You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/advocates/intro-azure-machine-learning-auth/5-knowledge-check.yml
+8-8Lines changed: 8 additions & 8 deletions
Original file line number
Diff line number
Diff line change
@@ -19,22 +19,22 @@ quiz:
19
19
explanation: "Access between Azure resources (including Azure Machine Learning) use managed-identities which is a feature of Microsoft Entra ID"
20
20
- content: "When Azure Machine Learning compute clusters or Kubernetes clusters access other Azure services."
21
21
isCorrect: false
22
-
explanation: "Azure Machine Learning compute clusters or Kubernetes clusters use managed-identities which is a feature of Entra ID"
22
+
explanation: "Azure Machine Learning compute clusters or Kubernetes clusters use managed-identities which are a feature of Entra ID"
23
23
- content: "When account keys or tokens are used for access to external data sources."
24
24
isCorrect: true
25
25
explanation: "In cases on which the data source only accepts credential-based authentication, Azure Machine Learning can use Azure Key Vault to store these secrets"
26
-
- content: "Which Azure Machine Learning default role should you assign to someone who will be responsible for the compute resources in a workspace?"
26
+
- content: "Which Azure Machine Learning default role should you assign to someone who is responsible for the compute resources in a workspace?"
27
27
choices:
28
28
- content: "Contributor."
29
29
isCorrect: false
30
-
explanation: "While contributors can create and delete compute resources in a workspace, they also have additional permissions. Granting Contributor access to someone who is responsible to for the compute resources might pose a security risk"
explanation: "Contributors can create and delete compute resources in a workspace and also have additional permissions. Granting Contributor access to someone who is responsible to for the compute resources might pose a security risk"
31
+
- content: "AzureML Compute Operator."
32
32
isCorrect: true
33
-
explanation: "Azure Machine Learning Compute Operators can only create, manage, delete, and access compute resources within a workspace"
34
-
- content: "Azure Machine Learning Data Scientist."
33
+
explanation: "Users assigned the AzureML Compute Operator role can only create, manage, delete, and access compute resources within a workspace"
34
+
- content: "AzureML Data Scientist."
35
35
isCorrect: false
36
-
explanation: "Azure Machine Learning Data Scientists can perform all actions within an Azure Machine Learning workspace, except for creating or deleting compute resources and modifying the workspace itself."
37
-
- content: "Which of the following statements is true regarding system-assigned managed identify for Azure Machine Learning?"
36
+
explanation: "Users assigned the AzureML Data Scientist role can perform all actions within an Azure Machine Learning workspace, except for creating or deleting compute resources and modifying the workspace itself."
37
+
- content: "Which of the following statements is true regarding system-assigned managed identity for Azure Machine Learning?"
38
38
choices:
39
39
- content: "When that workspace is deleted, its associated system-assigned identity is also deleted."
Copy file name to clipboardExpand all lines: learn-pr/advocates/intro-azure-machine-learning-auth/includes/2-authentication-azure-machine-learning-workspaces.md
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,24 +7,24 @@ Authentication in Azure Machine Learning workspaces can use Microsoft Entra ID o
7
7
8
8
Users authenticate to an Azure Machine Learning workspace using one of the following methods:
9
9
10
-
**Interactive**: Users can leverage their Microsoft Entra ID to either directly authenticate, or to get a token that is used for authentication. Interactive authentication is used during experimentation and iterative development. Interactive authentication enables you to control access to resources (such as a web service) on a per-user basis.
10
+
-**Interactive**: Users can leverage their Microsoft Entra ID to either directly authenticate, or to get a token that is used for authentication. Interactive authentication is used during experimentation and iterative development. Interactive authentication enables you to control access to resources (such as a web service) on a per-user basis.
11
11
12
-
**Service principal**: Service principal accounts in Microsoft Entra ID can be used by services to authenticate or get a token. A service principal is used to authenticate an automated process to the service without requiring user interaction. For example, a continuous integration and deployment script that trains and tests a model every time the training code changes.
12
+
-**Service principal**: Service principal accounts in Microsoft Entra ID can be used by services to authenticate or get a token. A service principal is used to authenticate an automated process to the service without requiring user interaction. For example, a continuous integration and deployment script that trains and tests a model every time the training code changes.
13
13
14
-
**Azure CLI session**: The Azure CLI extension for Machine Learning (the ml extension or CLI v2) is a command line tool for working with Azure Machine Learning. Users can sign in to Azure via the Azure CLI on their local workstation, without storing credentials in Python code or prompting them to authenticate. Similarly, users can reuse the same scripts as part of continuous integration and deployment pipelines, while authenticating the Azure CLI with a service principal identity.
14
+
-**Azure CLI session**: The Azure CLI extension for Machine Learning (the ml extension or CLI v2) is a command line tool for working with Azure Machine Learning. Users can sign in to Azure via the Azure CLI on their local workstation, without storing credentials in Python code or prompting them to authenticate. Similarly, users can reuse the same scripts as part of continuous integration and deployment pipelines, while authenticating the Azure CLI with a service principal identity.
15
15
16
-
**Managed identity**: When using the Azure Machine Learning SDK v2 on a compute instance or on an Azure Virtual Machine, users can use a managed identity for Azure. This workflow allows the VM to connect to the workspace using the managed identity, without storing credentials in Python code or prompting the user to authenticate. Azure Machine Learning compute clusters can also be configured to use a managed identity to access the workspace when training models. Whenever possible, using a managed identity is the preferred method and best practice.
16
+
-**Managed identity**: When using the Azure Machine Learning SDK v2 on a compute instance or on an Azure Virtual Machine, users can use a managed identity for Azure. This workflow allows the VM to connect to the workspace using the managed identity, without storing credentials in Python code or prompting the user to authenticate. Azure Machine Learning compute clusters can also be configured to use a managed identity to access the workspace when training models. Whenever possible, using a managed identity is the preferred method and best practice.
17
17
18
18
You can use Microsoft Entra Conditional Access to further control or restrict access to the workspace for each authentication workflow. For example, you can configure conditional access so that an administrator is only able to access an Azure Machine Learning workspace from a managed device.
19
19
20
20
Azure Machine Learning can authenticate with other services using the following methods:
21
21
22
-
Data access can happen along multiple paths depending on the data storage service and your configuration. For example, authentication to the datastore can use an account key, token, security principal, managed identity, or user identity.
22
+
-Data access can happen along multiple paths depending on the data storage service and your configuration. For example, authentication to the datastore can use an account key, token, security principal, managed identity, or user identity.
23
23
24
-
Azure Machine Learning workspaces use a managed identity to communicate with other Azure services. By default, this is a system-assigned managed identity, but you can also configure an Azure Machine Learning workspace with a user-assigned managed identity.
24
+
-Azure Machine Learning workspaces use a managed identity to communicate with other Azure services. By default, this is a system-assigned managed identity, but you can also configure an Azure Machine Learning workspace with a user-assigned managed identity.
25
25
26
-
Azure Machine Learning uses Azure Container Registry (ACR) to store container images used to train and deploy models. If you allow Azure Machine Learning to automatically create an ACR registry, it enables the **admin account** for that registry.
26
+
-Azure Machine Learning uses Azure Container Registry (ACR) to store container images used to train and deploy models. If you allow Azure Machine Learning to automatically create an ACR registry, it enables the **admin account** for that registry.
27
27
28
-
The Azure Machine Learning compute cluster uses a **managed identity** to retrieve connection information for datastores from Azure Key Vault and to pull container images from ACR. You can also configure identity-based access to datastores, which will instead use the managed identity of the compute cluster.
28
+
-The Azure Machine Learning compute cluster uses a **managed identity** to retrieve connection information for datastores from Azure Key Vault and to pull container images from ACR. You can also configure identity-based access to datastores, which will instead use the managed identity of the compute cluster.
29
29
30
-
Managed online endpoints can use a managed identity to access Azure resources when performing inference.
30
+
-Managed online endpoints can use a managed identity to access Azure resources when performing inference.
Copy file name to clipboardExpand all lines: learn-pr/advocates/intro-azure-machine-learning-auth/includes/3-manage-access-azure-machine-learning.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,24 +8,24 @@ The roles related to Azure Machine Learning workspaces are as follows.
8
8
9
9
|**Role**|**Access level**|
10
10
|---|---|
11
-
|**Azure Machine Learning Data Scientist**| Can perform all actions within an Azure Machine Learning workspace, except for creating or deleting compute resources and modifying the workspace itself. |
12
-
|**Azure Machine Learning Compute Operator**| Can create, manage, delete, and access compute resources within a workspace. |
11
+
|**AzureML Data Scientist**| Can perform all actions within an Azure Machine Learning workspace, except for creating or deleting compute resources and modifying the workspace itself. |
12
+
|**AzureML Compute Operator**| Can create, manage, delete, and access compute resources within a workspace. |
13
13
|**Reader**| Read-only actions in the workspace. Readers can list and view assets, including [datastore](/azure/machine-learning/how-to-access-data) credentials, in a workspace. Readers can't create or update these assets. |
14
14
|**Contributor**| View, create, edit, or delete (where applicable) assets in a workspace. For example, contributors can create an experiment, create or attach a compute cluster, submit a run, and deploy a web service. |
15
15
|**Owner**| Full access to the workspace, including the ability to view, create, edit, or delete (where applicable) assets in a workspace. Additionally, you can change role assignments. |
16
-
|**Azure Machine Learning Registry User**| Can get registries and read, write, and delete assets within them. Can't create new registry resources or delete them. |
16
+
|**AzureML Registry User**| Can get registries and read, write, and delete assets within them. Can't create new registry resources or delete them. |
17
17
18
18
If the permissions assigned to the built-in roles are insufficient or do not meet your needs, you can create custom roles. Custom roles might possess read, write, delete, and compute resource permissions in that workspace. You can make the custom role available at a specific workspace level, a specific resource group level, or a specific subscription level.
19
19
20
20
When you create an Azure Machine Learning workspace, you're automatically assigned the role of Owner for that resource. As an owner, you can add and remove roles for the workspace, and assign roles to users or groups.
21
21
22
22
As a best practice, you can use Microsoft Entra security groups to manage access to workspaces. You assign the RBAC role to an Entra security group and then manage which security principals have the role by managing membership of the group. This approach has the following benefits:
23
23
24
-
You can assign project leaders group ownership permissions. This means they can manage user access to workspace, without needing Owner role on the workspace resource directly.
24
+
-You can assign project leaders group ownership permissions. This means they can manage user access to workspace, without needing Owner role on the workspace resource directly.
25
25
26
-
You can organize, manage, and revoke users' permissions on workspace and other resources as a group, without having to manage permissions on user-by-user basis. This also makes it simpler to audit the permissions held as it's only a matter of determining group membership.
26
+
-You can organize, manage, and revoke users' permissions on workspace and other resources as a group, without having to manage permissions on user-by-user basis. This also makes it simpler to audit the permissions held as it's only a matter of determining group membership.
27
27
28
-
Using Microsoft Entra groups helps you to avoid reaching the subscription limit on role assignments.
28
+
-Using Microsoft Entra groups helps you to avoid reaching the subscription limit on role assignments.
29
29
30
30
To assign the Azure Machine Learning Data Scientist role, perform the following steps:
Copy file name to clipboardExpand all lines: learn-pr/advocates/intro-azure-machine-learning-auth/includes/4-authentication-between-azure-machine-learning-other-azure-services.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,9 +18,9 @@ Once a workspace is created with SAI identity type, it can be updated to SAI+UAI
18
18
19
19
Choosing between system-assigned and user-assigned identities depends on your specific needs and how your company manages Azure resources:
20
20
21
-
**System-assigned identities** are created and managed by Azure for a specific resource. When a resource is deleted, its associated system-assigned identity is also deleted, ensuring that the identity lifecycle is tightly coupled with the resource it belongs to. This type of identity is ideal for scenarios where the identity only needs to be used by a single resource, providing simplicity and reducing the administrative overhead since Azure manages the identity's credentials.
21
+
-**System-assigned identities** are created and managed by Azure for a specific resource. When a resource is deleted, its associated system-assigned identity is also deleted, ensuring that the identity lifecycle is tightly coupled with the resource it belongs to. This type of identity is ideal for scenarios where the identity only needs to be used by a single resource, providing simplicity and reducing the administrative overhead since Azure manages the identity's credentials.
22
22
23
-
**User-assigned identities** are created independently of any specific resource and can be shared across multiple resources. This makes them highly versatile for applications that require a consistent identity across different resources, enabling easier management of permissions and access controls. User-assigned identities persist even after the resources using them are deleted, allowing for greater flexibility in redeploying and reusing identities.
23
+
-**User-assigned identities** are created independently of any specific resource and can be shared across multiple resources. This makes them highly versatile for applications that require a consistent identity across different resources, enabling easier management of permissions and access controls. User-assigned identities persist even after the resources using them are deleted, allowing for greater flexibility in redeploying and reusing identities.
24
24
25
25
### User-assigned managed identity specific configuration ###
description: Implement inheritance and polymorphism
6
+
ms.date: 03/10/2025
7
+
author: wwlpublish
8
+
ms.author: cahowd
9
+
ms.topic: learning-path
10
+
title: Implement inheritance and polymorphism
11
+
prerequisites: |
12
+
- An installation of Visual Studio Code with the C# Dev Kit extension installed.
13
+
- The ability to develop basic object-oriented program in C# that implement classes with properties and methods.
14
+
- The ability to create interfaces that define a contract for the classes implemented by an object-oriented program written in C#.
15
+
summary: |
16
+
Learn how to create class hierarchies using base and derived classes and how to implement polymorphic behavior by using either class inheritance or interface implementation.
0 commit comments