Disable Root Access

Risk Level: High (not acceptable risk)

Rule ID: MachineLearning-014

To prevent unauthorized system-wide changes or the installation of malicious software on your compute instances, ensure that root access is disabled for your Azure Machine Learning compute instances.

Security

Disabling root access on Azure Machine Learning compute instances adheres to the Principle of Least Privilege (POLP), minimizing the attack surface. This prevents unauthorized system-wide modifications, reducing the risk of a privilege escalation attack or compromise.

Audit

To determine if root access is disabled for your Azure Machine Learning compute instances, perform the following operations:

Using Azure Console

Sign in to the Microsoft Azure Portal.
Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.
Choose the Azure subscription that you want to access from the Subscription equalls all filter box and choose Apply.
From the Type equals all filter box, select Type for Filter, Equals for Operator, and Azure Machine Learning workspace for Value, then choose Apply to list the Azure Machine Learning workspaces available in the selected subscription.
Click on the name (link) of the Machine Learning workspace that you want to examine.
In the resource navigation panel, select Overview, and choose Launch studio to open the Azure Machine Learning Studio.
In the left navigation panel, under Manage, choose Compute, and select the Compute instances tab to list the compute instances provisioned for the selected Azure Machine Learning workspace.
Click on the name (link) of the compute instance that you want to examine.
Select the Details tab and check the Root access attribute value listed in the Resource properties section to determine if the root access is enabled for the selected instance. If the Root access attribute is set to Enabled, root access is not disabled for the selected Azure Machine Learning compute instance.

Using Azure CLI

Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:
```
az account list
	--query '[*].id'
```

The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):
```
az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
```
Run ml workspace list command (Windows/macOS/Linux) with custom output filters to list the name and the associated resource group for each Azure Machine Learning workspace available in the current subscription:
```
az ml workspace list
	--output table
	--query '[*].{name:name, resourceGroup:resourceGroup}'
```

The command output should return the requested Azure Machine Learning workspace identifiers:

Name                           ResourceGroup
------------------------       ------------------------------
tm-ml-project5-workspace       cloud-shell-storage-westeurope
tm-ml-production-workspace     cloud-shell-storage-westeurope

Run ml compute list command (Windows/macOS/Linux) with custom output filters to list the name of each compute instance provisioned for the selected Azure Machine Learning workspace:
```
az ml compute list
	--resource-group cloud-shell-storage-westeurope
	--workspace-name tm-ml-project5-workspace
	--output table
	--query "[].{Name:name}"
```

The command output should return the requested compute instance identifiers (names):

Name
----------------------
project5-ml-instance01
project5-ml-instance02
project5-ml-instance03

Run ml compute show command (Windows/macOS/Linux) with the name of the Azure Machine Learning compute instance that you want to examine as the identifier parameter, to determine if root access is enabled for the selected compute instance:
```
az ml compute show
	--name project5-ml-instance01
	--workspace-name tm-ml-project5-workspace
	--resource-group cloud-shell-storage-westeurope
	--query "enable_root_access"
```
The command output should return the "enable_root_access" attribute value (true for enabled, false for disabled). "enable_root_access" indicates whether root access is enabled on the compute instance:
```
true
```
If the ml compute show command output returns true, as shown in the example above, root access is not disabled for the selected Azure Machine Learning compute instance.

Remediation / Resolution

To ensure that root access is disabled for your Microsoft Azure Machine Learning compute instances, perform the following operations:

Disabling root access for Machine Learning compute instances using the Azure Command Line Interface (Azure CLI) is not currently supported.

Using Azure Console

Sign in to the Microsoft Azure Portal.
Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.
Choose the Azure subscription that you want to access from the Subscription equalls all filter box and choose Apply.
From the Type equals all filter box, select Type for Filter, Equals for Operator, and Azure Machine Learning workspace for Value, then choose Apply to list the Azure Machine Learning workspaces available in the selected subscription.
Click on the name (link) of the Machine Learning workspace that you want to access.
In the resource navigation panel, select Overview, and choose Launch studio to open the Azure Machine Learning Studio.
In the left navigation panel, under Manage, choose Compute, and select the Compute instances tab.
Root access can't be disabled after instance deployment. To disable root access for your Azure Machine Learning compute instances, you must re-create your instances with the appropriate access configuration. Choose New and perform the following actions to create your new, compliant compute instance:
1. For Required settings, enter a name for the new instance in the Compute name box, select the instance type from the Virtual machine type, choose Select from all options under Virtual machine size, and select the appropriate VM size for your instance. Choose Next to continue the setup process.
2. (Optional) For Scheduling, choose whether to schedule the compute to start or stop on a recurring basis. You can also configure instance auto shutdown on this step. Choose Next to continue.
3. For Security, configure security settings such as SSH access, virtual network injection, root access, Single Sign-On (SSO), and managed identity for your new compute instance. Under Root access, ensure that Allow root access button is swiched off. Choose Next to continue the setup.
4. (Optional) For Applications, choose Add application, and add custom applications you may want to use on your compute instance. You can also choose to provision the new instance with a creation and/or startup script on this step. Choose Next to continue.
5. (Optional) For Tags, use the Name and Value text fields to create the tagging schema for your compute instance. Choose Next to continue the setup.
6. For Review, review the instance configuration and choose Create to deploy your new, compliant compute instance.
(Optional) To remove the non-compliant compute instance from your Azure Machine Learning workspace, select the instance that you want to remove, select Delete, and choose again Delete in the confirmation box.

References

Azure Official Documentation
What is an Azure Machine Learning compute instance?
Create an Azure Machine Learning compute instance
Manage an Azure Machine Learning compute instance

Azure Command Line Interface (CLI) Documentation
az account list
az account set
az ml workspace list
az ml compute list
az ml compute show

Publication date Oct 13, 2025

Audit

Using Azure Console

Using Azure CLI

Remediation / Resolution

Using Azure Console

References

Related MachineLearning rules