Merge pull request #190127 from Blackmist/1920941-npip-image-builds

note on image builds & no public IP

Author: PRMerger7

articles/machine-learning/how-to-secure-training-vnet.md

@@ -9,7 +9,7 @@ ms.topic: how-to
 ms.reviewer: larryfr
 ms.author: jhirono
 author: jhirono
-ms.date: 01/06/2022
+ms.date: 03/01/2022
 ms.custom: contperf-fy20q4, tracking-python, contperf-fy21q1, references_regions, devx-track-azurecli 
 ms.devlang: azurecli
 
@@ -107,6 +107,8 @@ In this article you learn how to secure the following training compute resources
 
 * If you create a compute instance and plan to use the no public IP address configuration, your Azure Machine Learning workspace's managed identity must be assigned the __Reader__ role for the virtual network that contains the workspace. For more information on assigning roles, see [Steps to assign an Azure role](/azure/role-based-access-control/role-assignments-steps).
 
+* If you have configured Azure Container Registry for your workspace behind the virtual network, you must use a compute cluster to build Docker images. You can't use a compute cluster with the no public IP address configuration. For more information, see [Enable Azure Container Registry](how-to-secure-workspace-vnet.md#enable-azure-container-registry-acr).
+
 * If the Azure Storage Accounts for the workspace are also in the virtual network, use the following guidance on subnet limitations:
 
     * If you plan to use Azure Machine Learning __studio__ to visualize data or use designer, the storage account must be __in the same subnet as the compute instance or cluster__.

articles/machine-learning/how-to-secure-workspace-vnet.md

@@ -8,7 +8,7 @@ ms.subservice: enterprise-readiness
 ms.reviewer: larryfr
 ms.author: jhirono
 author: jhirono
-ms.date: 02/28/2022
+ms.date: 03/01/2022
 ms.topic: how-to
 ms.custom: contperf-fy20q4, tracking-python, contperf-fy21q1, security
 
@@ -248,7 +248,9 @@ Azure Container Registry can be configured to use a private endpoint. Use the fo
 1. Use one of the following methods to configure the workspace to build Docker images using the compute cluster.
 
     > [!IMPORTANT]
-    > When using a compute cluster for image builds, only a CPU SKU is supported.
+    > The following limitations apply When using a compute cluster for image builds:
+    > * Only a CPU SKU is supported.
+    > * You can't use a compute cluster configured for no public IP address.
 
     # [Azure CLI](#tab/cli)