You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> This article is intended for Azure administrators who want to create the required infrastructure for an Azure Machine Learning solution.
25
25
26
26
## Credential-based data authentication
27
27
In general, credential-based data authentication involves these checks:
28
-
* Does the user who is accessing data from the credential-based datastore have been assigned a RBAC role containing `Microsoft.MachineLearningServices/workspaces/datastores/listsecrets/action`?
28
+
* Does the user who is accessing data from the credential-based datastore have been assigned an RBAC role containing `Microsoft.MachineLearningServices/workspaces/datastores/listsecrets/action`?
29
29
- This permission is required to retrieve credentials from the datastore on behalf of the user.
30
30
* Does the stored credential (service principal, account key, or sas token) have access to the data resource?
31
31
@@ -34,7 +34,7 @@ In general, credential-based data authentication involves these checks:
34
34
In general, identity-based data authentication involves these checks:
35
35
36
36
* Which user wants to access the resources?
37
-
- Depending on the conext the data is being accessed, different types of authentication are available, for example
37
+
- Depending on the conext when the data is being accessed, different types of authentication are available, for example
38
38
- user identity
39
39
- compute managed identity
40
40
- workspace managed identity
@@ -52,7 +52,7 @@ In general, identity-based data authentication involves these checks:
52
52
- Please find more [Azure built-in roles for storage here](../role-based-access-control/built-in-roles/storage.md).
53
53
54
54
55
-
## Other general checks for authetication
55
+
## Other general checks for authentication
56
56
* Where does the access come from?
57
57
- User: Is the client IP address in the VNet/subnet range?
58
58
- Workspace: Is the workspace public, or does it have a private endpoint in a VNet/subnet?
@@ -108,7 +108,7 @@ To secure communication between Azure Machine Learning and Azure Storage Account
108
108
109
109
### Azure Storage firewall
110
110
111
-
When an Azure Storage account is located behind a virtual network, the storage firewall can normally be used to allow your client to directly connect over the internet. However, when using studio, your client doesn't connect to the storage account. The Azure Machine Learning service that makes the request connects to the storage account. The IP address of the service isn't documented, and it changes frequently. __Enabling the storage firewall will not allow studio to access the storage account in a VNet configuration__.
111
+
When an Azure Storage account is located behind a virtual network, the storage firewall can normally be used to allow your client to directly connect over the internet. However, when using studio, your client doesn't connect to the storage account. The Azure Machine Learning service that makes the request connect to the storage account. The IP address of the service isn't documented, and it changes frequently. __Enabling the storage firewall will not allow studio to access the storage account in a VNet configuration__.
0 commit comments