You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/machine-learning/how-to-prevent-data-loss-exfiltration.md
+6-16Lines changed: 6 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ ms.reviewer: larryfr
12
12
ms.date: 08/26/2022
13
13
---
14
14
15
-
# Azure Machine Learning data exfiltration prevention (Preview)
15
+
# Azure Machine Learning data exfiltration prevention
16
16
17
17
<!-- Learn how to use a [Service Endpoint policy](../virtual-network/virtual-network-service-endpoint-policies-overview.md) to prevent data exfiltration from storage accounts in your Azure Virtual Network that are used by Azure Machine Learning. -->
18
18
@@ -36,17 +36,7 @@ Azure Machine Learning has several inbound and outbound dependencies. Some of th
36
36
* An Azure Machine Learning workspace with a private endpoint that connects to the VNet.
37
37
* The storage account used by the workspace must also connect to the VNet using a private endpoint.
38
38
39
-
## 1. Opt in to the preview
40
-
41
-
> [!IMPORTANT]
42
-
> Before opting in to this preview, you must have created a workspace and a compute instance on the subscription you plan to use. You can delete the compute instance and/or workspace after creating them.
43
-
44
-
Use the form at [https://forms.office.com/r/1TraBek7LV](https://forms.office.com/r/1TraBek7LV) to opt in to this Azure Machine Learning preview. Microsoft will contact you once your subscription has been allowlisted to the preview.
45
-
46
-
> [!TIP]
47
-
> It may take one to two weeks to allowlist your subscription.
48
-
49
-
## 2. Create the service endpoint policy
39
+
## 1. Create the service endpoint policy
50
40
51
41
1. From the [Azure portal](https://portal.azure.com), add a new __Service Endpoint Policy__. On the __Basics__ tab, provide the required information and then select __Next__.
52
42
1. On the __Policy definitions__ tab, perform the following actions:
@@ -73,7 +63,7 @@ Use the form at [https://forms.office.com/r/1TraBek7LV](https://forms.office.com
73
63
74
64
1. Select __Review + Create__, and then select __Create__.
75
65
76
-
## 3. Allow inbound and outbound network traffic
66
+
## 2. Allow inbound and outbound network traffic
77
67
78
68
### Inbound
79
69
@@ -114,7 +104,7 @@ __Allow__ outbound traffic over __TCP port 443__ to the following FQDNs. Replace
114
104
115
105
For more information, see [How to secure training environments](how-to-secure-training-vnet.md) and [Configure inbound and outbound network traffic](how-to-access-azureml-behind-firewall.md).
116
106
117
-
## 4. Enable storage endpoint for the subnet
107
+
## 3. Enable storage endpoint for the subnet
118
108
119
109
1. From the [Azure portal](https://portal.azure.com), select the __Azure Virtual Network__ for your Azure ML workspace.
120
110
1. From the left of the page, select __Subnets__ and then select the subnet that contains your compute cluster/instance resources.
@@ -123,15 +113,15 @@ For more information, see [How to secure training environments](how-to-secure-tr
123
113
124
114
:::image type="content" source="media/how-to-data-exfiltration-prevention/enable-storage-endpoint-for-subnet.png" alt-text="A screenshot of the Azure portal showing how to enable storage endpoint for the subnet." lightbox="media/how-to-data-exfiltration-prevention/enable-storage-endpoint-for-subnet.png":::
125
115
126
-
## 5. Curated environments
116
+
## 4. Curated environments
127
117
128
118
When using Azure ML curated environments, make sure to use the latest environment version. The container registry for the environment must also be `mcr.microsoft.com`. To check the container registry, use the following steps:
129
119
130
120
1. From [Azure ML studio](https://ml.azure.com), select your workspace and then select __Environments__.
131
121
1. Verify that the __Azure container registry__ begins with a value of `mcr.microsoft.com`.
132
122
133
123
> [!IMPORTANT]
134
-
> If the container registry is `viennaglobal.azurecr.io` you cannot use the curated environment with the data exfiltration preview. Try upgrading to the latest version of the curated environment.
124
+
> If the container registry is `viennaglobal.azurecr.io` you cannot use the curated environment with the data exfiltration. Try upgrading to the latest version of the curated environment.
135
125
136
126
1. When using `mcr.microsoft.com`, you must also allow outbound configuration to the following resources. Select the configuration option that you're using:
0 commit comments