Use System-Assigned Managed Identities for Azure Machine Learning Workspaces

01 Sign in to the Azure Management Console.

02 Navigate to Azure Machine Learning workspaces blade at https://portal.azure.com/#browse/Microsoft.MachineLearningServices%2Fworkspaces.

03 Select the Azure subscription that you want to examine from the Subscription filter box.

04 Click on the name (link) of the Azure Machine Learning workspace that you want to examine.

05 In the main navigation panel, select Overview, and choose JSON View under Essentials to access the workspace configuration information available in JSON format.

06 On the Resource JSON panel, check for the "identity.type" configuration attribute value in the resource configuration object, to determine the type of the managed identity configured for the selected workspace. If the "identity.type" attribute value is set to "UserAssigned", the selected Azure Machine Learning (ML) workspace is not using a system-assigned managed identity to authenticate to other cloud services.

07 Repeat steps no. 4 – 6 for each Azure Machine Learning workspace available within the selected subscription.

08 Repeat steps no. 3 – 7 for each subscription created in your Microsoft Azure cloud account.

01 Run ml workspace list command (Windows/macOS/Linux) with custom query filters to list the name and the associated resource group for each Azure Machine Learning workspace available in the current subscription:

az ml workspace list
  --output table
  --query '[*].{name:name, resourceGroup:resourceGroup}'

02 The command output should return the requested Azure Machine Learning workspace identifiers:

Name                           ResourceGroup
------------------------       ------------------------------
tm-ml-project5-workspace       cloud-shell-storage-westeurope
tm-ml-production-workspace     cloud-shell-storage-westeurope

03 Run ml workspace show command (Windows/macOS/Linux) with the name of the Azure Machine Learning workspace that you want to examine as the identifier parameter and custom output filters to determine the type of the managed identity configured for the selected workspace:

az ml workspace show
  --name tm-ml-project5-workspace
  --resource-group cloud-shell-storage-westeurope
  --query 'identity.type'

04 The command output should return the identity type used (system-assigned or user-assigned):

"user_assigned"

05 Repeat step no. 3 and 4 for each Azure Machine Learning workspace available in the selected Azure subscription.

06 Repeat steps no. 1 – 5 for each subscription created in your Microsoft Azure cloud account.

01 Sign in to the Azure Management Console.

02 Navigate to Azure Machine Learning workspaces blade at https://portal.azure.com/#browse/Microsoft.MachineLearningServices%2Fworkspaces.

03 Select the Azure subscription that you want to access from the Subscription equals all filter box, and choose Apply.

04 Choose Create, select New workspace, and perform the following actions to create your new Azure Machine Learning workspace:

1. For Basics, provide the following information:
   1. For Subscription, choose your Azure subscription.
   2. For Resource group, select the correct resource group.
   3. Provide a unique name for the workspace in the Name box.
   4. For Region, select the Azure cloud region where the workspace will be deployed.
   5. For Storage account, choose the storage account that is used as the default datastore for the workspace.
   6. For Key vault, select the key vault used to store secrets and other sensitive information required by the workspace.
   7. For Application insights, choose whether to enable the Application Insights monitoring feature. You can create a new Azure Application Insights resource or select an existing one from your subscription.
   8. For Container registry, select the container registry used to register docker images used in training and deployments.
   9. Choose Next : Networking to continue the workspace setup process.
2. For Networking, choose the type of network isolation that you need for your workspace. Choose Next : Encryption to continue the setup.
3. For Encryption, perform the following actions:
   1. For Encryption type, choose Customer-managed keys to use your own Customer-Managed Key (CMK) for data encryption (recommended).
   2. For Key vault, choose Click to select the key, and select the appropriate key vault and Customer-Managed Key (CMK).
   3. Choose Next : Identity to continue.
4. For Identity, perform the following operations:
   1. Choose System assigned identity for Identity type under Managed identity. A system-assigned managed identity enables the selected Azure Machine (ML) Learning workspace to authenticate to other cloud services without storing credentials in code.
   2. Select Identity-based access for Storage account access type under Storage account access.
   3. Under Data impact, check the High business impact workspace setting checkbox if you need to enable the High Business Impact (HBI) feature for your workspace.
   4. Choose Next : Tags to continue the setup.
5. For Tags, use the Name and Value fields to create tags that will help organize the identity of the workspace. Choose Next : Review + create to validate the workspace setup.
6. For Review + create, review the resource configuration details, then choose Create to create your new Azure Machine Learning workspace.

05 Repeat step no. 4 for each workspace that you want to re-create, available within the selected Azure subscription.

06 Repeat steps no. 3 – 5 for each subscription available in your Microsoft Azure cloud account.

01 Define the configuration file for your new Azure Machine Learning (ML) workspace. Create a new configuration file (YAML format), name the file workspace-config.yml, and paste the configuration document listed below. Set identity.type to system_assigned to configure the identity type and replace other configuration parameter values with your own information):

$schema: https://azuremlschemas.azureedge.net/latest/workspace.schema.json
name: tm-new2-project5-workspace
location: westeurope
display_name: tm-new-project5-workspace
storage_account: /subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/abcd1234abcd1234abcd1234
key_vault: /subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.KeyVault/vaults/1234abcd12341234abcd1234
identity:
	type: system_assigned

02 Run ml workspace create command (Windows/macOS/Linux) with the configuration file defined at the previous step (i.e. workspace-config.yml), to create your new Azure Machine Learning workspace:

az ml workspace create
  --resource-group cloud-shell-storage-westeurope
  --file workspace-config.yml

03 The command output should return the new workspace configuration information:

{
	"description": "tm-new-project5-workspace",
	"discovery_url": "https://westeurope.api.azureml.ms/discovery",
	"display_name": "tm-new-project5-workspace",
	"enable_data_isolation": false,
	"id": "/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.MachineLearningServices/workspaces/tm-new-project5-workspace",
	"identity": {
		"principal_id": "abcd1234-abcd-1234-abcd-1234abcd1234",
		"tenant_id": "abcd1234-abcd-1234-abcd-1234abcd1234",
		"type": "system_assigned"
	},
	"key_vault": "/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Keyvault/vaults/1234abcd12341234abcd1234",
	"location": "westeurope",
	"managed_network": {
		"isolation_mode": "disabled",
		"outbound_rules": []
	},
	"mlflow_tracking_uri": "azureml://westeurope.api.azureml.ms/mlflow/v1.0/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.MachineLearningServices/workspaces/tm-new-project5-workspace",
	"name": "tm-new-project5-workspace",
	"public_network_access": "Enabled",
	"resourceGroup": "cloud-shell-storage-westeurope",
	"resource_group": "cloud-shell-storage-westeurope",
	"serverless_compute": {
		"no_public_ip": false
	},
	"storage_account": "/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/abcd1234abcd1234abcd1234",
	"tags": {
		"AttachAppInsightsToWorkspace": "false",
		"createdByToolkit": "cli-v2-1.16.1"
	}
}

04 Repeat steps no. 1 - 3 for each workspace that you want to re-create, available in the selected Azure subscription.

05 Repeat steps no. 1 – 4 for each subscription available in your Microsoft Azure cloud account.