Skip to content

Commit 6ef5195

Browse files
jonburcheljonburchel
committed
Refreshes disable-local-auth.md
1 parent ca32ffb commit 6ef5195

File tree

1 file changed

+43
-41
lines changed

1 file changed

+43
-41
lines changed

‎articles/ai-foundry/how-to/disable-local-auth.md‎

Lines changed: 43 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.service: azure-ai-foundry
88
ms.custom:
99
- ignite-2024
1010
ms.topic: how-to
11-
ms.date: 07/14/2025
11+
ms.date: 10/01/2025
1212
ms.reviewer: meerakurup
1313
#customer intent: As an admin, I want to disable shared-key access to my resources to improve security.
1414
---
@@ -18,9 +18,9 @@ ms.reviewer: meerakurup
1818
> [!NOTE]
1919
> The information provided in this article is specific to a [!INCLUDE [hub](../includes/hub-project-name.md)] and doesn't apply to an [!INCLUDE [fdp](../includes/fdp-project-name.md)]. For more information, see [Types of projects](../what-is-azure-ai-foundry.md#project-types).
2020
21-
An [Azure AI Foundry](https://ai.azure.com/?cid=learnDocs) hub defaults to use of a shared key to access its default Azure Storage account. With key-based authorization, anyone who has the key and access to the storage account can access data.
21+
An [Azure AI Foundry](https://ai.azure.com/?cid=learnDocs) hub defaults to using a shared key to access its default Azure Storage account. With key-based authorization, anyone who has the key and access to the storage account can access data.
2222

23-
To reduce the risk of unauthorized access, you can disable key-based authorization and instead use Microsoft Entra ID for authorization. This configuration uses a Microsoft Entra ID value to authorize access to the storage account. The identity used to access storage is either the user's identity or a managed identity. The user's identity is used to view data in Azure Machine Learning studio or to run a notebook while authenticated with the user's identity. Machine Learning uses a managed identity to access the storage account. An example is when the managed identity runs a training job.
23+
To reduce the risk of unauthorized access, disable key-based authorization and instead use Microsoft Entra ID for authorization. This configuration uses a Microsoft Entra ID value to authorize access to the storage account. The identity used to access storage is either the user's identity or a managed identity. The user's identity is used to view data in Azure Machine Learning studio or to run a notebook while authenticated with the user's identity. Machine Learning uses a managed identity to access the storage account - for example, when the managed identity runs a training job.
2424

2525
Use of your hub with a shared-key disabled storage account is currently in preview.
2626

@@ -95,25 +95,27 @@ If you use [Azure Cloud Shell](https://azure.microsoft.com//features/cloud-shell
9595

9696
When you create a new hub, the creation process can automatically disable shared-key access. You can also create a storage account, disable shared-key access, and use it during hub creation.
9797

98+
This section shows you how to create a hub with identity-based access to the storage account.
99+
98100
# [Azure portal](#tab/portal)
99101

100-
1. In the Azure portal, search for `Azure AI Foundry`. On the left menu, select **AI Hubs**, and then select **+ Create** > **Hub**.
102+
1. In the Azure portal, search for `Azure AI Foundry`. On the left menu, select **AI Hubs**, and select **+ Create** > **Hub**.
101103

102104
:::image type="content" source="../media/how-to/hubs/create-hub.png" alt-text="Screenshot that shows the Azure AI Foundry portal." lightbox="../media/how-to/hubs/create-hub.png":::
103105

104-
1. On the __Basics__ tab, enter the hub details, and then select the __Storage__ tab. Select the storage account that you previously created.
106+
1. On the **Basics** tab, enter the hub details, and select the **Storage** tab. Select the storage account that you previously created.
105107

106108
:::image type="content" source="../media/disable-local-auth/ai-hub-storage.png" alt-text="Screenshot that shows hub creation by using the previously created storage account." lightbox="../media/disable-local-auth/ai-hub-storage.png":::
107109

108-
1. On the __Identity__ tab, set __Storage account access__ to __Identity-based access__. Then enable __Disable shared key access__.
110+
1. On the **Identity** tab, set **Storage account access** to **Identity-based access**. Enable **Disable shared key access**.
109111

110112
:::image type="content" source="../media/disable-local-auth/ai-hub-identity-based-access.png" alt-text="Screenshot that shows hub creation by using Identity-based storage access." lightbox="../media/disable-local-auth/ai-hub-identity-based-access.png":::
111113

112114
1. Continue the hub creation process. As the hub is created, the managed identity is automatically assigned the permissions it needs to access the storage account.
113115

114116
# [Python SDK](#tab/python)
115117

116-
When you create your hub with the SDK, set `system_datastores_auth_mode="identity"` for the hub. To use a preexisting storage account, use the `storage_account` parameter to specify the Resource Manager ID of an existing storage account:
118+
When you create your hub with the SDK, set `system_datastores_auth_mode="identity"` for the hub. To use a pre-existing storage account, use the `storage_account` parameter to specify the Resource Manager ID of an existing storage account:
117119

118120
```python
119121
# Creating a unique hub name with current datetime to avoid conflicts
@@ -131,7 +133,7 @@ ws_hub = Hub(
131133
description="This example shows how to create a Hub",
132134
hbi_workspace=False,
133135
tags=dict(purpose="demo"),
134-
storage_account= {existing_storage_account with AllowSharedKeyAccess=false},
136+
storage_account="{existing_storage_account with AllowSharedKeyAccess=false}",
135137
system_datastores_auth_mode="identity",
136138
)
137139

@@ -141,7 +143,7 @@ print(created_hub)
141143

142144
# [Azure CLI](#tab/cli)
143145

144-
To create a new hub with Microsoft Entra ID authorization for the storage account, use a YAML configuration file that sets `system_datastores_auth_mode` to `identity`. You can also specify the Resource Manager ID value of an existing storage account with the `storage_account` entry.
146+
To create a new hub with Microsoft Entra ID authorization for the storage account, use a YAML configuration file that sets `system_datastores_auth_mode` to `identity`. You can also specify the Resource Manager ID of an existing storage account with the `storage_account` entry.
145147

146148
This example YAML file shows how to set the hub to use a managed identity and an existing storage account:
147149

@@ -151,13 +153,13 @@ name: mlw-basicex-prod
151153
location: eastus
152154
display_name: Bring your own dependent resources-example
153155
description: This configuration specifies a workspace configuration with existing dependent resources
154-
storage_account: {your storage account resource id}
156+
storage_account: <your-storage-account-resource-id>
155157
system_datastores_auth_mode: identity
156158
tags:
157159
purpose: demonstration
158160
```
159161

160-
You can use this YAML file with the `az ml workspace create` command, with the `--file` parameter:
162+
You can use this YAML file with the `az ml workspace create` command and the `--file` parameter:
161163

162164
```azurecli-interactive
163165
az ml workspace create -g <resource-group-name> --kind hub --file workspace.yml
@@ -167,10 +169,10 @@ az ml workspace create -g <resource-group-name> --kind hub --file workspace.yml
167169

168170
In the JSON template example, substitute your own values for the following placeholders:
169171

170-
- *[workspace name]*
171-
- *[workspace friendly name]*
172-
- *[Storage Account ARM resource ID]*
173-
- *[Key Vault ARM resource ID]*
172+
- `<workspace-name>`
173+
- `<workspace-friendly-name>`
174+
- `<storage-account-arm-resource-id>`
175+
- `<key-vault-arm-resource-id>`
174176

175177
```json
176178
{
@@ -181,7 +183,7 @@ In the JSON template example, substitute your own values for the following place
181183
{
182184
"type": "Microsoft.MachineLearningServices/workspaces",
183185
"apiVersion": "2024-04-01",
184-
"name": "[workspace name]",
186+
"name": "<workspace-name>",
185187
"location": "[resourceGroup().location]",
186188
"sku":
187189
{
@@ -195,9 +197,9 @@ In the JSON template example, substitute your own values for the following place
195197
},
196198
"properties":
197199
{
198-
"friendlyName": "[workspace friendly name]",
199-
"storageAccount": "[Storage Account ARM resource ID]",
200-
"keyVault": "[Key Vault ARM resource ID]",
200+
"friendlyName": "<workspace-friendly-name>",
201+
"storageAccount": "<storage-account-arm-resource-id>",
202+
"keyVault": "<key-vault-arm-resource-id>",
201203
"systemDatastoresAuthMode": "identity",
202204
"managedNetwork":
203205
{
@@ -210,29 +212,29 @@ In the JSON template example, substitute your own values for the following place
210212
}
211213
```
212214

213-
For information on how to deploy an Azure Resource Manager template (ARM template), see the following articles:
215+
For information about how to deploy an Azure Resource Manager template (ARM template), see the following articles:
214216

215217
- [Tutorial: Deploy a local ARM template by using the Azure CLI or Azure PowerShell](/azure/azure-resource-manager/templates/deployment-tutorial-local-template)
216218
- [Quickstart: Create and deploy ARM templates by using the Azure portal](/azure/azure-resource-manager/templates/quickstart-create-templates-use-the-portal)
217219

218-
After you create the hub, identify all the users who will use it, such as data scientists. The users must be assigned the Storage Blob Data Contributor and Storage File Data Privileged Contributor roles in Azure role-based access control (RBAC) for the storage account. If the users need only read access, use the Storage Blob Data Reader and Storage File Data Privileged Reader roles instead. For more information, see the [Role assignments](#scenarios-for-hub-storage-account-role-assignments) section.
220+
After you create the hub, identify all the users who'll use it, such as data scientists. The users must be assigned the Storage Blob Data Contributor and Storage File Data Privileged Contributor roles in Azure role-based access control (RBAC) for the storage account. If the users need only read access, use the Storage Blob Data Reader and Storage File Data Privileged Reader roles instead. For more information, see [Role assignments](#scenarios-for-hub-storage-account-role-assignments).
219221

220222
---
221223

222224
## Update an existing hub
223225

224-
If you have an existing Azure AI Foundry hub, use the steps in this section to update the hub to use Microsoft Entra ID to authorize access to the storage account. Then, disable shared-key access on the storage account.
226+
If you have an existing Azure AI Foundry hub, use the steps in this section to update the hub to use Microsoft Entra ID to authorize access to the storage account. Then disable shared-key access on the storage account.
225227

226228
# [Azure portal](#tab/portal)
227229

228-
1. Go to the Azure portal and select __Azure AI Foundry hub__.
229-
1. On the left menu, select __Properties__. At the bottom of the pane, set __Storage account access__ to __Identity-based access__. Select __Save__ at the top of the pane to save the configuration.
230+
1. Go to the Azure portal and select **Azure AI Foundry hub**.
231+
1. On the left menu, select **Properties**. At the bottom of the pane, set **Storage account access** to **Identity-based access**. Select **Save** at the top of the pane to save the configuration.
230232

231233
:::image type="content" source="../media/disable-local-auth/update-existing-hub-identity-based-access.png" alt-text="Screenshot that shows selection of Identity-based access." lightbox="../media/disable-local-auth/update-existing-hub-identity-based-access.png":::
232234

233235
# [Python SDK](#tab/python)
234236

235-
To update an existing hub, set `system_datastores_auth_mode = "identity"` for the hub. This code sample shows an update of a hub named `test-ws1`:
237+
To update an existing hub, set `system_datastores_auth_mode = "identity"` for the hub. The following code sample shows an update of a hub named `test-ws1`:
236238

237239
```python
238240
ml_client = MLClient(DefaultAzureCredential(), subscription_id, resource_group)
@@ -243,7 +245,7 @@ ws = ml_client.workspaces.begin_update(workspace=ws).result()
243245

244246
# [Azure CLI](#tab/cli)
245247

246-
To update an existing hub, use the `az ml workspace update` command and specify `--system-datastores-auth-mode identity`. This example shows an update of a hub named `myhub`:
248+
To update an existing hub, use the `az ml workspace update` command and specify `--system-datastores-auth-mode identity`. The following example shows an update of a hub named `myhub`:
247249

248250
```azurecli-interactive
249251
az ml workspace update --name myhub --system-datastores-auth-mode identity
@@ -296,7 +298,7 @@ In the JSON template example, substitute your own values for the following place
296298
}
297299
```
298300

299-
For information on how to deploy an ARM template, see the following articles:
301+
For information about how to deploy an ARM template, see the following articles:
300302

301303
- [Tutorial: Deploy a local ARM template by using the Azure CLI or Azure PowerShell](/azure/azure-resource-manager/templates/deployment-tutorial-local-template)
302304
- [Quickstart: Create and deploy ARM templates by using the Azure portal](/azure/azure-resource-manager/templates/quickstart-create-templates-use-the-portal)
@@ -305,25 +307,25 @@ For information on how to deploy an ARM template, see the following articles:
305307

306308
### Assign roles to users
307309

308-
After you update the hub, update the storage account to disable shared-key access. For more information about how to disable shared-key access, see [Prevent shared-key authorization for an Azure Storage account](/azure/storage/common/shared-key-authorization-prevent).
310+
After you update the hub, update the storage account to disable shared-key access. For more information, see [Prevent shared-key authorization for an Azure Storage account](/azure/storage/common/shared-key-authorization-prevent).
309311

310312
You must also identify all the users who need access to the default datastores, such as data scientists. The users must be assigned the Storage Blob Data Contributor and Storage File Data Privileged Contributor roles in Azure RBAC for the storage account. If the users need only read access, use the Storage Blob Data Reader and Storage File Data Privileged Reader roles instead. For more information, see the [Role assignments](#scenarios-for-hub-storage-account-role-assignments) section.
311313

312-
## Revert to use shared keys
314+
## Revert to using shared keys
313315

314-
To revert a hub back to use of shared keys to access the storage account, use the following information.
316+
To revert a hub back to using shared keys to access the storage account, use the following information.
315317

316318
# [Azure portal](#tab/portal)
317319

318-
1. To update an existing workspace, go to **Properties** and select **Credential-based access**.
320+
1. Go to **Properties** and select **Credential-based access**.
319321

320322
:::image type="content" source="../media/disable-local-auth/update-existing-hub-credential-based-access.png" alt-text="Screenshot that shows selection of Credential-based access." lightbox="../media/disable-local-auth/update-existing-hub-credential-based-access.png":::
321323

322-
1. Select **Save** to save this choice.
324+
1. Select **Save**.
323325

324326
# [Python SDK](#tab/python)
325327

326-
To configure the hub to use a shared key again, set `system_datastores_auth_mode = "accesskey"` for the hub. This code demonstrates an update of a hub named `test-ws1`:
328+
To configure the hub to use a shared key again, set `system_datastores_auth_mode = "accesskey"` for the hub. This code updates a hub named `test-ws1`:
327329

328330
```python
329331
ml_client = MLClient(DefaultAzureCredential(), subscription_id, resource_group)
@@ -334,7 +336,7 @@ ws = ml_client.workspaces.begin_update(workspace=ws).result()
334336

335337
# [Azure CLI](#tab/cli)
336338

337-
To configure the hub to once again use a shared key, use the `az ml workspace update` command and specify `--system-datastores-auth-mode accesskey`. This example demonstrates an update of a hub named `myhub`:
339+
To configure the hub to use a shared key again, use the `az ml workspace update` command and specify `--system-datastores-auth-mode accesskey`. This example updates a hub named `myhub`:
338340

339341
```azurecli-interactive
340342
az ml workspace update --name myhub --system-datastores-auth-mode accesskey
@@ -391,24 +393,24 @@ In the JSON template example, substitute your own values for the following place
391393

392394
For information on how to deploy an ARM template, see the following articles:
393395

394-
- [Tutorial: Deploy a local ARM template using Azure CLI or Azure PowerShell](/azure/azure-resource-manager/templates/deployment-tutorial-local-template)
395-
- [Quickstart: Create and deploy ARM templates by using the Azure portal](/azure/azure-resource-manager/templates/quickstart-create-templates-use-the-portal)
396+
- [Tutorial: Deploy a local ARM template using Azure CLI or Azure PowerShell](/azure/azure-resource-manager/templates/deployment-tutorial-local-template).
397+
- [Quickstart: Create and deploy ARM templates by using the Azure portal](/azure/azure-resource-manager/templates/quickstart-create-templates-use-the-portal).
396398

397399
After you create the hub, identify all the users who will use it, such as data scientists. The users must be assigned the Storage Blob Data Contributor and Storage File Data Privileged Contributor roles in Azure RBAC for the storage account. If the users need only read access, use the Storage Blob Data Reader and Storage File Data Privileged Reader roles instead. For more information, see the [Role assignments](#scenarios-for-hub-storage-account-role-assignments) section.
398400

399401
---
400402

401-
After you revert the hub, update the storage account to enable shared-key access. For more information, see [Prevent shared-key authorization for an Azure Storage account](/azure/storage/common/shared-key-authorization-prevent).
403+
After you revert the hub, update the storage account to enable shared key access. For more information, see [Prevent shared-key authorization for an Azure Storage account](/azure/storage/common/shared-key-authorization-prevent).
402404

403405
## Scenarios for hub storage account role assignments
404406

405-
To work with a storage account with disabled shared-key access, you might need to grant more roles to either your users or the managed identity for your hub. Hubs have a system-assigned managed identity by default. Some scenarios require a user-assigned managed identity. This table summarizes the scenarios that require extra role assignments.
407+
To work with a storage account with disabled shared-key access, you need to grant more roles to either your users or the managed identity for your hub. Hubs have a system-assigned managed identity by default. Some scenarios require a user-assigned managed identity. This table summarizes the scenarios that require extra role assignments.
406408

407409
| Scenario | Microsoft Entra ID | Required roles | Notes |
408410
| ----- | ----- | ----- | ----- |
409-
| Azure AI Speech | Storage Blob Data Contributor </br>Storage File Data Privileged Contributor | |
410-
| Models as a service | System-assigned managed identity | Storage Blob Data Contributor | The hub's managed identity. </br>Automatically assigned the role when provisioned. </br>Don't manually change this role assignment. |
411-
| Azure AI Search | System-assigned managed identity | Storage Blob Data Contributor | The hub's managed identity. </br>Automatically assigned the role when provisioned. </br>Don't manually change this role assignment. |
411+
| Azure AI Speech | User's identity | Storage Blob Data Contributor </br>Storage File Data Privileged Contributor | |
412+
| Models as a service | System-assigned managed identity | Storage Blob Data Contributor | The hub's managed identity. </br>Automatically assigned the role when you provision the hub. </br>Don't manually change this role assignment. |
413+
| Azure AI Search | System-assigned managed identity | Storage Blob Data Contributor | The hub's managed identity. </br>Automatically assigned the role when you provision the hub. </br>Don't manually change this role assignment. |
412414
| Fine-tuning of open-source software models | User-assigned managed identity | Storage Blob Data Contributor | |
413415
| Prompt flow | User's identity | Storage Blob Data Contributor </br>Storage File Data Privileged Contributor | |
414416
| Add and manage your own data | User's identity | Storage Blob Data Contributor | |

0 commit comments

Comments
 (0)