MAINT Migrate Azure Cognitive Services from API key to Entra ID authentication#1404
Open
romanlutz wants to merge 10 commits intoAzure:mainfrom
Open
MAINT Migrate Azure Cognitive Services from API key to Entra ID authentication#1404romanlutz wants to merge 10 commits intoAzure:mainfrom
romanlutz wants to merge 10 commits intoAzure:mainfrom
Conversation
- Update AIRTTargetInitializer to use get_azure_openai_auth() for Azure OpenAI targets and get_azure_token_provider() for PromptShieldTarget instead of API key environment variables - Remove key_var from all Azure target configs in TARGET_CONFIGS - Update 15 notebook .py files to use Entra auth for Azure endpoints - Non-Azure targets (platform OpenAI, Groq, Google, etc.) keep API keys - Update unit tests to mock Entra auth providers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Remove Azure CogSvc API key lines from .env_example - Update .env_example header to reflect Entra auth is the default - Re-execute 13 notebooks with jupytext --execute to verify Entra auth works and populate cell outputs All notebooks pass except: - 10_http_target: second cell fails with pre-existing regex bug (unrelated) - 7_azure_sql_memory_attacks: fails due to az login not available in kernel subprocess (infrastructure issue, not auth) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Cell 1 (AOAI example) succeeds with Entra auth. Cell 2 (Red Teaming) fails due to pre-existing regex bug in HTTPTarget. BIC cells are not executable (require browser cookies). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Add '10.2' to Playwright Copilot Target title in .py and .ipynb - Restore xpia website notebook outputs from main - Execute 7_azure_sql_memory_attacks notebook (all 4 cells pass) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use lambda in re.sub to prevent backslash interpretation in LLM response text (e.g. \u unicode escapes). All cells now pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
All three notebooks pass with Entra auth via AIRTTargetInitializer. Image notebook cell 2 (image editing) has pre-existing model error. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
dall-e-3 does not support image editing. Switch to OPENAI_IMAGE_ENDPOINT2 (gpt-image-1) with Entra auth for the editing example. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Empty assistant responses are due to content filtering on the Azure endpoint, not auth issues. Auth works correctly with Entra tokens. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Fix notebook URL: use /chat/completions path (was getting 404s) - Add model field to raw HTTP request body - Detect content-filtered responses and return error type - Add 2 unit tests for content filter handling Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR removes API key (local auth) dependencies for all Azure Cognitive Services targets in PyRIT, replacing them with Entra ID (Azure AD) token-based
authentication. This is in preparation for disabling local auth across 62 CogSvc resources in the AI Red Team Tooling and Trustworthy Machine Learning
subscriptions.
Changes
Core: AIRTTargetInitializer
PromptShieldTarget
Notebooks (15 .py + .ipynb pairs)
.env_example
Bug fixes (found during migration)
error/blocked type, consistent with other targets.
Other improvements
What's NOT changing
Testing