You need to restrict access to an Azure AI services (Cognitive Services) account so that only specific resources on a virtual network can reach it and block public (external) access with minimum effort.
The simplest approach is to use Virtual Network service endpoints for Microsoft.CognitiveServices:
Enable the service endpoint on the VNet/subnet (VNet1) for Microsoft.CognitiveServices
This routes traffic from that subnet to the Cognitive Services account over the Azure backbone and allows the account to identify traffic coming from that subnet.
Modify the Cognitive Services account’s network settings (CSAccount1)
Set Public network access: Disabled (or allow access from Selected networks) and add the VNet/subnet enabled with the service endpoint to the allowed list.
This blocks all external access while permitting access from only the specified VNet resources.
Other options are not appropriate:
A. Modify VNet settings (generic) doesn’t target the required service endpoint action.
C. IAM controls user/role authorization, not network access.
D. Create a virtual subnet isn’t necessary if the VNet/subnet already exists; using service endpoints avoids creating/maintaining private endpoints.
Therefore, the correct pair is B and E.
Microsoft Azure AI Solution References
Secure Cognitive Services with virtual network service endpoints – explains enabling Microsoft.CognitiveServices service endpoints on a subnet and restricting the account to selected networks.
https://learn.microsoft.com/azure/ai-services/cognitive-services-virtual-networks
Network access restrictions for Cognitive Services – details configuring “Public network access” and allowing access from selected VNets/subnets.
https://learn.microsoft.com/azure/ai-services/cognitive-services-network-security
Overview of securing Azure AI services – covers options (service endpoints vs. private endpoints) and minimal configuration steps.
https://learn.microsoft.com/azure/ai-services/security-networking
