How to set disableLocalAuth property while creating AML compute using Azure Cli ML v2

Question

How to set disableLocalAuth property while creating AML compute using Azure Cli ML v2

Jaiman, Amardeep (Baker Hughes Contractor) 5

Hi,

I want to set disableLocalAuth property while creating AMLCompute type compute using Azure CLI ML v2. I couldnt find any argument to set this property or value to this in

"az ml compute create" command.

without setting this property to true i am not able to create the amlcompute in my workspace as in our organization adminstrator has set this policy. I am getting following error :

Additional Information:Type: PolicyViolation
Info: {
    "evaluationDetails": {
        "evaluatedExpressions": [
            {
                "result": "True",
                "expressionKind": "Field",
                "expression": "type",
                "path": "type",
                "expressionValue": "Microsoft.MachineLearningServices/workspaces/computes",
                "targetValue": "Microsoft.MachineLearningServices/workspaces/computes",
                "operator": "Equals"
            },
            {
                "result": "True",
                "expressionKind": "Field",
                "expression": "Microsoft.MachineLearningServices/workspaces/computes/disableLocalAuth",
                "path": "properties.disableLocalAuth",
                "targetValue": "True",
                "operator": "NotEquals"
            }
        ]
    },

Please help me with proper guidance on this issue.

VasaviLankipalle-MSFT 18,741 Reputation points Moderator

2023-03-01T03:02:45.48+00:00

Hi @Jaiman, Amardeep (Baker Hughes Contractor) , Thanks for using Microsoft Q&A Platform.

I believe the az ml compute create command does not have a built-in argument to set the disableLocalAuth property. You can find Azure CLI Compute commands list here: https://learn.microsoft.com/en-us/cli/azure/ml/compute?view=azure-cli-latest#az-ml-compute-create

Since, disable local authentication policy has set. Here is the documentation about how to modify/disable local authentication policy: https://learn.microsoft.com/en-us/azure/machine-learning/how-to-integrate-azure-policy#disable-local-authentication
Jaiman, Amardeep (Baker Hughes Contractor) 5 Reputation points

2023-03-01T05:46:04.3733333+00:00

Thanks @VasaviLankipalle-MSFT for suggestions.

one more clarification, i am also setting --ssh-public-access-enabled parameter as false, this parameter shouldnt disable the localauth automatically on the cluster since we are disableing public ssh access ? are these 2 things different and not interconnected ?
VasaviLankipalle-MSFT 18,741 Reputation points Moderator

2023-03-01T20:33:13.8666667+00:00

Hi @Jaiman, Amardeep (Baker Hughes Contractor) , --ssh-public-access-enabled parameter to false might also work in a way. Did that help in your case?

But it looks like, the ssh-public-access-enabled parameter is used to control public SSH access to the nodes of the cluster, while the local authentication is controlled by the ssh_settings parameter. The ssh_settings parameter allows you to specify the administrator username and password or SSH public key for connecting to the cluster.

According to the documentation, setting ssh-public-access-enabled to false will not automatically disable local authentication.

Here is the reference documentation for the CLI (v2) compute cluster (AmlCompute) YAML schema: https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/machine-learning/reference-yaml-compute-aml.md
VasaviLankipalle-MSFT 18,741 Reputation points Moderator

2023-03-08T03:36:59.68+00:00

@Jaiman, Amardeep (Baker Hughes Contractor) , is there anything more you are looking help for?
Jaiman, Amardeep (Baker Hughes Contractor) 5 Reputation points

2023-03-09T16:13:26.4733333+00:00

Thanks for the help and valuable suggestions. For now i have used Bicep template to create the resource. That solves my problem.