You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/machine-learning/how-to-integrate-azure-policy.md
+19-6Lines changed: 19 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,9 +24,11 @@ As a platform administrator, you can use policies to lay out guardrails for team
24
24
25
25
Azure Machine Learning provides a set of policies that you can use for common scenarios with Azure Machine Learning. You can assign these policy definitions to your existing subscription or use them as the basis to create your own custom definitions.
26
26
27
-
The table below includes a selection of policies you can assign with Azure Machine Learning. For a complete list of the built-in policies for Azure Machine Learning, see [Built-in policies for Azure Machine Learning](../governance/policy/samples/built-in-policies.md#machine-learning).
27
+
The table below lists the built-in policies you can assign with Azure Machine Learning. For a complete list of the built-in policies for Azure services, see [Built-in policies](../governance/policy/samples/built-in-policies.md).
| **Customer-managed key** | Audit or enforce whether workspaces must use a customer-managed key. |
32
34
| **Private link** | Audit or enforce whether workspaces use a private endpoint to communicate with a virtual network. |
@@ -36,7 +38,7 @@ The table below includes a selection of policies you can assign with Azure Machi
36
38
| **Disable public network access** | Audit or enforce whether workspaces disable access from the public internet. |
37
39
| **Disable local authentication** | Audit or enforce whether Azure Machine Learning compute resources should have local authentication methods disabled. |
38
40
| **Modify/disable local authentication** | Configure compute resources to disable local authentication methods. |
39
-
|**Compute cluster and instance is behind virtual network**| Audit whether compute resources are behind a virtual network. |
41
+
| **Compute cluster and instance is behind virtual network** | Audit whether compute resources are behind a virtual network. |-->
40
42
41
43
Policies can be set at different scopes, such as at the subscription or resource group level. For more information, see the [Azure Policy documentation](../governance/policy/overview.md).
### Workspace encryption with customer-managed key
72
77
73
78
Controls whether a workspace should be encrypted with a customer-managed key, or using a Microsoft-managed key to encrypt metrics and metadata. For more information on using customer-managed key, see the [Azure Cosmos DB](concept-data-encryption.md#azure-cosmos-db) section of the data encryption article.
@@ -108,24 +113,32 @@ If the policy is set to __deny__, then you cannot create a workspace unless you
108
113
109
114
Controls whether a workspace should disable network access from the public internet.
110
115
111
-
To configure this policy, set thee effect parameter to __audit__, __deny__, or __disabled__. If set to __audit__, you can create a workspace with public access and a warning event is created in the activity log.
116
+
To configure this policy, set the effect parameter to __audit__, __deny__, or __disabled__. If set to __audit__, you can create a workspace with public access and a warning event is created in the activity log.
112
117
113
118
If the policy is set to __deny__, then you cannot create a workspace that allows network access from the public internet.
114
119
115
-
### Disable local authentication
120
+
### Computes should have local authentication methods disabled.
116
121
117
122
Controls whether an Azure Machine Learning compute cluster or instance should disable local authentication (SSH).
118
123
119
124
To configure this policy, set the effect parameter to __audit__, __deny__, or __disabled__. If set to __audit__, you can create a compute with SSH enabled and a warning event is created in the activity log.
120
125
121
126
If the policy is set to __deny__, then you cannot create a compute unless SSH is disabled. Attempting to create a compute with SSH enabled results in an error. The error is also logged in the activity log. The policy identifier is returned as part of this error.
122
127
123
-
### Modify/disable local authentication
128
+
### Configure computes to Modify/disable local authentication
124
129
125
130
Modifies any Azure Machine Learning compute cluster or instance creation request to disable local authentication (SSH).
126
131
127
132
To configure this policy, set the effect parameter to __Modify__ or __Disabled__. If set __Modify__, any creation of a compute cluster or instance within the scope where the policy applies will automatically have local authentication disabled.
128
133
134
+
### Compute instances should have idle shutdown
135
+
136
+
TBD
137
+
138
+
### Compute instances should be recreated to get software updates
139
+
140
+
TBD
141
+
129
142
### Compute cluster and instance is behind virtual network
130
143
131
144
Controls auditing of compute cluster and instance resources behind a virtual network.
0 commit comments