Skip to content

Commit e03ccc7

Browse files
santiagxfsantiagxf
authored
Update how-to-authenticate-batch-endpoint.md
1 parent 1c7d352 commit e03ccc7

File tree

1 file changed

+108
-70
lines changed

1 file changed

+108
-70
lines changed

‎articles/machine-learning/batch-inference/how-to-authenticate-batch-endpoint.md

Lines changed: 108 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Batch endpoints support Azure Active Directory authentication, or `aad_token`. T
2323

2424
## How authentication works
2525

26-
To invoke a batch endpoint, the user must present a valid Azure Active Directory token representing a security principal. This principal can be a user principal or a service principal. In any case, once an endpoint is invoked, a batch deployment job is created under the identity associated with the token. The identity needs the following permissions in order to successfully create a job:
26+
To invoke a batch endpoint, the user must present a valid Azure Active Directory token representing a security principal. This principal can be a __user principal__ or a __service principal__. In any case, once an endpoint is invoked, a batch deployment job is created under the identity associated with the token. The identity needs the following permissions in order to successfully create a job:
2727

2828
> [!div class="checklist"]
2929
> * Read batch endpoints/deployments.
@@ -43,97 +43,139 @@ The following examples show different ways to start batch deployment jobs using
4343

4444
### Running jobs using user's credentials
4545

46-
# [Azure ML CLI](#tab/cli)
46+
In this case, we want to execute a batch endpoint using the identity of the user currenly logged in. Follow these steps:
4747

48-
Use the Azure CLI to log in using either interactive or device code authentication:
48+
> [!IMPORTANT]
49+
> When working on a private link-enabled workspaces, batch endpoints can't be invoked from the UI in Azure ML studio. Please use the Azure ML CLI v2 instead for job creation.
4950
50-
```azurecli
51-
az login
52-
```
51+
> [!NOTE]
52+
> When working on Azure ML studio, batch endpoints/deployments are always executed using the identity of the current user logged in.
5353
54-
Once authenticated, use the following command to run a batch deployment job:
54+
# [Azure ML CLI](#tab/cli)
5555

56-
```azurecli
57-
az ml batch-endpoint invoke --name $ENDPOINT_NAME --input https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data
58-
```
56+
1. Use the Azure CLI to log in using either interactive or device code authentication:
5957

60-
# [Azure ML SDK for Python](#tab/sdk)
58+
```azurecli
59+
az login
60+
```
6161
62-
Use the Azure ML SDK for Python to log in using either interactive or device authentication:
62+
1. Once authenticated, use the following command to run a batch deployment job:
6363
64-
```python
65-
from azure.ai.ml import MLClient
66-
from azure.identity import InteractiveAzureCredentials
64+
```azurecli
65+
az ml batch-endpoint invoke --name $ENDPOINT_NAME --input https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data
66+
```
6767
68-
subscription_id = "<subscription>"
69-
resource_group = "<resource-group>"
70-
workspace = "<workspace>"
68+
# [Azure ML SDK for Python](#tab/sdk)
7169
72-
ml_client = MLClient(InteractiveAzureCredentials(), subscription_id, resource_group, workspace)
73-
```
70+
1. Use the Azure ML SDK for Python to log in using either interactive or device authentication:
7471
75-
Once authenticated, use the following command to run a batch deployment job:
72+
```python
73+
from azure.ai.ml import MLClient
74+
from azure.identity import InteractiveAzureCredentials
7675
77-
```python
78-
job = ml_client.batch_endpoints.invoke(
79-
endpoint_name,
80-
input=Input(path="https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data")
81-
)
82-
```
76+
subscription_id = "<subscription>"
77+
resource_group = "<resource-group>"
78+
workspace = "<workspace>"
79+
80+
ml_client = MLClient(InteractiveAzureCredentials(), subscription_id, resource_group, workspace)
81+
```
8382
84-
# [studio](#tab/studio)
83+
1. Once authenticated, use the following command to run a batch deployment job:
8584
86-
Jobs are always started using the identity of the user in the portal in studio.
85+
```python
86+
job = ml_client.batch_endpoints.invoke(
87+
endpoint_name,
88+
input=Input(path="https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data")
89+
)
90+
```
8791
8892
---
8993
9094
### Running jobs using a service principal
9195
96+
In this case, we want to execute a batch endpoint using a service princpal already created in Azure Active Directory. To complete the authentication, you will have to create a secret to perform the authentication. Follow these steps:
97+
9298
# [Azure ML CLI](#tab/cli)
9399
94-
For more details see [Sign in with Azure CLI](/cli/azure/authenticate-azure-cli).
100+
1. Create a secret to use for authentication as explained at [Option 2: Create a new application secret](../../active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret).
101+
1. For more details see [Sign in with Azure CLI](/cli/azure/authenticate-azure-cli).
95102
96-
```bash
97-
az login --service-principal -u <app-id> -p <password-or-cert> --tenant <tenant>
98-
```
103+
```bash
104+
az login --service-principal -u <app-id> -p <password-or-cert> --tenant <tenant>
105+
```
99106
100-
Once authenticated, use the following command to run a batch deployment job:
107+
1. Once authenticated, use the following command to run a batch deployment job:
101108
102-
```azurecli
103-
az ml batch-endpoint invoke --name $ENDPOINT_NAME --input https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data
104-
```
109+
```azurecli
110+
az ml batch-endpoint invoke --name $ENDPOINT_NAME --input https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data
111+
```
105112
106113
# [Azure ML SDK for Python](#tab/sdk)
107114
108-
To authenticate using a service principal, indicate the tenant ID, client ID and client secret of the service principal using environment variables as demonstrated here:
109-
110-
```python
111-
from azure.ai.ml import MLClient
112-
from azure.identity import EnvironmentCredential
113-
114-
os.environ["AZURE_TENANT_ID"] = "<TENANT_ID>"
115-
os.environ["AZURE_CLIENT_ID"] = "<CLIENT_ID>"
116-
os.environ["AZURE_CLIENT_SECRET"] = "<CLIENT_SECRET>"
117-
118-
subscription_id = "<subscription>"
119-
resource_group = "<resource-group>"
120-
workspace = "<workspace>"
121-
122-
ml_client = MLClient(DefaultAzureCredential(), subscription_id, resource_group, workspace)
123-
```
124-
125-
Once authenticated, use the following command to run a batch deployment job:
126-
127-
```python
128-
job = ml_client.batch_endpoints.invoke(
129-
endpoint_name,
130-
input=Input(path="https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data")
131-
)
132-
```
133-
134-
# [studio](#tab/studio)
135-
136-
You can't run jobs using a service principal from studio.
115+
1. Create a secret to use for authentication as explained at [Option 2: Create a new application secret](../../active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret).
116+
1. To authenticate using a service principal, indicate the tenant ID, client ID and client secret of the service principal using environment variables as demonstrated:
117+
118+
```python
119+
from azure.ai.ml import MLClient
120+
from azure.identity import EnvironmentCredential
121+
122+
os.environ["AZURE_TENANT_ID"] = "<TENANT_ID>"
123+
os.environ["AZURE_CLIENT_ID"] = "<CLIENT_ID>"
124+
os.environ["AZURE_CLIENT_SECRET"] = "<CLIENT_SECRET>"
125+
126+
subscription_id = "<subscription>"
127+
resource_group = "<resource-group>"
128+
workspace = "<workspace>"
129+
130+
ml_client = MLClient(DefaultAzureCredential(), subscription_id, resource_group, workspace)
131+
```
132+
133+
1. Once authenticated, use the following command to run a batch deployment job:
134+
135+
```python
136+
job = ml_client.batch_endpoints.invoke(
137+
endpoint_name,
138+
input=Input(path="https://azuremlexampledata.blob.core.windows.net/data/heart-disease-uci/data")
139+
)
140+
```
141+
142+
# [REST](#tab/rest)
143+
144+
You can use the REST API of Azure Machine Learning to start a batch endpoints job using the user's credential. Follow these steps:
145+
146+
1. Use the login service from Azure to get an authorization token. Authorization tokens are issued to a particular scope. The resource type for Azure Machine learning is `https://ml.azure.com`. The request would look as follows:
147+
148+
__POST__: https://login.microsoftonline.com/<TENANT_ID>/oauth2/token
149+
```Body
150+
grant_type=client_credentials&client_id=<CLIENT_ID>&client_secret=<CLIENT_SECRET>&resource=https://ml.azure.com
151+
```
152+
153+
> [!IMPORTANT]
154+
> Notice that the resource scope for invoking a batch endpoints (`https://ml.azure.com1) is different from the resource scope used to manage them. All management APIs in Azure use the resource scope `https://management.azure.com`, including Azure Machine Learning.
155+
156+
3. Once authenticated, use the query to run a batch deployment job:
157+
158+
__POST__: <ENDPOINT_URI>
159+
160+
```json
161+
{
162+
"properties": {
163+
"InputData": {
164+
"mnistinput": {
165+
"JobInputType" : "UriFolder",
166+
"Uri": "https://pipelinedata.blob.core.windows.net/sampledata/mnist"
167+
}
168+
}
169+
}
170+
}
171+
```
172+
173+
The following headers need to be included:
174+
175+
| Header | Value |
176+
|---------------|------------------|
177+
| Authorization | Bearer <TOKEN> |
178+
| Content-Type | application/json |
137179
138180
---
139181
@@ -174,10 +216,6 @@ job = ml_client.batch_endpoints.invoke(
174216
)
175217
```
176218

177-
# [studio](#tab/studio)
178-
179-
You can't run jobs using a managed identity from studio.
180-
181219
---
182220

183221
## Next steps

0 commit comments

Comments
 (0)