Merge pull request #3296 from Blackmist/400007-iplist

initial writing

Author: prmerger-automator[bot]

articles/ai-foundry/how-to/configure-private-link.md

@@ -6,7 +6,7 @@ manager: scottpolly
 ms.service: azure-ai-foundry
 ms.custom: ignite-2023, devx-track-azurecli, build-2024, ignite-2024
 ms.topic: how-to
-ms.date: 01/15/2025
+ms.date: 04/30/2025
 ms.reviewer: meerakurup
 ms.author: larryfr
 author: Blackmist
@@ -252,8 +252,85 @@ az extension add --name ml
 
 :::zone-end
 
+## Enable Public Access only from internet IP ranges (preview)
+
+You can use IP network rules to allow access to your secured hub from specific public internet IP address ranges by creating IP network rules. Each Azure AI Foundry hub supports up to 200 rules. These rules grant access to specific internet-based services and on-premises networks and block general internet traffic. This feature is currently in preview.
+
+> [!WARNING]
+> * Enable your endpoint's public network access flag if you want to allow access to your endpoint from specific public internet IP address ranges.
+> * You can only use IPv4 addresses.
+> * If the workspace goes from __Enable from selected IPs__ to __Disabled__ or __Enabled__, the IP ranges will be reset.
+
+# [Portal](#tab/azure-portal)
+
+1. From the [Azure portal](https://portal.azure.com), select your Azure Machine AI Foundry hub.
+1. From the left side of the page, select __Networking__ and then select the __Public access__ tab.
+1. Select __Enabled from selected IP addresses__, input address ranges and then select __Save__.
+
+<!-- :::image type="content" source="./media/how-to-configure-private-link/workspace-public-access-ip-ranges.png" alt-text="Screenshot of the UI to enable access from internet IP ranges."::: -->
+
+# [Azure CLI](#tab/cli)
+
+Use the `az ml workspace update` Azure CLI command to manage public access from an IP address or address range:
+
+> [!TIP]
+> The configurations for the selected IP addresses are stored in the hub's properties, under `network_acls`:
+> ```yml
+> name: sample_hub
+> location: centraluseuap
+> display_name: sample hub
+> description: desc
+> public_network_access: enabled
+> network_acls:
+>     ip_rules:
+>         value: "X.X.X.X/X"
+>         value: "X.X.X.X"
+>     default_action: Deny
+> ```
+ 
+1. Disabled:
+`az ml workspace update -n test-ws -g test-rg --public-network-access Disabled`
+1. Enabled from selected IP addresses: 
+`az ml workspace update -n test-ws -g test-rg --public-network-access Enabled --network-acls "167.220.238.199/32,167.220.238.194/32" `
+1. Enabled from all networks: 
+`az ml workspace update -n test-ws -g test-rg --public-network-access Enabled --network-acls none`
+
 ---
 
+You can also use the [Workspace](/python/api/azure-ai-ml/azure.ai.ml.entities.workspace) class from the Azure Machine Learning [Python SDK](/python/api/azure-ai-ml/azure.ai.ml.entities.networkacls) to define which IP addresses are allowed inbound access:
+
+```python
+class Workspace(Resource):
+    """Azure ML workspace.
+    :param public_network_access: Whether to allow public endpoint connectivity
+        when a workspace is private link enabled.
+    :type public_network_access: str
+    :param network_acls: The network access control list (ACL) settings of the workspace.
+    :type network_acls: ~azure.ai.ml.entities.NetworkAcls
+ 
+    def __init__(
+        self,
+        *,
+        public_network_access: Optional[str] = None,
+        network_acls: Optional[NetworkAcls] = None,
+```
+
+### Restrictions for IP network rules
+
+The following restrictions apply to IP address ranges:
+
+- IP network rules are allowed only for _public internet_ IP addresses.
+
+  [Reserved IP address ranges](https://en.wikipedia.org/wiki/Reserved_IP_addresses) aren't allowed in IP rules such as private addresses that start with 10, 172.16 to 172.31, and 192.168.
+
+- You must provide allowed internet address ranges by using [CIDR notation](https://tools.ietf.org/html/rfc4632) in the form 16.17.18.0/24 or as individual IP addresses like 16.17.18.19.
+
+- Only IPv4 addresses are supported for configuration of storage firewall rules.
+
+- When this feature is enabled, you can test public endpoints using any client tool such as Curl, but the Endpoint Test tool in the portal isn't supported.
+
+- You can only set the IP addresses for the AI Foundry hub after the hub has been created.
+
 ## Private storage configuration
 
 If your storage account is private (uses a private endpoint to communicate with your project), you perform the following steps: