---
title: Azure AI Foundry API keys enabled then listed
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure AI Foundry API keys enabled then
  listed
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure AI Foundry API keys enabled then listed
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects when an Azure AI Foundry account enables API-key-based access. Use of Azure OpenAI API keys is discouraged by Microsoft as those keys are not tied to a specific identity and lack any fine-grained permission scopes.

## Strategy{% #strategy %}

This rule monitors Azure Activity Log events for `azure.cognitiveservices` resources and links two key-listing actions against the same Cognitive Services account. The first step matches when `MICROSOFT.COGNITIVESERVICES/ACCOUNTS/LISTKEYS/ACTION` fails with a status message indicating that `disableLocalAuth` is set to `true`, meaning API-key access is turned off. The second step matches a successful key retrieval (`MICROSOFT.COGNITIVESERVICES/ACCOUNTS/LISTKEYS/ACTION` with `@evt.outcome` of `Success`) on that same account within three hours, indicating that API-key access was re-enabled in between and keys are now active.

## Triage & Response{% #triage--response %}

- Examine whether the `{{@usr.id}}` that performed this activity had a legitimate reason to modify the Azure AI Foundry account configuration and retrieve its keys.
- Review the `{{@callerIpAddress}}` and `{{@identity.claims}}` associated with both events to determine if the activity originated from expected infrastructure, such as a known CI/CD pipeline or administrative workstation, and whether the same actor performed both steps.
- Look for a `MICROSOFT.COGNITIVESERVICES/ACCOUNTS/WRITE` event on `{{@resource_name}}` between the two key-listing events to confirm who re-enabled local authentication and whether that change was approved.
- Examine subsequent use of API keys for suspicious behavior, such as calls from unexpected IPs or calls to new services.