You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> There are some specific requirements your subscription must meet before using this template:
87
+
> * The __Azure Machine Learning__ application must be a __contributor__ for your Azure subscription.
88
+
> * You must have an existing Azure Key Vault that contains an encryption key.
89
+
> * You must have an access policy in the Azure Key Vault that grants __get__, __wrap__, and __unwrap__ access to the __Azure Cosmos DB__ application.
90
+
> * The Azure Key Vault must be in the same region where you plan to create the Azure Machine Learning workspace.
91
+
> * Your subscription must support __customer-managed keys__ for Azure Cosmos DB.
264
92
265
-
To get the ID of the Key Vault, and the key URI needed by this template, you can use the Azure CLI. The following command gets the Key Vault ID:
93
+
__To add the Azure Machine Learning app as a contributor__, use the following commands:
266
94
267
-
```azurecli-interactive
268
-
az keyvault show --name mykeyvault --resource-group myresourcegroup --query "id"
269
-
```
95
+
1. To authenticate to Azure from the CLI, use the following command:
270
96
271
-
This command returns a value similar to `"/subscriptions/{subscription-guid}/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/mykeyvault"`.
To get the URI for the customer managed key, use the following command:
103
+
1. To get the object ID of the Azure Machine Learning app, use the following command. The value may be different for each of your Azure subscriptions:
274
104
275
-
```azurecli-interactive
276
-
az keyvault key show --vault-name mykeyvault --name mykey --query "key.kid"
277
-
```
105
+
```azurecli-interactive
106
+
az ad sp list --display-name "Azure Machine Learning" --query '[].[appDisplayName,objectId]' --output tsv
107
+
```
108
+
109
+
This command returns the object ID, which is a GUID.
110
+
111
+
1. To add the object ID as a contributor to your subscription, use the following command. Replace `<object-ID>` with the GUID from the previous step. Replace `<subscription-ID>` with the name or ID of your Azure subscription:
112
+
113
+
```azurecli-interactive
114
+
az role assignment create --role 'Contributor' --assignee-object-id <object-ID> --subscription <subscription-ID>
115
+
```
116
+
117
+
__To add a key to your Azure Key Vault__, use the information in the [Adding a key, secret, or certificate to the key vault](../key-vault/general/manage-with-cli2.md#adding-a-key-secret-or-certificate-to-the-key-vault) section of the __Manage Key Vault using Azure CLI__ article.
118
+
119
+
__To add an access policy to the key vault, use the following commands__:
120
+
121
+
1. To get the object ID of the Azure Cosmos DB app, use the following command. The value may be different for each of your Azure subscriptions:
122
+
123
+
```azurecli-interactive
124
+
az ad sp list --display-name "Azure Cosmos DB" --query '[].[appDisplayName,objectId]' --output tsv
125
+
```
126
+
127
+
This command returns the object ID, which is a GUID.
128
+
129
+
1. To set the policy, use the following command. Replace `<keyvault-name>` with the name of the existing Azure Key Vault. Replace `<object-ID>` with the GUID from the previous step:
130
+
131
+
```azurecli-interactive
132
+
az keyvault set-policy --name <keyvault-name> --object-id <object-ID> --key-permissions get unwrapKey wrapKey
133
+
```
134
+
135
+
__To enable customer-managed keys for Azure Cosmos DB__, send mail to [email protected] with your Azure subscription ID. For more information, see [Configure customer-managed keys for your Azure Cosmos account](..//cosmos-db/how-to-setup-cmk.md).
136
+
137
+
__To get the values__ for the `cmk_keyvault` (ID of the Key Vault) and the `resource_cmk_uri` (key URI) parameters needed by this template, use the following steps:
138
+
139
+
1. To get the Key Vault ID, use the following command:
140
+
141
+
```azurecli-interactive
142
+
az keyvault show --name mykeyvault --resource-group myresourcegroup --query "id"
143
+
```
144
+
145
+
This command returns a value similar to `/subscriptions/{subscription-guid}/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/mykeyvault`.
146
+
147
+
1. To get the value for the URI for the customer managed key, use the following command:
148
+
149
+
```azurecli-interactive
150
+
az keyvault key show --vault-name mykeyvault --name mykey --query "key.kid"
151
+
```
152
+
153
+
This command returns a value similar to `https://mykeyvault.vault.azure.net/keys/mykey/{guid}`.
154
+
155
+
__Example template__
278
156
279
-
This command returns a value similar to `"https://mykeyvault.vault.azure.net/keys/mykey/{guid}"`.
> Once a workspace has been created, you cannot change the settings for confidential data, encryption, key vault ID, or key identifiers. To change these values, you must create a new workspace using the new values.
0 commit comments