You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/ai-foundry/concepts/rbac-azure-ai-foundry.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.custom:
9
9
- build-2024
10
10
- ignite-2024
11
11
ms.topic: conceptual
12
-
ms.date: 03/04/2025
12
+
ms.date: 06/04/2025
13
13
ms.reviewer: deeikele
14
14
ms.author: larryfr
15
15
author: Blackmist
@@ -222,10 +222,10 @@ For example, if you're trying to consume a new Blob storage, you need to ensure
222
222
223
223
If you're an owner of a Foundry account resource, you can add and remove roles for Azure AI Foundry. From the **Home** page in [Azure AI Foundry](https://ai.azure.com/?cid=learnDocs), select your Foundry resource. Then select **Users** to add and remove users for the hub. You can also manage permissions from the [Azure portal](https://portal.azure.com) under **Access Control (IAM)** or through the Azure CLI.
224
224
225
-
For example, use the Azure CLI to assign the Azure AI User role to `[email protected]` for resource group `this-rg`with the following command:
225
+
For example, the following command assigns Azure AI User role to `[email protected]` for resource group `this-rg`in the subscription with an ID of `00000000-0000-0000-0000-000000000000`:
226
226
227
227
```azurecli
228
-
az role assignment create --role "Azure AI User" --assignee "[email protected]" --resource-group this-rg
228
+
az role assignment create --role "Azure AI User" --assignee "[email protected]" --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/this-rg
229
229
```
230
230
231
231
## Create custom roles
@@ -461,10 +461,10 @@ For example, if you're trying to consume a new Blob storage, you need to ensure
461
461
462
462
## Manage access with roles
463
463
464
-
If you're an owner of a hub, you can add and remove roles for Azure AI Foundry. Go to the **Home** page in [Azure AI Foundry](https://ai.azure.com/?cid=learnDocs) and select your hub. Then select **Users** to add and remove users for the hub. You can also manage permissions from the Azure portal under **Access Control (IAM)** or through the Azure CLI. For example, use the [Azure CLI](/cli/azure/) to assign the Azure AI Developer role to "[email protected]" for resource group "this-rg" with the following command:
464
+
If you're an owner of a hub, you can add and remove roles for Azure AI Foundry. Go to the **Home** page in [Azure AI Foundry](https://ai.azure.com/?cid=learnDocs) and select your hub. Then select **Users** to add and remove users for the hub. You can also manage permissions from the Azure portal under **Access Control (IAM)** or through the Azure CLI. For example, to assign the Azure AI Developer role to "[email protected]" for resource group "this-rg" in the subscription with an ID of `00000000-0000-0000-0000-000000000000`, you can use the following Azure CLI command:
465
465
466
466
```azurecli-interactive
467
-
az role assignment create --role "Azure AI Developer" --assignee "[email protected]" --resource-group this-rg
467
+
az role assignment create --role "Azure AI Developer" --assignee "[email protected]" --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/this-rg
Copy file name to clipboardExpand all lines: articles/machine-learning/concept-customer-managed-keys.md
+3-4Lines changed: 3 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -54,13 +54,12 @@ When you use a customer-managed key, there are two possible configurations:
54
54
55
55
## Service-side encryption of metadata
56
56
57
-
A new architecture for the customer-managed key encryption workspace is available in preview, reducing cost compared to the current architecture and mitigating likelihood of Azure policy conflicts. In this configuration, encrypted data is stored service-side on Microsoft-managed resources instead of in your subscription.
57
+
In this configuration, encrypted data is stored service-side on Microsoft-managed resources instead of in your subscription. Using service-side encryption reduces costs compared to the subscription-side encryption, and mitigates the likelihood of Azure policy conflicts.
58
58
59
-
Data that previously was stored in Azure Cosmos DB in your subscription, is stored in multitenant Microsoft-managed resources with document-level encryption using your encryption key. Search indices that were previously stored in Azure AI Search in your subscription, are stored on Microsoft-managed resources that are provisioned dedicated for you per workspace. The cost of the Azure AI search instance is charged under your Azure Machine Learning workspace in Microsoft Cost Management.
59
+
Data is stored in multitenant Microsoft-managed resources with document-level encryption using your encryption key. Search indices are stored on Microsoft-managed resources that are provisioned dedicated for you per workspace. The cost of the Azure AI search instance is charged under your Azure Machine Learning workspace in Microsoft Cost Management.
60
60
61
-
Pipelines metadata that previously was stored in a storage account in a managed resource group, is now stored on the storage account in your subscription that is associated to the Azure Machine Learning workspace. Since this Azure Storage resource is managed separately in your subscription, you're responsible to configure encryption settings on it.
61
+
Pipelines metadata is stored on the storage account in your subscription that is associated to the Azure Machine Learning workspace. Since this Azure Storage resource is managed separately in your subscription, you're responsible to configure encryption settings on it.
62
62
63
-
To opt in for this preview, set the `enableServiceSideCMKEncryption` on a REST API or in your Bicep or Resource Manager template. You can also use Azure portal.
64
63
65
64
:::image type="content" source="./media/concept-customer-managed-keys/cmk-service-side-encryption.png" alt-text="Screenshot of the encryption tab with the option for server side encryption selected." lightbox="./media/concept-customer-managed-keys/cmk-service-side-encryption.png":::
1. Select **Encrypt data using a ustomer-managed key**, and then select **Click to select key**. This configuration creates Azure resources used to encrypt data in your Azure subscription. Alternatively, select **Use service-side encryption (preview)** to use service-side resources for encryption. For more information, see [Customer-managed keys](concept-customer-managed-keys.md).
241
+
1. Select **Encrypt data using a ustomer-managed key**, and then select **Click to select key**. This configuration creates Azure resources used to encrypt data in your Azure subscription. Alternatively, select **Use service-side encryption** to use service-side resources for encryption. For more information, see [Customer-managed keys](concept-customer-managed-keys.md).
242
242
243
243
:::image type="content"source="media/how-to-manage-workspace/advanced-workspace.png" alt-text="Screenshot of the customer-managed keys.":::
> Small VM SKUs such as `Standard_DS1_v2` and `Standard_F2s_v2` may be too small for bigger models and may lead to container termination due to insufficient memory, not enough space on the disk, or probe failure as it takes too long to initiate the container. If you face [OutOfQuota errors](how-to-troubleshoot-online-endpoints.md?tabs=cli#error-outofquota) or [ResourceNotReady errors](how-to-troubleshoot-online-endpoints.md?tabs=cli#error-resourcenotready), try bigger VM SKUs. If you want to reduce the cost of deploying multiple models with managed online endpoint, see [Deployment for several local models](concept-online-deployment-model-specification.md#deployment-for-several-local-models).
0 commit comments