This chapter covers the Azure Face Service, a key computer vision offering in Microsoft Azure. The AI-900 exam tests your understanding of face detection, verification, identification, and attribute analysis, along with responsible AI considerations. Expect approximately 5-10% of exam questions to touch on this topic, often in scenarios involving security, user authentication, or demographic analysis. By the end of this chapter, you'll be able to differentiate between face-related operations and understand their appropriate use cases.
Jump to a section
Imagine a high-security building with a VIP entrance. The Azure Face Service is like an automated security system that scans each person's face as they approach. First, the camera detects that a face is present (Face Detection). Then, it extracts unique facial features like the distance between eyes, nose shape, and jawline, creating a digital 'faceprint' (Face Landmarks). This faceprint is stored in a secure database (PersonGroup). When a VIP arrives, the system compares their live faceprint against the database to verify their identity (Face Verification). If the system needs to find a person in a crowd, it searches the database for the closest match (Face Identification). The system can also analyze attributes like age, emotion, or whether the person is wearing glasses (Face Attributes). Importantly, the system never stores the actual image, only the mathematical representation, ensuring privacy. The entire process is stateless and stateless, meaning each request is independent and no session state is maintained between calls.
What is the Azure Face Service?
The Azure Face Service is a cloud-based API that provides advanced algorithms for detecting, recognizing, and analyzing human faces in images. It is part of Azure Cognitive Services, specifically under Computer Vision. The service allows developers to integrate facial recognition capabilities into applications without needing deep expertise in machine learning. It is built on deep learning models trained on massive datasets and is continuously updated by Microsoft.
Why It Exists
Facial recognition technology is used in many scenarios: security and access control (e.g., unlocking phones, building entry), user verification (e.g., banking apps), photo tagging (e.g., social media), and demographic analysis (e.g., retail customer insights). The Azure Face Service provides a scalable, secure, and compliant way to implement these features. Importantly, Microsoft has strict responsible AI policies that limit the use of facial recognition for certain purposes (e.g., real-time surveillance in public spaces) to ensure ethical deployment.
How It Works Internally
When you submit an image to the Face Service, the following steps occur: 1. Face Detection: The service first detects human faces in the image. It returns a bounding box for each face (coordinates of the face rectangle). The detection model is trained to identify faces even with partial occlusion (e.g., glasses, masks) or varying angles (up to a certain degree). 2. Face Landmark Extraction: For each detected face, the service extracts 27 facial landmarks (e.g., eye corners, nose tip, mouth corners). These landmarks are used for alignment and feature extraction. 3. Feature Vector Generation: The service converts the face into a mathematical representation called a 'face vector' or 'faceprint'. This is a high-dimensional vector (typically 128 or 512 dimensions) that encodes the unique features of the face. The same person under different conditions (lighting, expression) will produce similar vectors. 4. Face Verification: To verify a person's identity, the service compares two face vectors (one from a live image, one from a stored image) and returns a confidence score. If the score exceeds a threshold (default 0.5), the faces are considered the same person. 5. Face Identification: To identify a person from a gallery, the service compares a query face vector against all stored vectors in a PersonGroup. It returns the top matches with confidence scores. The maximum number of candidates returned can be configured (default is 1). 6. Face Attributes: The service can optionally analyze attributes such as age, gender, emotion (anger, contempt, disgust, fear, happiness, neutral, sadness, surprise), head pose, smile, facial hair, glasses, and more. These attributes are probabilistic estimates, not absolute truths.
Key Components, Values, and Defaults
PersonGroup: A container for up to 10,000 persons. Each person can have up to 248 face images. Used for identification and verification scenarios.
LargePersonGroup: Supports up to 1,000,000 persons. Used for large-scale identification.
FaceList: A list of up to 1,000 faces used for find-similar operations (not identification).
LargeFaceList: Supports up to 1,000,000 faces.
Detection Model: detection_01 (default) or detection_02 (improved for small faces and rotated faces). Use detection_02 for better accuracy on small faces.
Recognition Model: recognition_01 (original), recognition_02 (improved), recognition_03 (best accuracy). recognition_04 is the latest as of 2023. Always use the latest model for production.
Confidence Threshold: Default 0.5 for verification and identification. You can adjust this based on your security needs. Higher threshold reduces false positives but may increase false negatives.
API Endpoint: https://<your-resource-name>.cognitiveservices.azure.com/face/v1.0/
Rate Limits: Varies by tier (Free: 20 calls per minute, Standard: 10 calls per second).
Configuration and Verification Commands
To use the Face Service, you must create a Cognitive Services resource in the Azure portal. Then you can interact via REST API or SDKs (C#, Python, Java, etc.). Here is an example using Python SDK:
from azure.cognitiveservices.vision.face import FaceClient
from msrest.authentication import CognitiveServicesCredentials
# Create client
face_client = FaceClient(ENDPOINT, CognitiveServicesCredentials(KEY))
# Detect faces
detected_faces = face_client.face.detect_with_url(
url='https://example.com/image.jpg',
return_face_attributes=['age', 'emotion'],
recognition_model='recognition_04'
)
for face in detected_faces:
print(f'Face ID: {face.face_id}')
print(f'Age: {face.face_attributes.age}')
print(f'Emotion: {max(face.face_attributes.emotion.as_dict(), key=face.face_attributes.emotion.as_dict().get)}')To verify two faces:
verify_result = face_client.face.verify_face_to_face(face_id1, face_id2)
print(f'Confidence: {verify_result.confidence}')To identify a face against a PersonGroup:
identify_results = face_client.face.identify([face_id], person_group_id='mygroup')
for result in identify_results:
for candidate in result.candidates:
print(f'Person ID: {candidate.person_id}, Confidence: {candidate.confidence}')How It Interacts with Related Technologies
Azure Cognitive Services: The Face Service is part of the broader Cognitive Services suite. It can be combined with other services like Computer Vision (for OCR or image analysis) or Video Indexer (for face detection in videos).
Azure Logic Apps and Power Automate: You can integrate Face Service into workflows without writing code. For example, trigger an action when a specific person is detected.
Azure Functions: Use serverless functions to process face detection requests at scale.
Azure Storage: Store images in Blob Storage and pass URLs to the Face Service.
Custom Vision: For specialized face recognition tasks (e.g., specific animal faces), you may use Custom Vision instead of the pre-built Face Service.
Responsible AI Considerations
Microsoft has retired several facial recognition capabilities for ethical reasons. As of June 2023, the Face Service no longer supports: - Emotion attribute analysis (returning emotion values from faces). - Gender attribute analysis. - Age attribute analysis (this is still available but with a warning). - Facial hair, makeup, and accessories attributes. These changes were made to prevent potential misuse, such as profiling or surveillance. The AI-900 exam may test your awareness of these responsible AI policies.
Trap Patterns
Confusing Face Detection with Face Recognition: Detection just finds faces; recognition identifies them. The exam may ask which operation returns a bounding box vs. a person ID.
Assuming Face Service can recognize emotions: It no longer does as of the latest update. The exam might present a scenario where emotion analysis is required, but the correct answer would be to use a different service or acknowledge the limitation.
Overestimating accuracy: Face Service is probabilistic. Confidence scores are not 100% accurate. The exam may test that you must set an appropriate confidence threshold.
Ignoring rate limits: The Free tier is limited to 20 calls per minute. The exam may ask about scaling to production.
Create a Face Resource
In the Azure portal, create a Cognitive Services resource of type 'Face'. Choose a region (e.g., East US), pricing tier (Free F0 or Standard S0). The Free tier allows 20 calls per minute, 30K calls per month. You'll get an endpoint URL and two keys (primary and secondary). These are used for authentication in API calls. For production, use Standard tier and store keys in Azure Key Vault.
Detect Faces in an Image
Call the Face API's detect endpoint with an image URL or binary data. The API returns a JSON response with face rectangles (top, left, width, height), face IDs (valid for 24 hours), and optional attributes if requested. The detection models `detection_01` and `detection_02` affect accuracy on small/rotated faces. Use `detection_02` for better results. The face ID is used for subsequent operations like verification or identification.
Extract Face Attributes
Set the `returnFaceAttributes` parameter to a comma-separated list of attributes: `age`, `gender`, `headPose`, `smile`, `facialHair`, `glasses`, `emotion`, `hair`, `makeup`, `accessories`, `occlusion`, `blur`, `exposure`, `noise`. Note that as of June 2023, Microsoft has retired `emotion`, `gender`, `age` (with warning), `facialHair`, `makeup`, and `accessories` for new resources. Existing resources may still work but new ones will not return these attributes. The exam may test this change.
Create a PersonGroup
A PersonGroup is a container for persons. You create it via the PersonGroup - Create API. Specify a `personGroupId` (string, no spaces) and `name`. Optionally set `recognitionModel` to `recognition_04`. The PersonGroup can hold up to 10,000 persons (or 1,000,000 for LargePersonGroup). Each person can have up to 248 face images. After creating the group, you add persons and their faces using the PersonGroup Person - Add Face API.
Train the PersonGroup
After adding persons and faces, you must train the PersonGroup using the PersonGroup - Train API. Training generates the face vectors for all persons. Training is asynchronous; you can check status with PersonGroup - Get Training Status. Until training completes, identification and verification against the group will fail. Training time depends on the number of persons and faces. You must retrain after adding or removing faces.
Identify a Face
To identify a face, call the Face - Identify API with a face ID (from detection) and a PersonGroup ID. The API compares the query face vector against all trained vectors in the group. It returns up to `maxNumOfCandidatesReturned` (default 1) candidates with confidence scores. You set a `confidenceThreshold` to filter low-confidence matches. The default is 0.5. If no candidate exceeds the threshold, the result is empty.
Enterprise Scenario 1: Secure Building Access
A multinational corporation uses Azure Face Service for employee entry to its headquarters. Employees register their faces via a mobile app that captures multiple images (with different angles and expressions). These images are added to a LargePersonGroup (up to 10,000 employees). At each entrance, a camera captures a live image, detects the face, and calls the Face - Identify API. The system grants access if the top candidate has confidence > 0.7. The security team monitors false rejections (employees not recognized) and adjusts the threshold. They also use detection_02 for better detection of faces with masks (partial occlusion). Performance considerations: The API calls are routed through Azure Front Door for low latency. The system is designed for 1,000 entry requests per hour. If the network is slow, the API may timeout (default 60 seconds). They use Azure Functions to retry on transient failures.
Enterprise Scenario 2: Photo Tagging in Social Media App
A social media startup wants to automatically tag users in uploaded photos. They use Face Service's find_similar operation to match faces in a new photo against a FaceList of known users. Each user has a representative face image stored in a FaceList. When a photo is uploaded, the app detects all faces and for each, finds the most similar face in the FaceList. If confidence > 0.6, the user is tagged. The startup must handle rate limits: the Free tier allows 20 calls per minute, so they upgrade to Standard. They also implement caching: if a face ID is already matched, they store the match for 24 hours (since face IDs expire). A common issue is false positives when two people look similar (e.g., twins). They mitigate by requiring multiple images per user and setting a high threshold.
Enterprise Scenario 3: Retail Customer Analytics (Legacy)
A retail chain used Face Service to analyze demographic attributes (age, gender, emotion) of customers to optimize store layouts. However, after Microsoft's responsible AI changes, they can no longer use these attributes. They had to pivot to using only face detection for counting foot traffic (number of faces detected per hour) and use other services (e.g., Custom Vision) for customer sentiment analysis. This scenario highlights the importance of staying updated with service capabilities. The exam may test that you are aware of these retirement changes.
What AI-900 Tests on This Topic
AI-900 objective 3.3 covers 'Identify features of computer vision workloads on Azure'. The Face Service is a specific example. Exam questions typically ask you to match a business scenario to the correct Face Service operation. For example: - 'Which Face Service operation should you use to confirm a person is who they claim to be?' Answer: Face Verification. - 'Which operation finds a person from a pre-registered group?' Answer: Face Identification. - 'Which operation returns bounding boxes?' Answer: Face Detection.
Common Wrong Answers and Why
Confusing Verification and Identification: Candidates often choose 'Identification' when the scenario is about verifying a match between two specific images (e.g., passport photo vs. live selfie). Verification is for one-to-one matching; Identification is one-to-many. The exam may describe a login scenario where the user provides a username (so it's verification, not identification).
Assuming Emotion Detection is Available: Many outdated study materials still mention emotion detection. The exam now tests that emotion analysis is retired. The correct answer for a scenario requiring emotion would be that Face Service cannot do it (or use a different service).
Choosing 'Find Similar' Instead of 'Identify': Find Similar is for finding faces that look alike from a FaceList (no person identity). Identify is for matching against a PersonGroup (known identities). The exam may trick you with a scenario where you have a list of known criminals (PersonGroup) vs. a list of random faces (FaceList).
Ignoring the Training Step: Candidates may think that after adding faces to a PersonGroup, identification works immediately. The exam may ask about the required step before identification. The correct answer is to train the PersonGroup.
Specific Numbers and Terms to Memorize
Maximum persons in a PersonGroup: 10,000 (LargePersonGroup: 1,000,000).
Maximum faces per person: 248.
Face ID expiration: 24 hours.
Default confidence threshold: 0.5.
Detection models: detection_01, detection_02.
Recognition models: recognition_01, recognition_02, recognition_03, recognition_04.
Retired attributes: emotion, gender, age (with warning), facial hair, makeup, accessories.
Edge Cases and Exceptions
Multiple faces in one image: Detection returns all faces. Each gets a unique face ID.
No face detected: API returns an empty array.
Invalid image format: Must be JPEG, PNG, GIF, BMP. Max file size 6MB for detection. Larger images must be resized.
Occlusion: Face Service can detect faces with glasses, masks, or hats, but accuracy may decrease.
Recognition across models: Face vectors from different recognition models are incompatible. You must use the same model for enrollment and query.
How to Eliminate Wrong Answers
If the scenario involves comparing two specific images, it's Verification.
If the scenario involves searching a database for a person's identity, it's Identification.
If the scenario involves finding similar-looking faces without identity, it's Find Similar.
If the scenario asks for a bounding box, it's Detection.
If the scenario mentions emotion or gender, remember it's retired (unless the question explicitly says 'prior to retirement').
Face Detection returns bounding boxes and face IDs; does not identify the person.
Face Verification is one-to-one matching; Face Identification is one-to-many matching.
PersonGroup holds up to 10,000 persons; LargePersonGroup holds up to 1,000,000.
Training a PersonGroup is required after adding faces before identification.
Face IDs expire 24 hours after detection.
Default confidence threshold for verification/identification is 0.5.
Emotion, gender, and several other attributes are retired from Face Service for new resources.
Use the latest recognition model (recognition_04) for best accuracy.
Face Service does not store original images; only face vectors.
Rate limits: Free tier 20 calls/min, Standard tier 10 calls/sec.
These come up on the exam all the time. Here's how to tell them apart.
Face Detection
Finds faces in an image and returns bounding boxes.
Does not identify who the person is.
Returns a face ID that expires in 24 hours.
Can be used with multiple detection models.
Does not require a PersonGroup or training.
Face Recognition
Identifies or verifies a person's identity.
Requires a PersonGroup with trained face vectors.
Uses face IDs from detection for comparison.
Can be one-to-one (Verification) or one-to-many (Identification).
Requires training on the PersonGroup before use.
Mistake
Face Service can recognize emotions like happiness or sadness.
Correct
As of June 2023, Microsoft retired emotion analysis from the Face Service for new resources. Existing resources may still work, but new ones will not return emotion attributes. The AI-900 exam tests this change.
Mistake
Face Verification and Face Identification are the same thing.
Correct
Verification is one-to-one matching: 'Is this person the same as that person?' Identification is one-to-many matching: 'Who is this person in a group of known people?' They use different API endpoints and have different use cases.
Mistake
After adding faces to a PersonGroup, you can immediately identify faces.
Correct
You must train the PersonGroup after adding or removing faces. Until training completes, identification and verification against the group will fail. Training is an asynchronous operation.
Mistake
Face Service stores the actual images of faces.
Correct
Face Service only stores the mathematical face vectors (faceprints). The original image is not retained unless you explicitly store it yourself. This is for privacy and security.
Mistake
The default confidence threshold for identification is 0.8.
Correct
The default confidence threshold is 0.5. You can adjust it based on your security needs. A higher threshold reduces false positives but may increase false negatives.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Face Verification compares two face images to determine if they are the same person (one-to-one match). It returns a confidence score. Face Identification compares a single face against a database of known persons (one-to-many match) and returns the closest matches with confidence scores. Verification is used for authentication (e.g., login), while identification is used for recognition (e.g., finding a person in a crowd).
Yes, absolutely. After creating a PersonGroup and adding persons with their face images, you must call the PersonGroup - Train API. Training generates the face vectors for all persons. Until training completes, any identification or verification request against that group will fail. You also need to retrain if you add or remove persons or faces.
A face ID returned by the Face Detection API is valid for 24 hours. After that, it expires and cannot be used for verification or identification. You must re-detect the face to get a new face ID. This is a security measure to prevent long-term tracking.
As of June 2023, Microsoft retired emotion analysis from the Face Service for new resources. Existing resources may still have the capability, but new resources will not return emotion attributes. The AI-900 exam reflects this change. If you need emotion detection, consider using other services like Video Indexer or custom models.
A standard PersonGroup can hold up to 10,000 persons. For larger scenarios, use a LargePersonGroup which supports up to 1,000,000 persons. Each person can have up to 248 face images. The choice depends on the scale of your application.
The default confidence threshold is 0.5. You can adjust it by setting the `confidenceThreshold` parameter in the API call. A higher threshold (e.g., 0.7) reduces false positives but may increase false negatives. The exam tests that you know the default is 0.5.
Azure Face Service does not store the original images. It only stores the mathematical face vectors (faceprints) and the metadata you provide (like person names). You have control over data retention and deletion. Microsoft also has responsible AI policies that limit certain uses, such as real-time surveillance in public spaces.
You've just covered Azure Face Service — now see how well it sticks with free AI-900 practice questions. Full explanations included, no account needed.
Done with this chapter?