Merge pull request #51065 from Orin-Thomas/orthomas-20Jun25-A

First draft of restrict azure ML workspace module

Author: v-ccolin

learn-pr/advocates/restrict-azure-machine-learning-workspace-network/1-azure-machine-learning-managed-virtual-networks.yml

@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.restrict-azure-machine-learning-network-traffic.azure-machine-learning-managed-virtual-networks
+title: Azure Machine Learning managed virtual networks
+metadata:
+  title: Azure Machine Learning managed virtual networks
+  description: Understand Azure Machine Learning managed virtual networks.
+  ms.date: 06/20/2025
+  author: Orin-Thomas
+  ms.author: viniap
+  ms.topic: unit
+durationInMinutes: 3
+content: |
+  [!include[](includes/1-azure-machine-learning-managed-virtual-networks.md)]

learn-pr/advocates/restrict-azure-machine-learning-workspace-network/2-managed-network-isolation.yml

@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.restrict-azure-machine-learning-network-traffic.managed-network-isolation
+title: Managed Network isolation
+metadata:
+  title: Managed Network isolation
+  description: Understand how to use managed virtual networks in Azure Machine Learning.
+  ms.date: 06/20/2025
+  author: Orin-Thomas
+  ms.author: viniap
+  ms.topic: unit
+durationInMinutes: 2
+content: |
+  [!include[](includes/2-managed-network-isolation.md)]

learn-pr/advocates/restrict-azure-machine-learning-workspace-network/3-custom-network-isolation.yml

@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.restrict-azure-machine-learning-network-traffic.custom-network-isolation
+title: Custom network isolation
+metadata:
+  title: Custom network isolation
+  description: Learn how to isolate Azure Machine Learning workspaces in custom virtual networks.
+  ms.date: 06/20/2025
+  author: Orin-Thomas
+  ms.author: viniap
+  ms.topic: unit
+durationInMinutes: 2
+content: |
+  [!include[](includes/3-custom-network-isolation.md)]

learn-pr/advocates/restrict-azure-machine-learning-workspace-network/4-comparing-network-configurations.yml

@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.restrict-azure-machine-learning-network-traffic.comparing-network-configurations
+title: Comparing network configurations
+metadata:
+  title: Comparing network configurations
+  description: Understand the differences between managed virtual networks and private endpoints in Azure Machine Learning.
+  ms.date: 06/20/2025
+  author: Orin-Thomas
+  ms.author: viniap
+  ms.topic: unit
+durationInMinutes: 2
+content: |
+  [!include[](includes/4-comparing-network-configurations.md)]

learn-pr/advocates/restrict-azure-machine-learning-workspace-network/5-configure-managed-virtual-network-approved-outbound.yml

@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.restrict-azure-machine-learning-network-traffic.configure-managed-virtual-network-approved-outbound
+title: Configure managed virtual network approved outbound
+metadata:
+  title: Configure managed virtual network approved outbound
+  description: Learn how to configure approved outbound traffic for managed virtual networks in Azure Machine Learning.
+  ms.date: 06/20/2025
+  author: Orin-Thomas
+  ms.author: viniap
+  ms.topic: unit
+durationInMinutes: 6
+content: |
+  [!include[](includes/5-configure-managed-virtual-network-approved-outbound.md)]

learn-pr/advocates/restrict-azure-machine-learning-workspace-network/6-knowledge-check.yml

@@ -0,0 +1,47 @@
+### YamlMime:ModuleUnit
+uid: learn.restrict-azure-machine-learning-network-traffic.knowledge-check
+title: Knowledge Check
+metadata:
+  title: Knowledge Check
+  description: Test your knowledge of Azure Machine Learning managed virtual networks.
+  ms.date: 06/20/2025
+  author: Orin-Thomas
+  ms.author: viniap
+  ms.topic: unit
+durationInMinutes: 4
+content: Choose the best response for each question. 
+quiz:
+  questions:
+    - content: "You need to restrict the internet access of an Azure Machine Learning workspace. Which of the below will accomplish that?"
+      choices:
+        - content: "Configure the Azure virtual network for the Azure Machine Learning workspace to route all traffic to the on-premises network."
+          isCorrect: false
+          explanation: "Routing traffic to the on-premises network can be used to access on-premises resources but won't restrict internet access to the compute resources on an Azure Machine Learning workspace."
+        - content: "Set the isolation mode of the Azure Machine Learning workspace to allow_internet_outbound."
+          isCorrect: false
+          explanation: "The allow_internet_outbound setting enables compute resources on the Azure Machine Learning workspace to access the internet freely."
+        - content: "Set the isolation mode of the Azure Machine Learning workspace to allow_only_approved_outbound."
+          isCorrect: true
+          explanation: "The allow_only_approved_outbound setting restricts internet access from the compute resources in the Azure Machine Learning workspace to destinations allowed in the outbound rule."
+    - content: "Which statement from the below is a benefit of using Managed networks for isolation?"
+      choices:
+        - content: "Supports managed online endpoints."
+          isCorrect: true
+          explanation: "Managed networks support the utilization of managed online endpoints for real-time inferencing. Managed online endpoints are platform managed and require less administrative overhead."
+        - content: "Connect to on-premises resources."
+          isCorrect: false
+          explanation: "To connect to on-premises resources, you need to configure a custom virtual network or use a virtual network in between the managed network and the on-premises gateway."
+        - content: "Support for non-HTTP/S endpoint resources."
+          isCorrect: false
+          explanation: "Managed networks can only access HTTP/S endpoint resources."
+    - content: "As the cloud administrator of the Azure Machine Learning workspace, you receive a request from a data scientist to access the Python Package Index (PyPI) so the Azure Machine Learning workspace can access Python packages. As your workspace is configured to restrict access to the internet, how can you allow your data scientists to download these packages while staying compliant with your company's policies?"
+      choices:
+        - content: "Change the isolation mode of the Azure Machine Learning workspace to allow_internet_outbound."
+          isCorrect: false
+          explanation: "Changing the isolation mode to allow_internet_outbound allows for unrestricted internet access from the compute nodes."
+        - content: "Add a new entry to the outbound rule for a private endpoint."
+          isCorrect: false
+          explanation: "Service endpoints can be used for Azure resources."
+        - content: "Add a new entry to the outbound rule for an FQDN."
+          isCorrect: true
+          explanation: "You can add the domain of the website your compute nodes download packages from to the outbound rule."

learn-pr/advocates/restrict-azure-machine-learning-workspace-network/7-summary.yml

@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.restrict-azure-machine-learning-network-traffic.summary
+title: Summary
+metadata:
+  title: Summary
+  description: Review the key concepts of restricting network traffic in Azure Machine Learning workspaces.
+  ms.date: 06/20/2025
+  author: Orin-Thomas
+  ms.author: viniap
+  ms.topic: unit
+durationInMinutes: 1
+content: |
+  [!include[](includes/7-summary.md)]

learn-pr/advocates/restrict-azure-machine-learning-workspace-network/includes/1-azure-machine-learning-managed-virtual-networks.md

@@ -0,0 +1,11 @@
+Network isolation is a security strategy that involves dividing a network into separate segments or subnets, each functioning as its own small network. This approach helps to improve security and performance within a larger network structure. Major enterprises require network isolation to secure their resources from unauthorized access, tampering, or leakage of data and models. They also need to adhere to the regulations and standards that apply to their industry and domain. Managed virtual network isolation streamlines allows you to automate network isolation for Azure Machine Learning workspaces.
+
+Azure Machine Learning managed virtual networks secure your managed Azure Machine Learning resources, such as compute instances, compute clusters, serverless compute, and managed online endpoints.
+
+Network isolation must be considered in three areas within Azure Machine Learning:
+
+- Inbound access to the Azure Machine Learning workspace. For example, for your Data Scientists to securely access the workspace.
+- Outbound access from the Azure Machine Learning workspace. For example, to access other Azure services.
+- Outbound access from the Azure Machine Learning compute resources. For example, to access data sources, Python package repositories, or other resources.
+
+![Diagram showing inbound and outbound communication for Azure Machine Learning.](../media/inbound-outbound-communication.png)

learn-pr/advocates/restrict-azure-machine-learning-workspace-network/includes/2-managed-network-isolation.md

@@ -0,0 +1,6 @@
+Using a managed virtual network provides an easier configuration for network isolation. It automatically secures your workspace and managed compute resources in a managed virtual network. You can add private endpoint connections for other Azure services that the workspace relies on, such as Azure Storage Accounts. Depending on your needs, you can allow all outbound traffic to the public network or allow only the outbound traffic you approve. Outbound traffic required by the Azure Machine Learning service is automatically enabled for the managed virtual network. For outbound traffic, using a managed network provides two options:
+
+- **Allow internet outbound mode**: Use this option if you want to allow your machine learning engineers access the internet freely. You can create other private endpoint outbound rules to let them access your private resources on Azure.
+- **Allow only approved outbound mode**: Use this option if you want to minimize data exfiltration risk and control what your machine learning engineers can access. You can control outbound rules using private endpoint, service tag, and FQDN.
+
+![Diagram showing the contents of a managed virtual network.](../media/managed-virtual-network.svg)

learn-pr/advocates/restrict-azure-machine-learning-workspace-network/includes/3-custom-network-isolation.md

@@ -0,0 +1,14 @@
+If a managed virtual network doesn't suit your needs, you can configure and manage an Azure virtual network to implement network isolation. 
+
+![Diagram of a custom network isolation configuration.](../media/custom-network-isolation.png)
+
+For scenarios using custom network isolation, Microsoft recommends the following best practices:
+
+- Put all resources in the same region.
+- A hub virtual network, which contains your firewall and custom DNS set-up.
+- A spoke virtual network, which contains the following resources:
+  - A training subnet contains compute instances and clusters used for training ML models. These resources are configured for no public IP.
+  - A scoring subnet contains an AKS cluster.
+  - A 'PE' subnet contains private endpoints that connect to the workspace and private resources used by the workspace (storage, key vault, container registry, etc.)
+
+Custom virtual networks aren't recommended as misconfigurations are more likely to occur compared to managed virtual networks.