Merge pull request #225829 from Blackmist/firewall-service-tag

updates

Author: prmerger-automator[bot]

articles/machine-learning/how-to-access-azureml-behind-firewall.md

@@ -28,7 +28,9 @@ The following terms and information are used throughout this article:
 * __Azure service tags__: A service tag is an easy way to specify the IP ranges used by an Azure service. For example, the `AzureMachineLearning` tag represents the IP addresses used by the Azure Machine Learning service.
 
     > [!IMPORTANT]
-    > Azure service tags are only supported by some Azure services. If you are using a non-Azure solution such as a 3rd party firewall, download a list of [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519). Extract the file and search for the service tag within the file. The IP addresses may change periodically.
+    > Azure service tags are only supported by some Azure services. For a list of service tags supported with network security groups and Azure Firewall, see the [Virtual network service tags](/azure/virtual-network/service-tags-overview) article.
+    > 
+    > If you are using a non-Azure solution such as a 3rd party firewall, download a list of [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519). Extract the file and search for the service tag within the file. The IP addresses may change periodically.
 
 * __Region__: Some service tags allow you to specify an Azure region. This limits access to the service IP addresses in a specific region, usually the one that your service is in. In this article, when you see `<region>`, substitute your Azure region instead. For example, `BatchNodeManagement.<region>` would be `BatchNodeManagement.uswest` if your Azure Machine Learning workspace is in the US West region.
 
@@ -354,6 +356,7 @@ __Azure Machine Learning compute instance and compute cluster hosts__
 > * The host for __Azure Key Vault__ is only needed if your workspace was created with the [hbi_workspace](/python/api/azure-ai-ml/azure.ai.ml.entities.workspace) flag enabled.
 > * Ports 8787 and 18881 for __compute instance__ are only needed when your Azure Machine workspace has a private endpoint.
 > * In the following table, replace `<storage>` with the name of the default storage account for your Azure Machine Learning workspace.
+> * In the following table, replace `<region>` with the Azure region that contains your Azure Machine Learning workspace.
 > * Websocket communication must be allowed to the compute instance. If you block websocket traffic, Jupyter notebooks won't work correctly.
 
 # [Azure public](#tab/public)
@@ -363,7 +366,7 @@ __Azure Machine Learning compute instance and compute cluster hosts__
 | Compute cluster/instance | `graph.windows.net` | TCP | 443 |
 | Compute instance | `*.instances.azureml.net` | TCP | 443 |
 | Compute instance | `*.instances.azureml.ms` | TCP | 443, 8787, 18881 |
-| Compute instance | `*.tundra.azureml.ms` | UDP | 5831 |
+| Compute instance | `<region>.tundra.azureml.ms` | UDP | 5831 |
 | Compute instance | `*.batch.azure.com` | ANY | 443 |
 | Compute instance | `*.service.batch.com` | ANY | 443 | 
 | Microsoft storage access | `*.blob.core.windows.net` | TCP | 443 |
@@ -380,6 +383,7 @@ __Azure Machine Learning compute instance and compute cluster hosts__
 | Compute cluster/instance | `graph.windows.net` | TCP | 443 |
 | Compute instance | `*.instances.azureml.us` | TCP | 443 |
 | Compute instance | `*.instances.azureml.ms` | TCP | 443, 8787, 18881 |
+| Compute instance | `<region>.tundra.azureml.us` | UDP | 5831 |
 | Microsoft storage access | `*.blob.core.usgovcloudapi.net` | TCP | 443 |
 | Microsoft storage access | `*.table.core.usgovcloudapi.net` | TCP | 443 |
 | Microsoft storage access | `*.queue.core.usgovcloudapi.net` | TCP | 443 |
@@ -394,6 +398,7 @@ __Azure Machine Learning compute instance and compute cluster hosts__
 | Compute cluster/instance | `graph.chinacloudapi.cn` | TCP | 443 |
 | Compute instance |  `*.instances.azureml.cn` | TCP | 443 |
 | Compute instance | `*.instances.azureml.ms` | TCP | 443, 8787, 18881 |
+| Compute instance | `<region>.tundra.azureml.cn` | UDP | 5831 |
 | Microsoft storage access | `*.blob.core.chinacloudapi.cn` | TCP | 443 |
 | Microsoft storage access | `*.table.core.chinacloudapi.cn` | TCP | 443 |
 | Microsoft storage access | `*.queue.core.chinacloudapi.cn` | TCP | 443 |

articles/machine-learning/how-to-secure-training-vnet.md

@@ -106,7 +106,7 @@ In this article you learn how to secure the following training compute resources
 
 The following configurations are in addition to those listed in the [Prerequisites](#prerequisites) section, and are specific to **creating** a compute instances/clusters configured for no public IP:
 
-+ Your workspace must use a private endpoint to connect to the VNet. For more information, see [Configure a private endpoint for Azure Machine Learning workspace](how-to-configure-private-link.md).
++ You must use a workspace private endpoint for the compute resource to communicate with Azure Machine Learning services from the VNet. For more information, see [Configure a private endpoint for Azure Machine Learning workspace](how-to-configure-private-link.md).
 
 + In your VNet, allow **outbound** traffic to the following service tags or fully qualified domain names (FQDN):
 
@@ -137,6 +137,8 @@ The following configurations are in addition to those listed in the [Prerequisit
     - [Configure inbound and outbound network traffic](how-to-access-azureml-behind-firewall.md).
     - [Azure's outbound connectivity methods](/azure/load-balancer/load-balancer-outbound-connections#scenarios).
 
+    For more information on service tags that can be used with Azure Firewall, see the [Virtual network service tags](/azure/virtual-network/service-tags-overview) article.
+
 Use the following information to create a compute instance or cluster with no public IP address:
 
 # [Azure CLI](#tab/cli)

articles/machine-learning/v1/how-to-secure-training-vnet.md

@@ -116,7 +116,7 @@ For more information on using Azure Databricks in a virtual network, see [Deploy
 
 The following configurations are in addition to those listed in the [Prerequisites](#prerequisites) section, and are specific to **creating** a compute instances/clusters configured for no public IP:
 
-+ Your workspace must use a private endpoint to connect to the VNet. For more information, see [Configure a private endpoint for Azure Machine Learning workspace](how-to-configure-private-link.md).
++ You must use a workspace private endpoint for the compute resource to communicate with Azure Machine Learning services from the VNet. For more information, see [Configure a private endpoint for Azure Machine Learning workspace](how-to-configure-private-link.md).
 
 + In your VNet, allow **outbound** traffic to the following service tags or fully qualified domain names (FQDN):