Merge pull request #1424 from meerakurup/patch-3

Update how-to-troubleshoot-managed-network.md

Author: prmerger-automator[bot]

articles/machine-learning/how-to-troubleshoot-managed-network.md

@@ -19,7 +19,7 @@ This article provides information on troubleshooting common issues with Azure Ma
 
 ## Can I still use an Azure Virtual Network?
 
-Yes, you can still use an Azure Virtual Network for network isolation. If you're using the v2 __Azure CLI__ and __Python SDK__, the process is the same as before the introduction of the managed virtual network feature. The process through the Azure portal has changed slightly.
+Yes, you can still use an Azure Virtual Network for network isolation. If you're using the v2 __Azure CLI__ and __Python SDK__, the process is the same as before the introduction of the managed virtual network feature. The process through the Azure portal changed slightly.
 
 To use an Azure Virtual Network when creating a workspace through the Azure portal, use the following steps:
 
@@ -33,13 +33,22 @@ To use an Azure Virtual Network when creating a workspace through the Azure port
 
 When you create a managed virtual network, the operation can fail with an error similar to the following text:
 
-"The client '\<GUID\>' with object id '\<GUID\>' does not have authorization to perform action 'Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read' over scope '/subscriptions/\<GUID\>/resourceGroups/\<resource-group-name\>/providers/Microsoft.MachineLearningServices/workspaces/\<workspace-name\>' or the scope is invalid."
+"The client '\<GUID\>' with object id '\<GUID\>' doesn't have authorization to perform action 'Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read' over scope '/subscriptions/\<GUID\>/resourceGroups/\<resource-group-name\>/providers/Microsoft.MachineLearningServices/workspaces/\<workspace-name\>' or the scope is invalid."
 
 This error occurs when the Azure identity used to create the managed virtual network doesn't have the following Azure role-based access control permissions:
 
 * Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read
 * Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write
 
+## Troubleshoot configurations on connecting to storage
+
+When you create a workspace, required outbound rules to Azure storage are autocreated for data upload scenarios and artifact storage. Ensure your Azure storage is set up correct by checked with the following steps:
+
+1. In Azure portal, check the network settings of the storage account that is associated to your hub.
+  * If public network access is set to __Enabled from selected virtual networks and IP addresses__, ensure the correct IP address ranges are added to access your storage account.
+  * If public network access is set to __Disabled__, ensure you have a private endpoint configured from your Azure virtual network to your storage account with Target subresource as blob. In addition, you must grant the [Reader](/azure/role-based-access-control/built-in-roles#reader) role for the storage account private endpoint to the managed identity.
+2. In Azure portal, navigate to your Azure Machine Learning workspace. Ensure the managed virtual network is provisioned and the outbound private endpoint to blob storage is Active.
+
 ## Next steps
 
 For more information, see [Managed virtual networks](how-to-managed-network.md).