Skip to content

Commit 5c38151

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #216615 from santiagxf/santiagxf/aml-batch-auth
Update how-to-authenticate-batch-endpoint.md
2 parents b79914f + efe70a7 commit 5c38151

File tree

1 file changed

+124
-66
lines changed

1 file changed

+124
-66
lines changed

‎articles/machine-learning/batch-inference/how-to-authenticate-batch-endpoint.md

Lines changed: 124 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Batch endpoints support Azure Active Directory authentication, or `aad_token`. T
2323

2424
## How authentication works
2525

26-
To invoke a batch endpoint, the user must present a valid Azure Active Directory token representing a security principal. This principal can be a user principal or a service principal. In any case, once an endpoint is invoked, a batch deployment job is created under the identity associated with the token. The identity needs the following permissions in order to successfully create a job:
26+
To invoke a batch endpoint, the user must present a valid Azure Active Directory token representing a security principal. This principal can be a __user principal__ or a __service principal__. In any case, once an endpoint is invoked, a batch deployment job is created under the identity associated with the token. The identity needs the following permissions in order to successfully create a job:
2727

2828
> [!div class="checklist"]
2929
> * Read batch endpoints/deployments.
@@ -41,99 +41,149 @@ You can either use one of the [built-in security roles](../../role-based-access-
4141

4242
The following examples show different ways to start batch deployment jobs using different types of credentials:
4343

44+
> [!IMPORTANT]
45+
> When working on a private link-enabled workspaces, batch endpoints can't be invoked from the UI in Azure ML studio. Please use the Azure ML CLI v2 instead for job creation.
46+
4447
### Running jobs using user's credentials
4548

49+
In this case, we want to execute a batch endpoint using the identity of the user currently logged in. Follow these steps:
50+
51+
> [!NOTE]
52+
> When working on Azure ML studio, batch endpoints/deployments are always executed using the identity of the current user logged in.
53+
4654
# [Azure ML CLI](#tab/cli)
4755

48-
Use the Azure CLI to log in using either interactive or device code authentication:
56+
1. Use the Azure CLI to log in using either interactive or device code authentication:
4957

50-
```azurecli
51-
az login
52-
```
58+
```azurecli
59+
az login
60+
```
5361
54-
Once authenticated, use the following command to run a batch deployment job:
62+
1. Once authenticated, use the following command to run a batch deployment job:
5563
56-
```azurecli
57-
az ml batch-endpoint invoke --name $ENDPOINT_NAME --input https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data
58-
```
64+
```azurecli
65+
az ml batch-endpoint invoke --name $ENDPOINT_NAME --input https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data
66+
```
5967
6068
# [Azure ML SDK for Python](#tab/sdk)
6169
62-
Use the Azure ML SDK for Python to log in using either interactive or device authentication:
70+
1. Use the Azure ML SDK for Python to log in using either interactive or device authentication:
6371
64-
```python
65-
from azure.ai.ml import MLClient
66-
from azure.identity import InteractiveAzureCredentials
72+
```python
73+
from azure.ai.ml import MLClient
74+
from azure.identity import InteractiveAzureCredentials
6775
68-
subscription_id = "<subscription>"
69-
resource_group = "<resource-group>"
70-
workspace = "<workspace>"
76+
subscription_id = "<subscription>"
77+
resource_group = "<resource-group>"
78+
workspace = "<workspace>"
7179
72-
ml_client = MLClient(InteractiveAzureCredentials(), subscription_id, resource_group, workspace)
73-
```
80+
ml_client = MLClient(InteractiveAzureCredentials(), subscription_id, resource_group, workspace)
81+
```
7482
75-
Once authenticated, use the following command to run a batch deployment job:
83+
1. Once authenticated, use the following command to run a batch deployment job:
7684
77-
```python
78-
job = ml_client.batch_endpoints.invoke(
79-
endpoint_name,
80-
input=Input(path="https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data")
81-
)
82-
```
85+
```python
86+
job = ml_client.batch_endpoints.invoke(
87+
endpoint_name,
88+
input=Input(path="https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data")
89+
)
90+
```
8391
84-
# [studio](#tab/studio)
92+
# [REST](#tab/rest)
8593
86-
Jobs are always started using the identity of the user in the portal in studio.
94+
When working with REST APIs, we recommend to using either a service principal or a managed identity to interact with the API.
8795
8896
---
8997
9098
### Running jobs using a service principal
9199
100+
In this case, we want to execute a batch endpoint using a service principal already created in Azure Active Directory. To complete the authentication, you will have to create a secret to perform the authentication. Follow these steps:
101+
92102
# [Azure ML CLI](#tab/cli)
93103
94-
For more details see [Sign in with Azure CLI](/cli/azure/authenticate-azure-cli).
104+
1. Create a secret to use for authentication as explained at [Option 2: Create a new application secret](../../active-directory/develop/howto-create-service-principal-portal.md#option-2-create-a-new-application-secret).
105+
1. For more details see [Sign in with Azure CLI](/cli/azure/authenticate-azure-cli).
95106
96-
```bash
97-
az login --service-principal -u <app-id> -p <password-or-cert> --tenant <tenant>
98-
```
107+
```bash
108+
az login --service-principal -u <app-id> -p <password-or-cert> --tenant <tenant>
109+
```
99110
100-
Once authenticated, use the following command to run a batch deployment job:
111+
1. Once authenticated, use the following command to run a batch deployment job:
101112
102-
```azurecli
103-
az ml batch-endpoint invoke --name $ENDPOINT_NAME --input https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data
104-
```
113+
```azurecli
114+
az ml batch-endpoint invoke --name $ENDPOINT_NAME --input https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data
115+
```
105116
106117
# [Azure ML SDK for Python](#tab/sdk)
107118
108-
To authenticate using a service principal, indicate the tenant ID, client ID and client secret of the service principal using environment variables as demonstrated here:
109-
110-
```python
111-
from azure.ai.ml import MLClient
112-
from azure.identity import EnvironmentCredential
113-
114-
os.environ["AZURE_TENANT_ID"] = "<TENANT_ID>"
115-
os.environ["AZURE_CLIENT_ID"] = "<CLIENT_ID>"
116-
os.environ["AZURE_CLIENT_SECRET"] = "<CLIENT_SECRET>"
117-
118-
subscription_id = "<subscription>"
119-
resource_group = "<resource-group>"
120-
workspace = "<workspace>"
121-
122-
ml_client = MLClient(DefaultAzureCredential(), subscription_id, resource_group, workspace)
123-
```
124-
125-
Once authenticated, use the following command to run a batch deployment job:
126-
127-
```python
128-
job = ml_client.batch_endpoints.invoke(
129-
endpoint_name,
130-
input=Input(path="https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data")
131-
)
132-
```
133-
134-
# [studio](#tab/studio)
135-
136-
You can't run jobs using a service principal from studio.
119+
1. Create a secret to use for authentication as explained at [Option 2: Create a new application secret](../../active-directory/develop/howto-create-service-principal-portal.md#option-2-create-a-new-application-secret).
120+
1. To authenticate using a service principal, indicate the tenant ID, client ID and client secret of the service principal using environment variables as demonstrated:
121+
122+
```python
123+
from azure.ai.ml import MLClient
124+
from azure.identity import EnvironmentCredential
125+
126+
os.environ["AZURE_TENANT_ID"] = "<TENANT_ID>"
127+
os.environ["AZURE_CLIENT_ID"] = "<CLIENT_ID>"
128+
os.environ["AZURE_CLIENT_SECRET"] = "<CLIENT_SECRET>"
129+
130+
subscription_id = "<subscription>"
131+
resource_group = "<resource-group>"
132+
workspace = "<workspace>"
133+
134+
ml_client = MLClient(DefaultAzureCredential(), subscription_id, resource_group, workspace)
135+
```
136+
137+
1. Once authenticated, use the following command to run a batch deployment job:
138+
139+
```python
140+
job = ml_client.batch_endpoints.invoke(
141+
endpoint_name,
142+
input=Input(path="https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data")
143+
)
144+
```
145+
146+
# [REST](#tab/rest)
147+
148+
You can use the REST API of Azure Machine Learning to start a batch endpoints job using the user's credential. Follow these steps:
149+
150+
1. Use the login service from Azure to get an authorization token. Authorization tokens are issued to a particular scope. The resource type for Azure Machine learning is `https://ml.azure.com`. The request would look as follows:
151+
152+
__Request__:
153+
154+
```Body
155+
POST /{TENANT_ID}/oauth2/token
156+
Host:https://login.microsoftonline.com
157+
grant_type=client_credentials&client_id=<CLIENT_ID>&client_secret=<CLIENT_SECRET>&resource=https://ml.azure.com
158+
```
159+
160+
> [!IMPORTANT]
161+
> Notice that the resource scope for invoking a batch endpoints (`https://ml.azure.com1) is different from the resource scope used to manage them. All management APIs in Azure use the resource scope `https://management.azure.com`, including Azure Machine Learning.
162+
163+
3. Once authenticated, use the query to run a batch deployment job:
164+
165+
__Request__:
166+
167+
```http
168+
POST jobs HTTP/1.1
169+
Host: <ENDPOINT_URI>
170+
Authorization: Bearer <TOKEN>
171+
Content-Type: application/json
172+
```
173+
__Body:__
174+
175+
```json
176+
{
177+
"properties": {
178+
"InputData": {
179+
"mnistinput": {
180+
"JobInputType" : "UriFolder",
181+
"Uri": "https://pipelinedata.blob.core.windows.net/sampledata/mnist"
182+
}
183+
}
184+
}
185+
}
186+
```
137187
138188
---
139189
@@ -174,12 +224,20 @@ job = ml_client.batch_endpoints.invoke(
174224
)
175225
```
176226

177-
# [studio](#tab/studio)
227+
# [REST](#tab/rest)
228+
229+
You can use the REST API of Azure Machine Learning to start a batch endpoints job using a managed identity. The steps vary depending on the underlying service being used. Some examples include (but are not limited to):
230+
231+
* [Managed identity for Azure Data Factory](../../data-factory/data-factory-service-identity.md)
232+
* [How to use managed identities for App Service and Azure Functions](../../app-service/overview-managed-identity.md).
233+
* [How to use managed identities for Azure resources on an Azure VM to acquire an access token](../../active-directory/managed-identities-azure-resources/how-to-use-vm-token.md).
178234

179-
You can't run jobs using a managed identity from studio.
235+
You can also use the Azure CLI to get an authentication token for the managed identity and the pass it to the batch endpoints URI.
180236

181237
---
182238

183239
## Next steps
184240

185241
* [Network isolation in batch endpoints](how-to-secure-batch-endpoint.md)
242+
* [Invoking batch endpoints from Event Grid events in storage](how-to-use-event-grid-batch.md).
243+
* [Invoking batch endpoints from Azure Data Factory](how-to-use-batch-azure-data-factory.md).

0 commit comments

Comments
 (0)