Merge pull request #266178 from Blackmist/212475-ip-vnet

212475 ip vnet

Author: prmerger-automator[bot]

articles/machine-learning/how-to-configure-private-link.md

@@ -305,6 +305,7 @@ You can use IP network rules to allow access to your workspace and endpoint from
 > [!WARNING]
 > * Enable your endpoint's [public network access flag](concept-secure-online-endpoint.md#secure-inbound-scoring-requests) if you want to allow access to your endpoint from specific public internet IP address ranges.
 > * When you enable this feature, this has an impact to all existing public endpoints associated with your workspace. This may limit access to new or existing endpoints. If you access any endpoints from a non-allowed IP, you get a 403 error.
+> * To use this feature with Azure Machine Learning managed virtual network, see [Azure Machine Learning managed virtual network](how-to-managed-network.md#scenario-enable-access-from-selected-ip-addresses).
 
 # [Azure CLI](#tab/cli)
 [!INCLUDE [cli v2](includes/machine-learning-cli-v2.md)]

articles/machine-learning/how-to-managed-network.md

@@ -1032,6 +1032,18 @@ If you plan to use __HuggingFace models__ with Azure Machine Learning, add outbo
 * `cdn.auth0.com`
 * `cdn-lfs.huggingface.co`
 
+### Scenario: Enable access from selected IP Addresses
+
+If you want to enable access from specific IP addresses, use the following actions:
+
+1. Add an outbound _private endpoint_ rule to allow traffic to the Azure Machine Learning workspace. This allows compute instances created in the managed virtual network to access the workspace.
+
+    > [!TIP]
+    > You can't add this rule during workspace creation, as the workspace doesn't exist yet.
+
+1. Enable public network access to the workspace. For more information, see [public network access enabled](how-to-configure-private-link.md#enable-public-access).
+1. Add your IP addresses to the firewall for Azure Machine Learning. For more information, see [enable access only from IP ranges](how-to-configure-private-link.md#enable-public-access-only-from-internet-ip-ranges-preview).
+
 ## Private endpoints
 
 Private endpoints are currently supported for the following Azure services: