freshness updates concept-compute-target and how-to-assign-roles

Author: sdgilley

articles/machine-learning/concept-compute-target.md

@@ -9,7 +9,7 @@ ms.topic: conceptual
 ms.author: vijetaj
 author: vijetajo
 ms.reviewer: sgilley
-ms.date: 10/19/2022
+ms.date: 01/23/2024
 ms.custom:
   - ignite-fall-2021
   - event-tier1-build-2022
@@ -145,13 +145,19 @@ See the following table to learn more about supported series.
 
 While Azure Machine Learning supports these VM series, they might not be available in all Azure regions. To check whether VM series are available, see [Products available by region](https://azure.microsoft.com/global-infrastructure/services/?products=virtual-machines).
 
+:::moniker range="azureml-api-2"
 > [!NOTE]
 > Azure Machine Learning doesn't support all VM sizes that Azure Compute supports. To list the available VM sizes, use one of the following methods:
 > * [REST API](https://github.com/Azure/azure-rest-api-specs/blob/master/specification/machinelearningservices/resource-manager/Microsoft.MachineLearningServices/stable/2020-08-01/examples/ListVMSizesResult.json)
-:::moniker range="azureml-api-2"
 > * The [Azure CLI extension 2.0 for machine learning](how-to-configure-cli.md) command, [az ml compute list-sizes](/cli/azure/ml/compute#az-ml-compute-list-sizes).
 :::moniker-end
 
+:::moniker range="azureml-api-1"
+> [!NOTE]
+> Azure Machine Learning doesn't support all VM sizes that Azure Compute supports. To list the available VM sizes, use one of the following methods:
+> * [REST API](https://github.com/Azure/azure-rest-api-specs/blob/master/specification/machinelearningservices/resource-manager/Microsoft.MachineLearningServices/stable/2020-08-01/examples/ListVMSizesResult.json)
+:::moniker-end
+
 If using the GPU-enabled compute targets, it is important to ensure that the correct CUDA drivers are installed in the training environment. Use the following table to determine the correct CUDA version to use:
 
 | **GPU Architecture**  | **Azure VM Series** | **Supported CUDA versions** |

articles/machine-learning/how-to-assign-roles.md

@@ -9,7 +9,7 @@ ms.topic: how-to
 ms.reviewer: larryfr
 ms.author: meyetman
 author: meyetman
-ms.date: 08/01/2022
+ms.date: 01/23/2024
 ms.custom: how-to, seodec18, devx-track-azurecli, contperf-fy21q2, event-tier1-build-2022, devx-track-arm-template
 monikerRange: 'azureml-api-1 || azureml-api-2'
 ---
@@ -31,7 +31,7 @@ In this article, you learn how to manage access (authorization) to an Azure Mach
 
 ## Default roles
 
-Azure Machine Learning workspaces have a five built-in roles that are available by default. When adding users to a workspace, they can be assigned one of the built-in roles described below.
+Azure Machine Learning workspaces have built-in roles that are available by default. When adding users to a workspace, they can be assigned one of the built-in roles described below.
 
 | Role | Access level |
 | --- | --- |
@@ -197,13 +197,17 @@ The following table is a summary of Azure Machine Learning activities and the pe
 | Scoring against a deployed AKS endpoint | Not required | Not required | Owner, contributor, or custom role allowing: `"/workspaces/services/aks/score/action", "/workspaces/services/aks/listkeys/action"` (when you are not using Microsoft Entra auth) OR `"/workspaces/read"` (when you are using token auth) |
 | Accessing storage using interactive notebooks | Not required | Not required | Owner, contributor, or custom role allowing: `"/workspaces/computes/read", "/workspaces/notebooks/samples/read", "/workspaces/notebooks/storage/*", "/workspaces/listStorageAccountKeys/action", "/workspaces/listNotebookAccessToken/read"`|
 | Create new custom role | Owner, contributor, or custom role allowing `Microsoft.Authorization/roleDefinitions/write` | Not required | Owner, contributor, or custom role allowing: `/workspaces/computes/write` |
-| Create/manage online endpoints and deployments | Not required | Not required | Owner, contributor, or custom role allowing `Microsoft.MachineLearningServices/workspaces/onlineEndpoints/*`. If you use studio to create/manage online endpoints/deployments, you will need an additional permission "Microsoft.Resources/deployments/write" from the resource group owner. |
+| Create/manage online endpoints and deployments | Not required | To deploy on studio,  "Microsoft.Resources/deployments/write" and "Microsoft.MachineLearningServices/workspaces/onlineEndpoints/deployments/write". For SDK/CLI deployments, "Microsoft.MachineLearningServices/workspaces/onlineEndpoints/deployments/write"| Owner, contributor, or custom role allowing `Microsoft.MachineLearningServices/workspaces/onlineEndpoints/*`.  |
 | Retrieve authentication credentials for online endpoints | Not required | Not required | Owner, contributor, or custom role allowing `Microsoft.MachineLearningServices/workspaces/onlineEndpoints/token/action` and `Microsoft.MachineLearningServices/workspaces/onlineEndpoints/listkeys/action`.
 
 1: If you receive a failure when trying to create a workspace for the first time, make sure that your role allows `Microsoft.MachineLearningServices/register/action`. This action allows you to register the Azure Machine Learning resource provider with your Azure subscription.
 
 2: When attaching an AKS cluster, you also need to have the [Azure Kubernetes Service Cluster Admin Role](/azure/role-based-access-control/built-in-roles#azure-kubernetes-service-cluster-admin-role) on the cluster.
 
+###  Deploy into a virtual network or subnet
+
+[!INCLUDE [network-rbac](includes/network-rbac.md)]
+
 ### Differences between actions for V1 and V2 APIs
 
 There are certain differences between actions for V1 APIs and V2 APIs.
@@ -610,8 +614,6 @@ Here are a few things to be aware of while you use Azure role-based access contr
 
 - When there are two role assignments to the same Microsoft Entra user with conflicting sections of Actions/NotActions, your operations listed in NotActions from one role might not take effect if they are also listed as Actions in another role. To learn more about how Azure parses role assignments, read [How Azure RBAC determines if a user has access to a resource](/azure/role-based-access-control/overview#how-azure-rbac-determines-if-a-user-has-access-to-a-resource)
 
-[!INCLUDE [network-rbac](includes/network-rbac.md)]
-
 - It can sometimes take up to 1 hour for your new role assignments to take effect over cached permissions across the stack.
 
 ## Next steps