Policy: Configure private DNS zones for cognitive services / There is no distinction between different resource types that use different private DNS zones.

[alcaraz-fran]

I have seen that Azure AI Services (Microsoft.CognitiveServices/accounts) currently have three possible private DNS zones (Link to the documentation):

    "privatelink.cognitiveservices.azure.com", # Azure AI services (Microsoft.CognitiveServices/accounts) / account
    "privatelink.openai.azure.com",            # Azure AI services (Microsoft.CognitiveServices/accounts) / account
    "privatelink.services.ai.azure.com",       # Azure AI services (Microsoft.CognitiveServices/accounts) / accoun

I am looking for an Azure policy that configures the correct private dns zone in the private endpoints.

• The buil-in policy 'Configure Cognitive Services accounts to use private DNS zones' doesn't fit well because Azure Open AI uses a different domain name.
• The custom policy 'Configure a private DNS Zone ID for Cognitive Services account groupID' differentiates between the Azure Open AI resources and the other types of resources, it does not differentiate between resources with the private DNS zone 'privatelink.cognitiveservices.azure.com' and those with 'privatelink.services.ai.azure.com'. This custom policy was provided in this issue: Issue link

Hence, we cannot properly deploy DNS Zone Groups for these services correctly.