Skip to content

Commit e688a09

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #265466 from Blackmist/201156-architecture
initial writing
2 parents 3efb80a + 99abbe7 commit e688a09

File tree

6 files changed

+150
-16
lines changed

6 files changed

+150
-16
lines changed

‎articles/ai-studio/concepts/ai-resources.md

Lines changed: 5 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -107,22 +107,11 @@ Connections can be set up as shared with all projects in the same Azure AI hub r
107107

108108
Azure AI Studio layers on top of existing Azure services including Azure AI and Azure Machine Learning services. While this might not be visible on the display names in Azure portal, AI Studio, or when using the SDK or CLI, some of these architectural details become apparent when you work with the Azure REST APIs, use Azure cost reporting, or use infrastructure-as-code templates such as Azure Bicep or Azure Resource Manager. From an Azure Resource Provider perspective, Azure AI Studio resource types map to the following resource provider kinds:
109109

110-
|Resource type|Resource provider|Kind|
111-
|---|---|---|
112-
|Azure AI hub resources|Microsoft.MachineLearningServices/workspace|hub|
113-
|Azure AI project|Microsoft.MachineLearningServices/workspace|project|
114-
|Azure AI services|Microsoft.CognitiveServices/account|AIServices|
115-
|Azure AI OpenAI Service|Microsoft.CognitiveServices/account|OpenAI|
116-
117-
When you create a new Azure AI hub resource, a set of dependent Azure resources are required to store data that you upload or get generated when working in AI Studio. If not provided by you, these resources are automatically created.
118-
119-
|Dependent Azure resource|Note|
120-
|---|---|
121-
|Azure AI services|Either Azure AI services multi-service provider, or Azure OpenAI Service. Provides API endpoints and keys for prebuilt AI services.|
122-
|Azure Storage account|Stores artifacts for your projects like flows and evaluations. For data isolation, storage containers are prefixed using the project GUID, and conditionally secured using Azure ABAC for the project identity.|
123-
|Azure Key Vault| Stores secrets like connection strings for your resource connections. For data isolation, secrets can't be retrieved across projects via APIs.|
124-
|Azure Container Registry| Stores docker images created when using custom runtime for prompt flow. For data isolation, docker images are prefixed using the project GUID.|
125-
|Azure Application Insights| Used as log storage when you opt in for application-level logging for your deployed prompt flows.|
110+
[!INCLUDE [Resource provider kinds](../includes/resource-provider-kinds.md)]
111+
112+
When you create a new Azure AI hub resource, a set of dependent Azure resources are required to store data that you upload or get generated when working in AI studio. If not provided by you, and required, these resources are automatically created.
113+
114+
[!INCLUDE [Dependent Azure resources](../includes/dependent-resources.md)]
126115

127116
## Managing cost
128117

‎articles/ai-studio/concepts/architecture.md

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
---
2+
title: Architecture
3+
titleSuffix: Azure AI Studio
4+
description: Learn about the architecture of Azure AI Studio.
5+
manager: scottpolly
6+
ms.service: azure-ai-studio
7+
ms.topic: conceptual
8+
ms.date: 02/06/2024
9+
ms.reviewer: deeikele
10+
ms.author: larryfr
11+
author: Blackmist
12+
---
13+
14+
# Azure AI Studio architecture
15+
16+
[!INCLUDE [Azure AI Studio preview](../includes/preview-ai-studio.md)]
17+
18+
AI Studio provides a unified experience for AI developers and data scientists to build, evaluate, and deploy AI models through a web portal, SDK, or CLI. It's built on capabilities and services provided by other Azure services.
19+
20+
The top level AI Studio resources (AI hub and AI projects) are based on Azure Machine Learning. Other resources, such as Azure OpenAI, Azure AI Services, and Azure AI Search, are used by the AI hub and AI project.
21+
22+
- **AI hub**: The AI hub is the top-level resource in AI Studio. The Azure resource provider for an AI hub is `Microsoft.MachineLearningServices/workspaces`, and the kind of resource is `Hub`. It provides the following features:
23+
- Data upload and artifact storage.
24+
- Hub-scoped connections to Azure services such as Azure OpenAI, Azure AI Services, and Azure AI Search.
25+
- Base model endpoints for Azure OpenAI, Speech, and Vision.
26+
- Compute resources.
27+
- Security and governance.
28+
- **AI project**: An AI project is a child resource of the AI hub. The Azure resource provider for an AI project is `Microsoft.MachineLearningServices/workspaces`, and the kind of resource is `Project`. It inherits the AI hub's connections, and compute resources. When a new AI project is created from the AI hub, the security settings of the AI hub are applied to it. The AI project provides the following features:
29+
- Groups of components such as datasets, models, and indexes.
30+
- An isolated data container (within the storage inherited from the AI hub).
31+
- Project-scoped connections. For example, a project might need access to data stored in a separate Azure Storage account.
32+
- Open source model deployments from catalog and fine-tuned model endpoints.
33+
34+
An AI hub can have multiple child AI projects. Each AI project can have its own set of project-scoped connections.
35+
36+
:::image type="content" source="../media/concepts/azureai-hub-project-relationship.png" alt-text="Diagram of the relationship between AI Studio resources." lightbox="../media/concepts/azureai-hub-project-relationship.png":::
37+
38+
### Tenant separation
39+
40+
While most of the resources used by Azure AI Studio live in your Azure subscription, some resources exist in the Azure AI Studio tenant. The Azure AI Studio tenant is a separate Microsoft Entra ID tenant that provides some of the services used by Azure AI Studio. The following resources are in the Azure AI Studio tenant:
41+
42+
- **Managed compute resources**: Provided by Azure Batch resources in the Azure AI Studio tenant.
43+
- **Managed virtual network**: Provided by Azure Virtual Network resources in the Azure AI Studio tenant. If FQDN rules are enabled, an Azure Firewall (standard) is added and charged to your subscription. For more information, see [Configure a managed virtual network for Azure AI Studio](../how-to/configure-managed-network.md).
44+
- **Metadata storage**: Provided by Azure Cosmos DB, Azure AI Search, and Azure Storage Account in the Azure AI Studio tenant. If you use customer-managed keys, these resources are created in your subscription. For more information, see [Customer-managed keys](../../ai-services/encryption/cognitive-services-encryption-keys-portal.md?context=/azure/ai-studio/context/context).
45+
46+
## Azure resource providers
47+
48+
Since Azure AI Studio is built from other Azure services, the resource providers for these services must be registered in your Azure subscription. The following table lists the resource, provider, and resource provider kinds:
49+
50+
[!INCLUDE [Resource provider kinds](../includes/resource-provider-kinds.md)]
51+
52+
When you create a new Azure AI hub resource, a set of dependent Azure resources are required to store data, manage security, and provide compute resources. The following table lists the dependent Azure resources and their resource providers:
53+
54+
> [!TIP]
55+
> If you don't provide a dependent resource when creating an AI hub, and it's a required dependency, AI Studio creates the resource for you.
56+
57+
[!INCLUDE [Dependent Azure resources](../includes/dependent-resources.md)]
58+
59+
For information on registering resource providers, see [Register an Azure resource provider](/azure/azure-resource-manager/management/resource-providers-and-types#register-resource-provider).
60+
61+
## Role-based access control and control plane proxy
62+
63+
Azure AI Services and Azure OpenAI provide control plane endpoints for operations such as listing model deployments. These endpoints are secured using a separate Azure role-based access control (RBAC) configuration than the one used for Azure AI hub.
64+
65+
To reduce the complexity of Azure RBAC management, AI Studio provides a *control plane proxy* that allows you to perform operations on connected Azure AI Services and Azure OpenAI resources. Performing operations on these resources through the control plane proxy only requires Azure RBAC permissions on the AI hub. The Azure AI Studio service then performs the call to the Azure AI Services or Azure OpenAI control plane endpoint on your behalf.
66+
67+
For more information, see [Role-based access control in Azure AI Studio](rbac-ai-studio.md).
68+
69+
## Encryption
70+
71+
Azure AI Studio uses encryption to protect data at rest and in transit. By default, Microsoft-managed keys are used for encryption, however you can use your own encryption keys. For more information, see [Customer-managed keys](../../ai-services/encryption/cognitive-services-encryption-keys-portal.md?context=/azure/ai-studio/context/context).
72+
73+
## Virtual network
74+
75+
Azure AI hub can be configured to use a *managed* virtual network. The managed virtual network secures communications between the AI hub, AI projects, and managed resources such as computes. If your dependency services (Azure Storage, Key Vault, and Container Registry) have public access disabled, a private endpoint for each dependency service is created to secure communication between the AI hub/project and the dependency service.
76+
77+
> [!NOTE]
78+
> If you want to use a virtual network to secure communications between your clients and the AI hub or AI project, you must use an Azure Virtual Network that you create and manage. For example, an Azure Virtual Network that uses a VPN or ExpressRoute connection to your on-premises network.
79+
80+
For more information on how to configure a managed virtual network, see [Configure a managed virtual network for Azure AI Studio](../how-to/configure-managed-network.md).
81+
82+
## Azure Monitor
83+
84+
Azure monitor and Azure Log Analytics provide monitoring and logging for the underlying resources used by Azure AI Studio. Since Azure AI Studio is built on Azure Machine Learning, Azure OpenAI, Azure AI Services, and Azure AI Search, use the following articles to learn how to monitor the services:
85+
86+
| Resource | Monitoring and logging |
87+
| --- | --- |
88+
| Azure AI hub and AI project | [Monitor Azure Machine Learning](/azure/machine-learning/monitor-azure-machine-learning) |
89+
| Azure OpenAI | [Monitor Azure OpenAI](/azure/ai-services/openai/how-to/monitoring) |
90+
| Azure AI Services | [Monitor Azure AI (training)](/training/modules/monitor-ai-services/) |
91+
| Azure AI Search | [Monitor Azure AI Search](/azure/search/monitor-azure-cognitive-search) |
92+
93+
## Price and quota
94+
95+
For more information on price and quota, use the following articles:
96+
97+
- [Plan and manage costs](../how-to/costs-plan-manage.md)
98+
- [Commitment tier pricing](../how-to/commitment-tier.md)
99+
- [Quota management](../how-to/quota.md)
100+
101+
## Next steps
102+
103+
Create an AI hub using one of the following methods:
104+
105+
- [Azure AI Studio](../how-to/create-azure-ai-resource.md#create-an-azure-ai-hub-resource-in-ai-studio): Create an AI hub for getting started.
106+
- [Azure portal](../how-to/create-azure-ai-resource.md#create-a-secure-azure-ai-hub-resource-in-the-azure-portal): Create an AI hub with your own networking, encryption, identity and access management, dependent resources, and resource tag settings.
107+
- [Bicep template](../how-to/create-azure-ai-hub-template.md).

‎articles/ai-studio/includes/dependent-resources.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
title: include file
3+
description: include file
4+
author: Blackmist
5+
ms.reviewer: larryfr
6+
ms.author: larryfr
7+
ms.service: azure-ai-studio
8+
ms.topic: include
9+
ms.date: 02/09/2024
10+
ms.custom: include
11+
---
12+
13+
|Dependent Azure resource|Resource provider|Optional|Note|
14+
|---|---|:---:|---|
15+
| Azure AI Search|`Microsoft.Search/searchServices`|✔|Provides search capabilities for your projects.|
16+
|Azure Storage account|`Microsoft.Storage/storageAccounts`||Stores artifacts for your projects like flows and evaluations. For data isolation, storage containers are prefixed using the project GUID, and conditionally secured using Azure ABAC for the project identity.|
17+
|Azure Key Vault|`Microsoft.KeyVault/vaults`||Stores secrets like connection strings for your resource connections. For data isolation, secrets can't be retrieved across projects via APIs.|
18+
|Azure Container Registry|`Microsoft.ContainerRegistry/registries`|✔|Stores docker images created when using custom runtime for prompt flow. For data isolation, docker images are prefixed using the project GUID.|
19+
|Azure Application Insights &<br>Log Analytics Workspace| `Microsoft.Insights/components`<br>`Microsoft.OperationalInsights/workspaces` ||Used as log storage when you opt in for application-level logging for your deployed prompt flows.|
20+

‎articles/ai-studio/includes/resource-provider-kinds.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
title: include file
3+
description: include file
4+
author: Blackmist
5+
ms.reviewer: larryfr
6+
ms.author: larryfr
7+
ms.service: azure-ai-studio
8+
ms.topic: include
9+
ms.date: 02/09/2024
10+
ms.custom: include
11+
---
12+
13+
|Resource type|Resource provider|Kind|
14+
|---|---|---|
15+
|Azure AI hub resource and</br>Azure AI project|`Microsoft.MachineLearningServices/workspace`|`hub`</br>`project`|
16+
|Azure AI services *or*</br>Azure AI OpenAI Service|`Microsoft.CognitiveServices/account`|`AIServices`</br>`OpenAI`|

‎articles/ai-studio/media/concepts/azureai-hub-project-relationship.png

60.9 KB
Loading

‎articles/ai-studio/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@
88
- name: What are AI services?
99
href: ../ai-services/what-are-ai-services.md?context=/azure/ai-studio/context/context
1010
displayName: applied, cognitive, form recognizer
11+
- name: Azure AI Studio architecture
12+
href: concepts/architecture.md
1113
- name: Region support
1214
href: reference/region-support.md
1315
- name: What's new in Azure AI Studio?

0 commit comments

Comments
 (0)