(‘location’)]”,
“SKU”: {
“name”: “[parameters(‘sku’)]”
},
“type”: “SpeechServices”,
“attribute”: {
“restrictOutboundNetworkAccess”: true,
“disableLocalAuth”: true,
“List of allowed Fqdns”: [
                    “microsoft.com”
                ]
}
}
]
}

The above code deploys the voice service. Set restrictOutboundNetworkAccess to “true”

How to check if restrictOutboundNetworkAccess is enabled/disabled for Speech Services

You can go to the JSON view of the deployed resource and check whether the property is set to “true” or “false”.

Reference documentation for test use cases can be found here. Use Case for Testing Restrictoutboundnetworkaccess for Speech Service – Microsoft Community Hub