How to setup the EntraID auth for Azure OpenAI?

[Vivien Hung (Vivihung)]

Hi,

Are there more instructions on setting up Microsoft EntraID (was AAD) auth for access Azure OpenAI instances via UFO?
I don't understand what scope, and scope base mean below. Do you expect me to create an EntraID app and grand some inference roles defined in Azure OpenAI instance to the app? If so, what does scope mean under this context? Could you please provide an example?
 

  ### For Azure_AD
  # AAD_TENANT_ID: "YOUR_TENANT_ID", # Set the value to your tenant id for the llm model
  # AAD_API_SCOPE: "YOUR_SCOPE", # Set the value to your scope for the llm model
  # AAD_API_SCOPE_BASE: "YOUR_SCOPE_BASE" # Set the value to your scope base for the llm model, whose format is API://YOUR_SCOPE_BASE, and the only need is the YOUR_SCOPE_BASE

[Chiming Ni (nice-mee)]

Hi, AAD_API_SCOPE is only used in Operator and AAD_API_SCOPE_BASE is used in the rest of the modes.

You should have an URI like api://xxxxxxx-xxxxx/.default if you're using Azure AD. AAD_API_SCOPE_BASE is simply the substring without prefix api:// and trailing /.default. If you're not using Operator, there is no need to set up AAD_API_SCOPE.

This API scope is then passed to get_bearer_token_provider to set up a token provider, that's how authentication is done.

Sorry for the confusion between AAD_API_SCOPE_BASE and AAD_API_SCOPE. The operator mode only reads AAD_API_SCOPE and it should be the full URI (with prefix api:// and trailing /.default). We're planning on rolling out a version unifying the authentication of both modes.