4.4 Restrict Network Access to Machine Learning Workspaces

Restrict Network Access to Machine Learning Workspaces

Quick Answer: Inbound = a private endpoint on your Azure Virtual Network plus public_network_access: Disabled. Outbound from managed compute = the workspace managed virtual network in mode allow_internet_outbound, allow_only_approved_outbound, or disabled. Set image_build_compute when ACR is private. Spark needs spark_enabled and az ml workspace provision-network --include-spark. Isolation mode changes are one-way.

The last Domain 1 IaC bullet is restrict network access to Machine Learning workspaces. Chapter 2 introduced workspaces; this section is the network envelope around them. Microsoft’s 2026 managed-network article is the source of truth for SDK/CLI v2.

Two directions, two networks

People fail exam items by mixing inbound and outbound.

• Inbound (who can call the workspace, Studio, and scoring URLs): an Azure Virtual Network you create. You add a private endpoint (group-id amlworkspace) and private DNS (privatelink.api.azureml.ms, privatelink.notebooks.azure.net). Set workspace public_network_access to Disabled so the public IP is not a back door. Microsoft also documents Enabled from selected IPs as a middle setting — still not a substitute for a private endpoint in a regulated landing zone.
• Outbound (where compute instances, clusters, serverless compute, and managed online endpoints may send packets): the managed virtual network Azure Machine Learning creates for the workspace. You do not peer it like a customer VNet you fully own; you pick an isolation mode and outbound rules.

You can still use only a customer VNet (legacy “secure the workspace with your own VNet” article). Microsoft now recommends managed network isolation for outbound because it auto-secures managed computes.

Use managedNetworkKind v1. Microsoft says do not use v2, which is preview.

Isolation modes

CLI:

az ml workspace create -n ws -g rg --managed-network allow_internet_outbound --provision-network-now
# or
az ml workspace create -f workspace.yml -g rg

YAML:

managed_network:
  isolation_mode: allow_only_approved_outbound
  outbound_rules:
    - name: storage-pe
      type: private_endpoint
      destination:
        service_resource_id: /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<sa>
        subresource_target: blob
        spark_enabled: true
    - name: pypi
      type: fqdn
      destination: pypi.org

Service tag and FQDN rules are valid only in allow_only_approved_outbound. FQDN rules are implemented with Azure Firewall (Standard pricing). The first FQDN rule adds about 10 minutes to provisioning. Extra FQDN rules can increase exfiltration risk; Microsoft does not guarantee exfiltration protection once you add them.

Default private endpoint rules are created automatically:

• In allow internet outbound, for workspace, storage, Key Vault, and ACR when those resources have public network access disabled.
• In allow only approved outbound, for those resources regardless of their public network access setting.

Register Microsoft.Network. The deploying identity needs Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read and write.

Irreversible choices (memorize):

1. allow_internet_outbound → cannot go to disabled. The Python SDK v2 Spark notes also state you cannot later update that workspace to allow_only_approved_outbound.
2. allow_only_approved_outbound → cannot go to allow_internet_outbound.
3. Either managed mode → cannot disable managed virtual network isolation later.
4. Before updating an existing workspace onto a managed VNet, delete compute instances, compute clusters, and managed online endpoints.

Private endpoints on dependents, Studio, and image build

When storage, Key Vault, or ACR disable public access, also allow trusted Microsoft services (or resource-instance exceptions) as documented for each service, or the control plane cannot reach them.

Azure Machine Learning studio runs part of the dataset/notebook experience in the browser, talking directly to default storage. Clients therefore need a private endpoint or service endpoint to that storage in the client VNet. If storage public access is disabled, grant the Reader role on the client storage private endpoint to the workspace managed identity (blob and file). That is separate from the managed-VNet’s own private endpoints.

You cannot use a private endpoint and a service endpoint at the same time on the same storage account. Microsoft recommends private endpoints.

Image builds: if ACR is behind a virtual network, ACR Tasks cannot build. Set image_build_compute to a compute cluster or compute instance that can reach your package repositories:

az ml workspace update -n ws -g rg --image-build-compute cpu-build

In approved-outbound mode you may need extra FQDN or private-package rules so the build compute can pip/conda. Do not invent GPU SKU names for that cluster; pick a documented Standard_* size that exists in the region (Chapter 2).

CLI v2 from a locked-down laptop still sends YAML metadata to public ARM unless you build an ARM private link. Data in a VNet datastore is not copied onto the public internet by that control-plane call.

Provisioning time, Spark, and identity to approve connections

Managed VNet creation is deferred until the first compute or until you provision explicitly. The first compute can take about 30 minutes because it is also creating the network; a large outbound-rule set can time out. Prefer:

az ml workspace provision-network -g rg -n ws
# Spark:
az ml workspace provision-network -g rg -n ws --include-spark

or --provision-network-now / provision_network_now: true at create. Managed online endpoint deploys require the managed network to exist first (provision or create a compute instance).

If public network access is still enabled when you provision, workspace private endpoints inside the managed VNet may not auto-create — disable public access first.

Serverless Spark jobs need all of: managed VNet configured, a storage private endpoint outbound rule with spark_enabled: true, and provision-network --include-spark. Portal can tick Spark on a rule at create; existing workspaces use CLI/SDK. Under allow only approved outbound, conda packages in the Spark session fail to install; Microsoft’s workaround is a self-contained wheel on storage via private endpoint (py_files), not an FQDN rule (Spark does not propagate FQDN rules).

After 30 April 2025, the workspace managed identity is not auto-granted rights to approve private endpoint connections. Assign Azure AI Enterprise Network Connection Approver (covers storage, Key Vault, ACR, Azure Machine Learning, Foundry, and the other listed PaaS types) or a custom role. Creating PEs to types not on that list (Data Factory, Databricks, Function Apps) needs extra actions.

Associated resources in a VNet: Key Vault, Storage, ACR as in the managed-network table; Application Insights still does not sit in the VNet (section 4.2).

Exam scenario

A bank requires no public workspace endpoint and no uncontrolled internet from training nodes. An engineer sets --managed-network allow_internet_outbound, leaves public_network_access enabled, and wonders why Studio cannot list blobs. They then try to “tighten” the same workspace to allow_only_approved_outbound without deleting computes. The MLOps design is: create with allow_only_approved_outbound, public_network_access: Disabled, private endpoints on workspace/storage/KV/Premium ACR, client PE to storage for Studio, image_build_compute: cpu-build, --provision-network-now, and Azure AI Enterprise Network Connection Approver on the workspace identity. Spark gets a spark_enabled blob PE and --include-spark before the first Spark job.

Common trap

Do not say you will “switch prod from allow only approved outbound back to allow internet outbound for the weekend.” You cannot. Do not skip image_build_compute when ACR is private — environment builds fail. Do not assume Spark works because the managed VNet exists; without spark_enabled and --include-spark it does not. Do not invent unpublished SKU names for firewall or compute. Do not use managedNetworkKind v2 as the GA answer.