Cognitive Services accounts should have local authentication methods disabled
Disable local authentication methods so that Cognitive Services accounts require Azure Active Directory identities exclusively for authentication. The Checkov check inspects `local_auth_enabled` on `azurerm_cognitive_account`.
Static API keys never expire and carry no caller identity. A leaked key grants full data-plane access to models and data.
What this control checks
Cognitive Services accounts require Azure Active Directory identities exclusively
Common pitfalls
Policy Modify only applies to newer API versions
The Modify operation applies only when greaterOrEquals(requestContext().apiVersion, '2021-04-30').
Checkov expects local_auth_enabled to be False
Checkov inspects local_auth_enabled and expects the value False.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Configure Cognitive Services accounts to disable local authentication methods" (14de9e63-1b31-492e-a5a3-c3f7fd57f555); Prowler check aiservices_account_local_auth_disabled (prowler azure --checks aiservices_account_local_auth_disabled); PowerPipe control azure_compliance.control.cognitive_service_local_auth_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_236.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-2 (Account Management), AC-2(1) (Automated System Account Management), AC-2(7) (Privileged User Accounts) and 3 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- AC-2 Account Management
- AC-2(1) Automated System Account Management
- AC-2(7) Privileged User Accounts
- Access Enforcement (AC-3)
- IA-2: Identification And Authentication
1 more clause
- IA-4 Identifier Management
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.5.1 Identify system users, processes acting on behalf of users, and devices
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
6 more clauses
- 3.5.5 Prevent reuse of identifiers for a defined period
- 3.5.6 Disable identifiers after a defined period of inactivity
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cognitive_service_local_auth_disabled - Checkov Check:
CKV_AZURE_236 - Powerpipe Control:
azure_compliance.control.cognitive_service_local_auth_disabled - Prowler Check:
aiservices_account_local_auth_disabled - Azure Policy Definition:
14de9e63-1b31-492e-a5a3-c3f7fd57f555
Last reviewed: 2026-10-11