You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/machine-learning/how-to-integrate-azure-policy.md
+44-31Lines changed: 44 additions & 31 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,7 +24,7 @@ As a platform administrator, you can use policies to lay out guardrails for team
24
24
25
25
Azure Machine Learning provides a set of policies that you can use for common scenarios with Azure Machine Learning. You can assign these policy definitions to your existing subscription or use them as the basis to create your own custom definitions.
26
26
27
-
The table below lists the built-in policies you can assign with Azure Machine Learning. For a complete list of the built-in policies for Azure services, see [Built-in policies](../governance/policy/samples/built-in-policies.md).
27
+
The table below lists the built-in policies you can assign with Azure Machine Learning. For a list of all Azure built-in policies, see [Built-in policies](../governance/policy/samples/built-in-policies.md).
### Compute instances should be recreated to get software updates
78
+
79
+
TBD
80
+
81
+
### Compute cluster and instance should be in a virtual network
82
+
83
+
Controls auditing of compute cluster and instance resources behind a virtual network.
84
+
85
+
To configure this policy, set the effect parameter to __audit__ or __disabled__. If set to __audit__, you can create a compute that is not configured behind a virtual network and a warning event is created in the activity log.
86
+
87
+
### Computes should have local authentication methods disabled.
88
+
89
+
Controls whether an Azure Machine Learning compute cluster or instance should disable local authentication (SSH).
73
90
91
+
To configure this policy, set the effect parameter to __audit__, __deny__, or __disabled__. If set to __audit__, you can create a compute with SSH enabled and a warning event is created in the activity log.
74
92
93
+
If the policy is set to __deny__, then you cannot create a compute unless SSH is disabled. Attempting to create a compute with SSH enabled results in an error. The error is also logged in the activity log. The policy identifier is returned as part of this error.
75
94
76
-
### Workspace encryption with customer-managed key
95
+
### Workspaces should be encrypted with customer-managed key
77
96
78
97
Controls whether a workspace should be encrypted with a customer-managed key, or using a Microsoft-managed key to encrypt metrics and metadata. For more information on using customer-managed key, see the [Azure Cosmos DB](concept-data-encryption.md#azure-cosmos-db) section of the data encryption article.
79
98
80
99
To configure this policy, set the effect parameter to __audit__ or __deny__. If set to __audit__, you can create a workspace without a customer-managed key and a warning event is created in the activity log.
81
100
82
101
If the policy is set to __deny__, then you cannot create a workspace unless it specifies a customer-managed key. Attempting to create a workspace without a customer-managed key results in an error similar to `Resource 'clustername' was disallowed by policy` and creates an error in the activity log. The policy identifier is also returned as part of this error.
83
102
84
-
### Workspace should use private link
103
+
### Workspaces should disable public network access
85
104
86
-
Controls whether a workspace should use Azure Private Link to communicate with Azure Virtual Network. For more information on using private link, see [Configure private link for a workspace](how-to-configure-private-link.md).
105
+
Controls whether a workspace should disable network access from the public internet.
87
106
88
-
To configure this policy, set the effect parameter to __audit__or __deny__. If set to __audit__, you can create a workspace without using private link and a warning event is created in the activity log.
107
+
To configure this policy, set the effect parameter to __audit__, __deny__, or __disabled__. If set to __audit__, you can create a workspace with public access and a warning event is created in the activity log.
89
108
90
-
If the policy is set to __deny__, then you cannot create a workspace unless it uses a private link. Attempting to create a workspace without a private link results in an error. The error is also logged in the activity log. The policy identifier is returned as part of this error.
109
+
If the policy is set to __deny__, then you cannot create a workspace that allows network access from the public internet.
91
110
92
-
### Workspace should use private endpoint
111
+
### Workspaces should enable V1LegacyMode to support network isolation backward compatibility
93
112
94
-
Configures a workspace to create a private endpoint within the specified subnet of an Azure Virtual Network.
113
+
TBD
95
114
96
-
To configure this policy, set the effect parameter to __DeployIfNotExists__. Set the __privateEndpointSubnetID__ to the Azure Resource Manager ID of the subnet.
115
+
### Workspace should use private link
97
116
98
-
### Workspace should use private DNS zones
117
+
Controls whether a workspace should use Azure Private Link to communicate with Azure Virtual Network. For more information on using private link, see [Configure private link for a workspace](how-to-configure-private-link.md).
99
118
100
-
Configures a workspace to use a private DNS zone, overriding the default DNS resolution for a private endpoint.
119
+
To configure this policy, set the effect parameter to __audit__ or __deny__. If set to __audit__, you can create a workspace without using private link and a warning event is created in the activity log.
101
120
102
-
To configure this policy, set the effect parameter to __DeployIfNotExists__. Set the __privateDnsZoneId__ to the Azure Resource Manager ID of the private DNS zone to use.
121
+
If the policy is set to __deny__, then you cannot create a workspace unless it uses a private link. Attempting to create a workspace without a private link results in an error. The error is also logged in the activity log. The policy identifier is returned as part of this error.
103
122
104
123
### Workspace should use user-assigned managed identity
105
124
@@ -109,42 +128,36 @@ To configure this policy, set the effect parameter to __audit__, __deny__, or __
109
128
110
129
If the policy is set to __deny__, then you cannot create a workspace unless you provide a user-assigned identity during the creation process. Attempting to create a workspace without providing a user-assigned identity results in an error. The error is also logged to the activity log. The policy identifier is returned as part of this error.
111
130
112
-
### Workspace should disable public network access
131
+
### Configure computes to Modify/disable local authentication
113
132
114
-
Controls whether a workspace should disable network access from the public internet.
133
+
Modifies any Azure Machine Learning compute cluster or instance creation request to disable local authentication (SSH).
115
134
116
-
To configure this policy, set the effect parameter to __audit__, __deny__, or __disabled__. If set to __audit__, you can create a workspace with public access and a warning event is created in the activity log.
135
+
To configure this policy, set the effect parameter to __Modify__or __Disabled__. If set __Modify__, any creation of a compute cluster or instance within the scope where the policy applies will automatically have local authentication disabled.
117
136
118
-
If the policy is set to __deny__, then you cannot create a workspace that allows network access from the public internet.
137
+
### Configure workspaces to use private DNS zones
119
138
120
-
### Computes should have local authentication methods disabled.
139
+
Configures a workspace to use a private DNS zone, overriding the default DNS resolution for a private endpoint.
121
140
122
-
Controls whether an Azure Machine Learning compute cluster or instance should disable local authentication (SSH).
141
+
To configure this policy, set the effect parameter to __DeployIfNotExists__. Set the __privateDnsZoneId__ to the Azure Resource Manager ID of the private DNS zone to use.
123
142
124
-
To configure this policy, set the effect parameter to __audit__, __deny__, or __disabled__. If set to __audit__, you can create a compute with SSH enabled and a warning event is created in the activity log.
143
+
### Configure workspaces to disable public network access
125
144
126
-
If the policy is set to __deny__, then you cannot create a compute unless SSH is disabled. Attempting to create a compute with SSH enabled results in an error. The error is also logged in the activity log. The policy identifier is returned as part of this error.
145
+
TBD
127
146
128
-
### Configure computes to Modify/disable local authentication
147
+
### Configure workspaces with private endpoints
129
148
130
-
Modifies any Azure Machine Learning compute cluster or instance creation request to disable local authentication (SSH).
149
+
Configures a workspace to create a private endpoint within the specified subnet of an Azure Virtual Network.
131
150
132
-
To configure this policy, set the effect parameter to __Modify__ or __Disabled__. If set __Modify__, any creation of a compute cluster or instance within the scope where the policy applies will automatically have local authentication disabled.
151
+
To configure this policy, set the effect parameter to __DeployIfNotExists__. Set the __privateEndpointSubnetID__ to the Azure Resource Manager ID of the subnet.
133
152
134
-
### Compute instances should have idle shutdown
153
+
### Configure diagnostic workspaces to send logs to log analytics workspaces
135
154
136
155
TBD
137
156
138
-
### Compute instances should be recreated to get software updates
157
+
### Resource logs in workspaces should be enabled
139
158
140
159
TBD
141
160
142
-
### Compute cluster and instance is behind virtual network
143
-
144
-
Controls auditing of compute cluster and instance resources behind a virtual network.
145
-
146
-
To configure this policy, set the effect parameter to __audit__ or __disabled__. If set to __audit__, you can create a compute that is not configured behind a virtual network and a warning event is created in the activity log.
0 commit comments