You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Master the art of safeguarding sensitive data and enforcing governance for AI workloads on Azure. This learning path is crafted for IT and security professionals tasked with maintaining data protection and compliance in AI environments. Discover how to prevent data exfiltration and apply governance policies that ensure consistent, secure AI deployments. Learn to combine technical controls with strategic oversight to create resilient, policy-driven AI architectures that align with organizational and regulatory standards.
6
+
ms.date: 07/08/2025
7
+
author: vrapolinario
8
+
ms.author: viniap
9
+
ms.topic: learning-path
10
+
title: AI workload governance and DLP
11
+
prerequisites: |
12
+
- Experience navigating the Azure portal
13
+
- Familiarity with Microsoft Azure Networking
14
+
- Basic AI knowledge and familiarity with AI services on Azure
15
+
summary: |
16
+
AI workloads require not just performance—but precision in governance and data protection. This learning path guides Cloud Administrators through the essentials of data loss prevention (DLP) and AI policy governance in Azure. You’ll explore techniques to restrict data movement and enforce guardrails using Azure Policy. By the end of these modules, you'll be equipped to implement robust governance strategies that protect sensitive information and ensure responsible use of AI at scale.
description: Strengthen your command over securing network access for AI workloads in Azure. This learning path is tailored for Cloud Administrators and IT professionals looking to enforce precise access controls and ensure isolation of sensitive AI resources. Learn how to implement private endpoints, configure virtual networks, and restrict exposure of Azure AI services and Azure Machine Learning workspaces. Whether you're designing robust hybrid networks or hardening cloud-native architectures, this path empowers you with practical skills to safeguard your AI infrastructure in today's security-first digital landscape.
6
+
ms.date: 07/08/2025
7
+
author: vrapolinario
8
+
ms.author: viniap
9
+
ms.topic: learning-path
10
+
title: Manage Network Access for AI workloads
11
+
prerequisites: |
12
+
- Experience navigating the Azure portal
13
+
- Familiarity with Microsoft Azure Networking
14
+
- Basic AI knowledge and familiarity with AI services on Azure
15
+
summary: |
16
+
Managing AI workloads requires more than just compute and storage—it demands secure and well-architected network access. This learning path equips you with the knowledge to configure virtual network integration, secure access to Azure AI endpoints, and implement network-layer security controls. By the end of these modules, you'll be prepared to design and deploy AI solutions with confidence, minimizing exposure and maximizing control over your networked environments.
Copy file name to clipboardExpand all lines: learn-pr/wwl-azure/design-governance/includes/2-design-for-governance.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,7 @@
1
1
[Governance](/azure/cloud-adoption-framework/govern/guides/) provides mechanisms and processes to maintain control over your applications and resources in Azure. Governance involves determining your requirements, planning your initiatives, and setting strategic priorities.
To effectively apply your governance strategies, you must first create a hierarchical structure for your organizational environment. This structure lets you apply governance strategies exactly where they're needed. The governance strategies we cover in this module are Azure policy and resource tags.
4
6
5
7
:::image type="content" source="../media/governance-strategies.png" alt-text="Diagram of the Azure hierarchy that shows the tenant root group, management groups, subscriptions, resource groups, and resources." border="false":::
@@ -15,4 +17,4 @@ A typical Azure hierarchy has four levels: management groups, subscriptions, res
15
17
-**Resources** are instances of services that you create. For example, virtual machines, storage, and SQL databases.
16
18
17
19
> [!NOTE]
18
-
> The **tenant root group** contains all the management groups and subscriptions. This group allows global policies and Azure role assignments to be applied at the directory level.
20
+
> The **tenant root group** contains all the management groups and subscriptions. This group allows global policies and Azure role assignments to be applied at the directory level.
Copy file name to clipboardExpand all lines: learn-pr/wwl-azure/design-governance/includes/4-design-for-subscriptions.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,7 @@
1
1
Azure Subscriptions are logical containers that serve as units of management and scale and billing boundaries. Limits and quotas can be applied, and each organization can use subscriptions to manage costs and resources by group.
To use Azure, you must have an Azure subscription. A subscription provides you with a logical container to create and pay for Azure products and services. There are [several types of subscriptions](https://azure.microsoft.com/support/legal/offer-details/), such as Enterprise Agreement and Pay-As-You-Go.
Copy file name to clipboardExpand all lines: learn-pr/wwl-azure/design-governance/includes/6-design-for-resource-tags.md
+7-5Lines changed: 7 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,9 @@
1
1
[Resource tags](/azure/azure-resource-manager/management/tag-resources?tabs=json) are another way to organize resources. Tags provide extra information, or metadata, about your resources.
> Before you start a resource tagging project, ask yourself what you want to accomplish. Will reporting or billing use tags? Can you use the tags to enable more effective searching for Tailwind Traders? Will automated scripts use tags? Be sure to clearly define your goals.
6
+
> Before you start a resource tagging project, ask yourself what you want to accomplish. Can you use the tags to enable more effective searching for Tailwind Traders? Do automated scripts use tags? Be sure to clearly define your goals.
5
7
6
8
### Things to know about resource tags
7
9
@@ -13,15 +15,15 @@ As you plan the governance strategy for Tailwind Traders, consider these charact
13
15
14
16
- Resource tags can be added, modified, and deleted. These actions can be done with PowerShell, the Azure CLI, Azure Resource Manager (ARM) templates, the REST API, or the Azure portal.
15
17
16
-
-[Tags can be applied](/azure/azure-resource-manager/management/tag-resources) to a resource group. However, tags applied to a resource group aren't inherited by the resources in the group.
18
+
-[Tags can be applied](/azure/azure-resource-manager/management/tag-resources) to a resource group. However, tags applied to a resource group aren't inherited.
17
19
18
20
### Things to consider when creating resource tags
19
21
20
22
You created the organizational hierarchy for Tailwind Traders. Now you need to determine which resource tags to apply.
21
23
22
24
:::image type="content" source="../media/resource-tags.png" alt-text="Diagram that shows an example hierarchy of resource tags." border="false":::
23
25
24
-
-**Consider your organization's taxonomy**. Align your resource tags with accepted department nomenclature to make it easier to understand. Are there recognized terms for compliance or cost reporting for the Tailwind Traders organization? Add tags for office locations, confidentiality levels, or other defined policies.
26
+
-**Consider your organization's taxonomy**. Align your resource tags with accepted department nomenclature. Are there recognized terms for compliance or cost reporting for the Tailwind Traders organization? Add tags for office locations, confidentiality levels, or other defined policies.
25
27
26
28
-**Consider whether you need IT-aligned or business-aligned tagging**. Implement IT-aligned tagging or business-aligned tagging, or a combination of these approaches to be most effective.
27
29
@@ -40,7 +42,7 @@ You created the organizational hierarchy for Tailwind Traders. Now you need to d
40
42
| Tag type | Description | Example name-value pairs |
41
43
| --- | --- | --- |
42
44
|**Functional**| Functional tags categorize resources according to their purpose within a workload. This tag shows the deployed environment for a resource, or other functionality and operational details. | - `app = catalogsearch1` <br> - `tier = web` <br> - `webserver = apache` <br> - `env = production, dev, staging`|
43
-
|**Classification**| Classification tags identify a resource by how it's used and what policies apply to it. | - `confidentiality = private` <br> - `SLA = 24hours`|
|**Accounting**| Accounting tags allow a resource to be associated with specific groups within an organization for billing purposes. | - `department = finance` <br> - `program = business-initiative` <br> - `region = northamerica`|
45
47
|**Partnership**| Partnership tags provide information about the people (other than IT members) who are associated with a resource, or otherwise affected by the resource. | - `owner = jsmith` <br> - `contactalias = catsearchowners` <br> - `stakeholders = user1;user2;user3`|
46
48
|**Purpose**| Purpose tags align resources to business functions to better support investment decisions. | - `businessprocess = support` <br> - `businessimpact = moderate` <br> - `revenueimpact = high`|
@@ -52,4 +54,4 @@ You created the organizational hierarchy for Tailwind Traders. Now you need to d
52
54
-**Consider which resources require tagging**. Keep in mind that you don't need to enforce that a specific tag is present on all Tailwind Traders resources. You might decide that only mission-critical resources have the `Impact` tag. All nontagged resources would then not be considered as mission critical.
53
55
54
56
> [!NOTE]
55
-
> To implement an effective resource tagging structure, be sure to seek input from the different stakeholders in your organization.
57
+
> To implement an effective resource tagging structure, be sure to seek input from the different stakeholders in your organization.
Copy file name to clipboardExpand all lines: learn-pr/wwl-azure/design-governance/includes/7-design-for-azure-policy.md
+3Lines changed: 3 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,8 @@
1
1
[Azure Policy](https://azure.microsoft.com/services/azure-policy) is a service in Azure that enables you to create, assign, and manage policies to control or audit your resources. These policies enforce different rules over your resource configurations so the configurations stay compliant with corporate standards.
Copy file name to clipboardExpand all lines: learn-pr/wwl-azure/design-governance/includes/8-design-for-role-based-access-control.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
[Azure RBAC](/azure/role-based-access-control/overview) allows you to grant access to Azure resources that you control. Azure RBAC evaluates each request for access and determines if access should be blocked, not allowed, or allowed.
2
2
3
-
:::image type="content" source="../media/role-based-access-control-flowchart.png" alt-text="Diagram of an RBAC decision tree that shows the flow from no access to access allowed." border="false":::
RBAC is an allow model. An _allow model_ means when a user is assigned a specific role, Azure RBAC allows the user to perform the actions associated with that role. A role assignment could grant a user read permissions to a resource group. To have write permissions, the role would need to explicitly allow write access.
0 commit comments