Microsoft.MachineLearningServices workspaces

Article
08/01/2024

Bicep resource definition

The workspaces resource type can be deployed with operations that target:

Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.MachineLearningServices/workspaces resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.MachineLearningServices/workspaces@2024-07-01-preview' = {
  name: 'string'
  location: 'string'
  tags: {
    tagName1: 'tagValue1'
    tagName2: 'tagValue2'
  }
  sku: {
    capacity: int
    family: 'string'
    name: 'string'
    size: 'string'
    tier: 'string'
  }
  kind: 'string'
  identity: {
    type: 'string'
    userAssignedIdentities: {
      {customized property}: {}
    }
  }
  properties: {
    allowPublicAccessWhenBehindVnet: bool
    allowRoleAssignmentOnRG: bool
    applicationInsights: 'string'
    associatedWorkspaces: [
      'string'
    ]
    containerRegistries: [
      'string'
    ]
    containerRegistry: 'string'
    description: 'string'
    discoveryUrl: 'string'
    enableDataIsolation: bool
    enableServiceSideCMKEncryption: bool
    enableSimplifiedCmk: bool
    enableSoftwareBillOfMaterials: bool
    encryption: {
      cosmosDbResourceId: 'string'
      identity: {
        userAssignedIdentity: 'string'
      }
      keyVaultProperties: {
        identityClientId: 'string'
        keyIdentifier: 'string'
        keyVaultArmId: 'string'
      }
      searchAccountResourceId: 'string'
      status: 'string'
      storageAccountResourceId: 'string'
    }
    existingWorkspaces: [
      'string'
    ]
    featureStoreSettings: {
      computeRuntime: {
        sparkRuntimeVersion: 'string'
      }
      offlineStoreConnectionName: 'string'
      onlineStoreConnectionName: 'string'
    }
    friendlyName: 'string'
    hbiWorkspace: bool
    hubResourceId: 'string'
    imageBuildCompute: 'string'
    ipAllowlist: [
      'string'
    ]
    keyVault: 'string'
    keyVaults: [
      'string'
    ]
    managedNetwork: {
      isolationMode: 'string'
      outboundRules: {
        {customized property}: {
          category: 'string'
          status: 'string'
          type: 'string'
          // For remaining properties, see OutboundRule objects
        }
      }
      status: {
        sparkReady: bool
        status: 'string'
      }
    }
    primaryUserAssignedIdentity: 'string'
    publicNetworkAccess: 'string'
    serverlessComputeSettings: {
      serverlessComputeCustomSubnet: 'string'
      serverlessComputeNoPublicIP: bool
    }
    serviceManagedResourcesSettings: {
      cosmosDb: {
        collectionsThroughput: int
      }
    }
    sharedPrivateLinkResources: [
      {
        name: 'string'
        properties: {
          groupId: 'string'
          privateLinkResourceId: 'string'
          requestMessage: 'string'
          status: 'string'
        }
      }
    ]
    softDeleteRetentionInDays: int
    storageAccount: 'string'
    storageAccounts: [
      'string'
    ]
    systemDatastoresAuthMode: 'string'
    v1LegacyMode: bool
    workspaceHubConfig: {
      additionalWorkspaceStorageAccounts: [
        'string'
      ]
      defaultWorkspaceResourceGroup: 'string'
    }
  }
}

OutboundRule objects

Set the type property to specify the type of object.

For FQDN, use:

  type: 'FQDN'
  destination: 'string'

For PrivateEndpoint, use:

  type: 'PrivateEndpoint'
  destination: {
    serviceResourceId: 'string'
    sparkEnabled: bool
    sparkStatus: 'string'
    subresourceTarget: 'string'
  }
  parentRuleNames: [
    'string'
  ]

For ServiceTag, use:

  type: 'ServiceTag'
  destination: {
    action: 'string'
    portRanges: 'string'
    protocol: 'string'
    serviceTag: 'string'
  }

Property values

workspaces

Name	Description	Value
name	The resource name	string (required) Character limit: 3-33 Valid characters: Alphanumerics, hyphens, and underscores.
location		string
tags	Dictionary of {string}	Dictionary of tag names and values. See Tags in templates
sku	Optional. This field is required to be implemented by the RP because AML is supporting more than one tier	Sku
kind		string
identity	Managed service identity (system assigned and/or user assigned identities)	ManagedServiceIdentity
properties	Additional attributes of the entity.	WorkspaceProperties (required)

ManagedServiceIdentity

Name	Description	Value
type	Type of managed service identity (where both SystemAssigned and UserAssigned types are allowed).	'None' 'SystemAssigned' 'SystemAssigned,UserAssigned' 'UserAssigned' (required)
userAssignedIdentities	The set of user assigned identities associated with the resource. The userAssignedIdentities dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. The dictionary values can be empty objects ({}) in requests.	UserAssignedIdentities

UserAssignedIdentities

Name	Description	Value
{customized property}		UserAssignedIdentity

UserAssignedIdentity

This object doesn't contain any properties to set during deployment. All properties are ReadOnly.

WorkspaceProperties

Name	Description	Value
allowPublicAccessWhenBehindVnet	The flag to indicate whether to allow public access when behind VNet.	bool
allowRoleAssignmentOnRG	The flag to indicate whether we will do role assignment for the workspace MSI on resource group level.	bool
applicationInsights	ARM id of the application insights associated with this workspace.	string
associatedWorkspaces		string[]
containerRegistries		string[]
containerRegistry	ARM id of the container registry associated with this workspace.	string
description	The description of this workspace.	string
discoveryUrl	Url for the discovery service to identify regional endpoints for machine learning experimentation services	string
enableDataIsolation		bool
enableServiceSideCMKEncryption		bool
enableSimplifiedCmk	Flag to tell if simplified CMK should be enabled for this workspace.	bool
enableSoftwareBillOfMaterials	Flag to tell if SoftwareBillOfMaterials should be enabled for this workspace.	bool
encryption		EncryptionProperty
existingWorkspaces		string[]
featureStoreSettings	Settings for feature store type workspace.	FeatureStoreSettings
friendlyName	The friendly name for this workspace. This name in mutable	string
hbiWorkspace	The flag to signal HBI data in the workspace and reduce diagnostic data collected by the service	bool
hubResourceId		string
imageBuildCompute	The compute name for image build	string
ipAllowlist	The list of IPv4 addresses that are allowed to access the workspace.	string[]
keyVault	ARM id of the key vault associated with this workspace. This cannot be changed once the workspace has been created	string
keyVaults		string[]
managedNetwork	Managed Network settings for a machine learning workspace.	ManagedNetworkSettings
primaryUserAssignedIdentity	The user assigned identity resource id that represents the workspace identity.	string
publicNetworkAccess	Whether requests from Public Network are allowed.	'Disabled' 'Enabled'
serverlessComputeSettings	Settings for serverless compute in a workspace	ServerlessComputeSettings
serviceManagedResourcesSettings	The service managed resource settings.	ServiceManagedResourcesSettings
sharedPrivateLinkResources	The list of shared private link resources in this workspace.	SharedPrivateLinkResource[]
softDeleteRetentionInDays	Retention time in days after workspace get soft deleted.	int
storageAccount	ARM id of the storage account associated with this workspace. This cannot be changed once the workspace has been created	string
storageAccounts		string[]
systemDatastoresAuthMode	The auth mode used for accessing the system datastores of the workspace.	string
v1LegacyMode	Enabling v1_legacy_mode may prevent you from using features provided by the v2 API.	bool
workspaceHubConfig	WorkspaceHub's configuration object.	WorkspaceHubConfig

EncryptionProperty

Name	Description	Value
cosmosDbResourceId	The byok cosmosdb account that customer brings to store customer's data with encryption	string
identity	Identity to be used with the keyVault	IdentityForCmk
keyVaultProperties	KeyVault details to do the encryption	KeyVaultProperties (required)
searchAccountResourceId	The byok search account that customer brings to store customer's data with encryption	string
status	Indicates whether or not the encryption is enabled for the workspace.	'Disabled' 'Enabled' (required)
storageAccountResourceId	The byok storage account that customer brings to store customer's data with encryption	string

IdentityForCmk

Name	Description	Value
userAssignedIdentity	UserAssignedIdentity to be used to fetch the encryption key from keyVault	string

KeyVaultProperties

Name	Description	Value
identityClientId	Currently, we support only SystemAssigned MSI. We need this when we support UserAssignedIdentities	string
keyIdentifier	KeyVault key identifier to encrypt the data	string (required) Constraints: Min length = 1 Pattern = `[a-zA-Z0-9_]`
keyVaultArmId	KeyVault Arm Id that contains the data encryption key	string (required) Constraints: Min length = 1 Pattern = `[a-zA-Z0-9_]`

FeatureStoreSettings

Name	Description	Value
computeRuntime		ComputeRuntimeDto
offlineStoreConnectionName		string
onlineStoreConnectionName		string

ComputeRuntimeDto

Name	Description	Value
sparkRuntimeVersion		string

ManagedNetworkSettings

Name	Description	Value
isolationMode	Isolation mode for the managed network of a machine learning workspace.	'AllowInternetOutbound' 'AllowOnlyApprovedOutbound' 'Disabled'
outboundRules	Dictionary of {OutboundRule}	ManagedNetworkSettingsOutboundRules
status	Status of the Provisioning for the managed network of a machine learning workspace.	ManagedNetworkProvisionStatus

ManagedNetworkSettingsOutboundRules

Name	Description	Value
{customized property}		OutboundRule

OutboundRule

Name	Description	Value
category	Category of a managed network Outbound Rule of a machine learning workspace.	'Dependency' 'Recommended' 'Required' 'UserDefined'
status	Type of a managed network Outbound Rule of a machine learning workspace.	'Active' 'Inactive'
type	Set the object type	FQDN PrivateEndpoint ServiceTag (required)

FqdnOutboundRule

Name	Description	Value
type	Type of a managed network Outbound Rule of a machine learning workspace.	'FQDN' (required)
destination		string

PrivateEndpointOutboundRule

Name	Description	Value
type	Type of a managed network Outbound Rule of a machine learning workspace.	'PrivateEndpoint' (required)
destination	Private Endpoint destination for a Private Endpoint Outbound Rule for the managed network of a machine learning workspace.	PrivateEndpointDestination
parentRuleNames		string[]

PrivateEndpointDestination

Name	Description	Value
serviceResourceId		string
sparkEnabled		bool
sparkStatus	Type of a managed network Outbound Rule of a machine learning workspace.	'Active' 'Inactive'
subresourceTarget		string

ServiceTagOutboundRule

Name	Description	Value
type	Type of a managed network Outbound Rule of a machine learning workspace.	'ServiceTag' (required)
destination	Service Tag destination for a Service Tag Outbound Rule for the managed network of a machine learning workspace.	ServiceTagDestination

ServiceTagDestination

Name	Description	Value
action	The action enum for networking rule.	'Allow' 'Deny'
portRanges		string
protocol		string
serviceTag		string

ManagedNetworkProvisionStatus

Name	Description	Value
sparkReady		bool
status	Status for the managed network of a machine learning workspace.	'Active' 'Inactive'

ServerlessComputeSettings

Name	Description	Value
serverlessComputeCustomSubnet	The resource ID of an existing virtual network subnet in which serverless compute nodes should be deployed	string
serverlessComputeNoPublicIP	The flag to signal if serverless compute nodes deployed in custom vNet would have no public IP addresses for a workspace with private endpoint	bool

ServiceManagedResourcesSettings

Name	Description	Value
cosmosDb		CosmosDbSettings

CosmosDbSettings

Name	Description	Value
collectionsThroughput		int

SharedPrivateLinkResource

Name	Description	Value
name	Unique name of the private link	string
properties	Properties of a shared private link resource.	SharedPrivateLinkResourceProperty

SharedPrivateLinkResourceProperty

Name	Description	Value
groupId	group id of the private link	string
privateLinkResourceId	the resource id that private link links to	string
requestMessage	Request message	string
status	Connection status of the service consumer with the service provider	'Approved' 'Disconnected' 'Pending' 'Rejected' 'Timeout'

WorkspaceHubConfig

Name	Description	Value
additionalWorkspaceStorageAccounts		string[]
defaultWorkspaceResourceGroup		string

Sku

Name	Description	Value
capacity	If the SKU supports scale out/in then the capacity integer should be included. If scale out/in is not possible for the resource this may be omitted.	int
family	If the service has different generations of hardware, for the same SKU, then that can be captured here.	string
name	The name of the SKU. Ex - P3. It is typically a letter+number code	string (required)
size	The SKU size. When the name field is the combination of tier and some other value, this would be the standalone code.	string
tier	This field is required to be implemented by the Resource Provider if the service has more than one tier, but is not required on a PUT.	'Basic' 'Free' 'Premium' 'Standard'

Quickstart templates

The following quickstart templates deploy this resource type.

Template	Description
Azure Machine Learning Workspace	This template creates a new Azure Machine Learning Workspace, along with an encrypted Storage Account, KeyVault and Applications Insights Logging
Azure AI Studio basic setup	This set of templates demonstrates how to set up Azure AI Studio with the basic setup, meaning with public internet access enabled, Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Azure AI Studio basic setup	This set of templates demonstrates how to set up Azure AI Studio with the basic setup, meaning with public internet access enabled, Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Azure AI Studio with Microsoft Entra ID Authentication	This set of templates demonstrates how to set up Azure AI Studio with Microsoft Entra ID authentication for dependent resources, such as Azure AI Services and Azure Storage.
Azure AI Studio Network Restricted	This set of templates demonstrates how to set up Azure AI Studio with private link and egress disabled, using Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Create AML workspace with multiple Datasets & Datastores	This template creates Azure Machine Learning workspace with multiple datasets & datastores.
Azure Machine Learning end-to-end secure setup	This set of Bicep templates demonstrates how to set up Azure Machine Learning end-to-end in a secure set up. This reference implementation includes the Workspace, a compute cluster, compute instance and attached private AKS cluster.
Azure Machine Learning end-to-end secure setup (legacy)	This set of Bicep templates demonstrates how to set up Azure Machine Learning end-to-end in a secure set up. This reference implementation includes the Workspace, a compute cluster, compute instance and attached private AKS cluster.
Azure AI Studio Network Restricted	This set of templates demonstrates how to set up Azure AI Studio with private link and egress disabled, using Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Create an AKS compute target with a Private IP address	This template creates an AKS compute target in given Azure Machine Learning service workspace with a private IP address.
Create an Azure Machine Learning service workspace	This deployment template specifies an Azure Machine Learning workspace, and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. This configuration describes the minimal set of resources you require to get started with Azure Machine Learning.
Create an Azure Machine Learning service workspace (CMK)	This deployment template specifies an Azure Machine Learning workspace, and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. The example shows how to configure Azure Machine Learning for encryption with a customer-managed encryption key.
Create an Azure Machine Learning service workspace (CMK)	This deployment template specifies how to create an Azure Machine Learning workspace with service-side encryption using your encryption keys.
Create an Azure Machine Learning service workspace (vnet)	This deployment template specifies an Azure Machine Learning workspace, and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. This configuration describes the set of resources you require to get started with Azure Machine Learning in a network isolated set up.
Create an Azure Machine Learning service workspace (legacy)	This deployment template specifies an Azure Machine Learning workspace, and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. This configuration describes the set of resources you require to get started with Azure Machine Learning in a network isolated set up.

ARM template resource definition

The workspaces resource type can be deployed with operations that target:

Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.MachineLearningServices/workspaces resource, add the following JSON to your template.

{
  "type": "Microsoft.MachineLearningServices/workspaces",
  "apiVersion": "2024-07-01-preview",
  "name": "string",
  "location": "string",
  "tags": {
    "tagName1": "tagValue1",
    "tagName2": "tagValue2"
  },
  "sku": {
    "capacity": "int",
    "family": "string",
    "name": "string",
    "size": "string",
    "tier": "string"
  },
  "kind": "string",
  "identity": {
    "type": "string",
    "userAssignedIdentities": {
      "{customized property}": {}
    }
  },
  "properties": {
    "allowPublicAccessWhenBehindVnet": "bool",
    "allowRoleAssignmentOnRG": "bool",
    "applicationInsights": "string",
    "associatedWorkspaces": [ "string" ],
    "containerRegistries": [ "string" ],
    "containerRegistry": "string",
    "description": "string",
    "discoveryUrl": "string",
    "enableDataIsolation": "bool",
    "enableServiceSideCMKEncryption": "bool",
    "enableSimplifiedCmk": "bool",
    "enableSoftwareBillOfMaterials": "bool",
    "encryption": {
      "cosmosDbResourceId": "string",
      "identity": {
        "userAssignedIdentity": "string"
      },
      "keyVaultProperties": {
        "identityClientId": "string",
        "keyIdentifier": "string",
        "keyVaultArmId": "string"
      },
      "searchAccountResourceId": "string",
      "status": "string",
      "storageAccountResourceId": "string"
    },
    "existingWorkspaces": [ "string" ],
    "featureStoreSettings": {
      "computeRuntime": {
        "sparkRuntimeVersion": "string"
      },
      "offlineStoreConnectionName": "string",
      "onlineStoreConnectionName": "string"
    },
    "friendlyName": "string",
    "hbiWorkspace": "bool",
    "hubResourceId": "string",
    "imageBuildCompute": "string",
    "ipAllowlist": [ "string" ],
    "keyVault": "string",
    "keyVaults": [ "string" ],
    "managedNetwork": {
      "isolationMode": "string",
      "outboundRules": {
        "{customized property}": {
          "category": "string",
          "status": "string",
          "type": "string"
          // For remaining properties, see OutboundRule objects
        }
      },
      "status": {
        "sparkReady": "bool",
        "status": "string"
      }
    },
    "primaryUserAssignedIdentity": "string",
    "publicNetworkAccess": "string",
    "serverlessComputeSettings": {
      "serverlessComputeCustomSubnet": "string",
      "serverlessComputeNoPublicIP": "bool"
    },
    "serviceManagedResourcesSettings": {
      "cosmosDb": {
        "collectionsThroughput": "int"
      }
    },
    "sharedPrivateLinkResources": [
      {
        "name": "string",
        "properties": {
          "groupId": "string",
          "privateLinkResourceId": "string",
          "requestMessage": "string",
          "status": "string"
        }
      }
    ],
    "softDeleteRetentionInDays": "int",
    "storageAccount": "string",
    "storageAccounts": [ "string" ],
    "systemDatastoresAuthMode": "string",
    "v1LegacyMode": "bool",
    "workspaceHubConfig": {
      "additionalWorkspaceStorageAccounts": [ "string" ],
      "defaultWorkspaceResourceGroup": "string"
    }
  }
}

OutboundRule objects

Set the type property to specify the type of object.

For FQDN, use:

  "type": "FQDN",
  "destination": "string"

For PrivateEndpoint, use:

  "type": "PrivateEndpoint",
  "destination": {
    "serviceResourceId": "string",
    "sparkEnabled": "bool",
    "sparkStatus": "string",
    "subresourceTarget": "string"
  },
  "parentRuleNames": [ "string" ]

For ServiceTag, use:

  "type": "ServiceTag",
  "destination": {
    "action": "string",
    "portRanges": "string",
    "protocol": "string",
    "serviceTag": "string"
  }

Property values

workspaces

Name	Description	Value
type	The resource type	'Microsoft.MachineLearningServices/workspaces'
apiVersion	The resource api version	'2024-07-01-preview'
name	The resource name	string (required) Character limit: 3-33 Valid characters: Alphanumerics, hyphens, and underscores.
location		string
tags	Dictionary of {string}	Dictionary of tag names and values. See Tags in templates
sku	Optional. This field is required to be implemented by the RP because AML is supporting more than one tier	Sku
kind		string
identity	Managed service identity (system assigned and/or user assigned identities)	ManagedServiceIdentity
properties	Additional attributes of the entity.	WorkspaceProperties (required)

ManagedServiceIdentity

Name	Description	Value
type	Type of managed service identity (where both SystemAssigned and UserAssigned types are allowed).	'None' 'SystemAssigned' 'SystemAssigned,UserAssigned' 'UserAssigned' (required)
userAssignedIdentities	The set of user assigned identities associated with the resource. The userAssignedIdentities dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. The dictionary values can be empty objects ({}) in requests.	UserAssignedIdentities

UserAssignedIdentities

Name	Description	Value
{customized property}		UserAssignedIdentity

UserAssignedIdentity

This object doesn't contain any properties to set during deployment. All properties are ReadOnly.

WorkspaceProperties

Name	Description	Value
allowPublicAccessWhenBehindVnet	The flag to indicate whether to allow public access when behind VNet.	bool
allowRoleAssignmentOnRG	The flag to indicate whether we will do role assignment for the workspace MSI on resource group level.	bool
applicationInsights	ARM id of the application insights associated with this workspace.	string
associatedWorkspaces		string[]
containerRegistries		string[]
containerRegistry	ARM id of the container registry associated with this workspace.	string
description	The description of this workspace.	string
discoveryUrl	Url for the discovery service to identify regional endpoints for machine learning experimentation services	string
enableDataIsolation		bool
enableServiceSideCMKEncryption		bool
enableSimplifiedCmk	Flag to tell if simplified CMK should be enabled for this workspace.	bool
enableSoftwareBillOfMaterials	Flag to tell if SoftwareBillOfMaterials should be enabled for this workspace.	bool
encryption		EncryptionProperty
existingWorkspaces		string[]
featureStoreSettings	Settings for feature store type workspace.	FeatureStoreSettings
friendlyName	The friendly name for this workspace. This name in mutable	string
hbiWorkspace	The flag to signal HBI data in the workspace and reduce diagnostic data collected by the service	bool
hubResourceId		string
imageBuildCompute	The compute name for image build	string
ipAllowlist	The list of IPv4 addresses that are allowed to access the workspace.	string[]
keyVault	ARM id of the key vault associated with this workspace. This cannot be changed once the workspace has been created	string
keyVaults		string[]
managedNetwork	Managed Network settings for a machine learning workspace.	ManagedNetworkSettings
primaryUserAssignedIdentity	The user assigned identity resource id that represents the workspace identity.	string
publicNetworkAccess	Whether requests from Public Network are allowed.	'Disabled' 'Enabled'
serverlessComputeSettings	Settings for serverless compute in a workspace	ServerlessComputeSettings
serviceManagedResourcesSettings	The service managed resource settings.	ServiceManagedResourcesSettings
sharedPrivateLinkResources	The list of shared private link resources in this workspace.	SharedPrivateLinkResource[]
softDeleteRetentionInDays	Retention time in days after workspace get soft deleted.	int
storageAccount	ARM id of the storage account associated with this workspace. This cannot be changed once the workspace has been created	string
storageAccounts		string[]
systemDatastoresAuthMode	The auth mode used for accessing the system datastores of the workspace.	string
v1LegacyMode	Enabling v1_legacy_mode may prevent you from using features provided by the v2 API.	bool
workspaceHubConfig	WorkspaceHub's configuration object.	WorkspaceHubConfig

EncryptionProperty

Name	Description	Value
cosmosDbResourceId	The byok cosmosdb account that customer brings to store customer's data with encryption	string
identity	Identity to be used with the keyVault	IdentityForCmk
keyVaultProperties	KeyVault details to do the encryption	KeyVaultProperties (required)
searchAccountResourceId	The byok search account that customer brings to store customer's data with encryption	string
status	Indicates whether or not the encryption is enabled for the workspace.	'Disabled' 'Enabled' (required)
storageAccountResourceId	The byok storage account that customer brings to store customer's data with encryption	string

IdentityForCmk

Name	Description	Value
userAssignedIdentity	UserAssignedIdentity to be used to fetch the encryption key from keyVault	string

KeyVaultProperties

Name	Description	Value
identityClientId	Currently, we support only SystemAssigned MSI. We need this when we support UserAssignedIdentities	string
keyIdentifier	KeyVault key identifier to encrypt the data	string (required) Constraints: Min length = 1 Pattern = `[a-zA-Z0-9_]`
keyVaultArmId	KeyVault Arm Id that contains the data encryption key	string (required) Constraints: Min length = 1 Pattern = `[a-zA-Z0-9_]`

FeatureStoreSettings

Name	Description	Value
computeRuntime		ComputeRuntimeDto
offlineStoreConnectionName		string
onlineStoreConnectionName		string

ComputeRuntimeDto

Name	Description	Value
sparkRuntimeVersion		string

ManagedNetworkSettings

Name	Description	Value
isolationMode	Isolation mode for the managed network of a machine learning workspace.	'AllowInternetOutbound' 'AllowOnlyApprovedOutbound' 'Disabled'
outboundRules	Dictionary of {OutboundRule}	ManagedNetworkSettingsOutboundRules
status	Status of the Provisioning for the managed network of a machine learning workspace.	ManagedNetworkProvisionStatus

ManagedNetworkSettingsOutboundRules

Name	Description	Value
{customized property}		OutboundRule

OutboundRule

Name	Description	Value
category	Category of a managed network Outbound Rule of a machine learning workspace.	'Dependency' 'Recommended' 'Required' 'UserDefined'
status	Type of a managed network Outbound Rule of a machine learning workspace.	'Active' 'Inactive'
type	Set the object type	FQDN PrivateEndpoint ServiceTag (required)

FqdnOutboundRule

Name	Description	Value
type	Type of a managed network Outbound Rule of a machine learning workspace.	'FQDN' (required)
destination		string

PrivateEndpointOutboundRule

Name	Description	Value
type	Type of a managed network Outbound Rule of a machine learning workspace.	'PrivateEndpoint' (required)
destination	Private Endpoint destination for a Private Endpoint Outbound Rule for the managed network of a machine learning workspace.	PrivateEndpointDestination
parentRuleNames		string[]

PrivateEndpointDestination

Name	Description	Value
serviceResourceId		string
sparkEnabled		bool
sparkStatus	Type of a managed network Outbound Rule of a machine learning workspace.	'Active' 'Inactive'
subresourceTarget		string

ServiceTagOutboundRule

Name	Description	Value
type	Type of a managed network Outbound Rule of a machine learning workspace.	'ServiceTag' (required)
destination	Service Tag destination for a Service Tag Outbound Rule for the managed network of a machine learning workspace.	ServiceTagDestination

ServiceTagDestination

Name	Description	Value
action	The action enum for networking rule.	'Allow' 'Deny'
portRanges		string
protocol		string
serviceTag		string

ManagedNetworkProvisionStatus

Name	Description	Value
sparkReady		bool
status	Status for the managed network of a machine learning workspace.	'Active' 'Inactive'

ServerlessComputeSettings

Name	Description	Value
serverlessComputeCustomSubnet	The resource ID of an existing virtual network subnet in which serverless compute nodes should be deployed	string
serverlessComputeNoPublicIP	The flag to signal if serverless compute nodes deployed in custom vNet would have no public IP addresses for a workspace with private endpoint	bool

ServiceManagedResourcesSettings

Name	Description	Value
cosmosDb		CosmosDbSettings

CosmosDbSettings

Name	Description	Value
collectionsThroughput		int

SharedPrivateLinkResource

Name	Description	Value
name	Unique name of the private link	string
properties	Properties of a shared private link resource.	SharedPrivateLinkResourceProperty

SharedPrivateLinkResourceProperty

Name	Description	Value
groupId	group id of the private link	string
privateLinkResourceId	the resource id that private link links to	string
requestMessage	Request message	string
status	Connection status of the service consumer with the service provider	'Approved' 'Disconnected' 'Pending' 'Rejected' 'Timeout'

WorkspaceHubConfig

Name	Description	Value
additionalWorkspaceStorageAccounts		string[]
defaultWorkspaceResourceGroup		string

Sku

Name	Description	Value
capacity	If the SKU supports scale out/in then the capacity integer should be included. If scale out/in is not possible for the resource this may be omitted.	int
family	If the service has different generations of hardware, for the same SKU, then that can be captured here.	string
name	The name of the SKU. Ex - P3. It is typically a letter+number code	string (required)
size	The SKU size. When the name field is the combination of tier and some other value, this would be the standalone code.	string
tier	This field is required to be implemented by the Resource Provider if the service has more than one tier, but is not required on a PUT.	'Basic' 'Free' 'Premium' 'Standard'

Quickstart templates

The following quickstart templates deploy this resource type.

Template	Description
Azure Machine Learning Workspace	This template creates a new Azure Machine Learning Workspace, along with an encrypted Storage Account, KeyVault and Applications Insights Logging
Azure AI Studio basic setup	This set of templates demonstrates how to set up Azure AI Studio with the basic setup, meaning with public internet access enabled, Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Azure AI Studio basic setup	This set of templates demonstrates how to set up Azure AI Studio with the basic setup, meaning with public internet access enabled, Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Azure AI Studio with Microsoft Entra ID Authentication	This set of templates demonstrates how to set up Azure AI Studio with Microsoft Entra ID authentication for dependent resources, such as Azure AI Services and Azure Storage.
Azure AI Studio Network Restricted	This set of templates demonstrates how to set up Azure AI Studio with private link and egress disabled, using Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Create AML workspace with multiple Datasets & Datastores	This template creates Azure Machine Learning workspace with multiple datasets & datastores.
Azure Machine Learning end-to-end secure setup	This set of Bicep templates demonstrates how to set up Azure Machine Learning end-to-end in a secure set up. This reference implementation includes the Workspace, a compute cluster, compute instance and attached private AKS cluster.
Azure Machine Learning end-to-end secure setup (legacy)	This set of Bicep templates demonstrates how to set up Azure Machine Learning end-to-end in a secure set up. This reference implementation includes the Workspace, a compute cluster, compute instance and attached private AKS cluster.
Azure AI Studio Network Restricted	This set of templates demonstrates how to set up Azure AI Studio with private link and egress disabled, using Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Create an AKS compute target with a Private IP address	This template creates an AKS compute target in given Azure Machine Learning service workspace with a private IP address.
Create an Azure Machine Learning service workspace	This deployment template specifies an Azure Machine Learning workspace, and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. This configuration describes the minimal set of resources you require to get started with Azure Machine Learning.
Create an Azure Machine Learning service workspace (CMK)	This deployment template specifies an Azure Machine Learning workspace, and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. The example shows how to configure Azure Machine Learning for encryption with a customer-managed encryption key.
Create an Azure Machine Learning service workspace (CMK)	This deployment template specifies how to create an Azure Machine Learning workspace with service-side encryption using your encryption keys.
Create an Azure Machine Learning service workspace (vnet)	This deployment template specifies an Azure Machine Learning workspace, and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. This configuration describes the set of resources you require to get started with Azure Machine Learning in a network isolated set up.
Create an Azure Machine Learning service workspace (legacy)	This deployment template specifies an Azure Machine Learning workspace, and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. This configuration describes the set of resources you require to get started with Azure Machine Learning in a network isolated set up.

Terraform (AzAPI provider) resource definition

The workspaces resource type can be deployed with operations that target:

Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.MachineLearningServices/workspaces resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.MachineLearningServices/workspaces@2024-07-01-preview"
  name = "string"
  location = "string"
  parent_id = "string"
  tags = {
    tagName1 = "tagValue1"
    tagName2 = "tagValue2"
  }
  identity {
    type = "string"
    identity_ids = []
  }
  body = jsonencode({
    properties = {
      allowPublicAccessWhenBehindVnet = bool
      allowRoleAssignmentOnRG = bool
      applicationInsights = "string"
      associatedWorkspaces = [
        "string"
      ]
      containerRegistries = [
        "string"
      ]
      containerRegistry = "string"
      description = "string"
      discoveryUrl = "string"
      enableDataIsolation = bool
      enableServiceSideCMKEncryption = bool
      enableSimplifiedCmk = bool
      enableSoftwareBillOfMaterials = bool
      encryption = {
        cosmosDbResourceId = "string"
        identity = {
          userAssignedIdentity = "string"
        }
        keyVaultProperties = {
          identityClientId = "string"
          keyIdentifier = "string"
          keyVaultArmId = "string"
        }
        searchAccountResourceId = "string"
        status = "string"
        storageAccountResourceId = "string"
      }
      existingWorkspaces = [
        "string"
      ]
      featureStoreSettings = {
        computeRuntime = {
          sparkRuntimeVersion = "string"
        }
        offlineStoreConnectionName = "string"
        onlineStoreConnectionName = "string"
      }
      friendlyName = "string"
      hbiWorkspace = bool
      hubResourceId = "string"
      imageBuildCompute = "string"
      ipAllowlist = [
        "string"
      ]
      keyVault = "string"
      keyVaults = [
        "string"
      ]
      managedNetwork = {
        isolationMode = "string"
        outboundRules = {
          {customized property} = {
            category = "string"
            status = "string"
            type = "string"
            // For remaining properties, see OutboundRule objects
          }
        }
        status = {
          sparkReady = bool
          status = "string"
        }
      }
      primaryUserAssignedIdentity = "string"
      publicNetworkAccess = "string"
      serverlessComputeSettings = {
        serverlessComputeCustomSubnet = "string"
        serverlessComputeNoPublicIP = bool
      }
      serviceManagedResourcesSettings = {
        cosmosDb = {
          collectionsThroughput = int
        }
      }
      sharedPrivateLinkResources = [
        {
          name = "string"
          properties = {
            groupId = "string"
            privateLinkResourceId = "string"
            requestMessage = "string"
            status = "string"
          }
        }
      ]
      softDeleteRetentionInDays = int
      storageAccount = "string"
      storageAccounts = [
        "string"
      ]
      systemDatastoresAuthMode = "string"
      v1LegacyMode = bool
      workspaceHubConfig = {
        additionalWorkspaceStorageAccounts = [
          "string"
        ]
        defaultWorkspaceResourceGroup = "string"
      }
    }
    sku = {
      capacity = int
      family = "string"
      name = "string"
      size = "string"
      tier = "string"
    }
    kind = "string"
  })
}

OutboundRule objects

Set the type property to specify the type of object.

For FQDN, use:

  type = "FQDN"
  destination = "string"

For PrivateEndpoint, use:

  type = "PrivateEndpoint"
  destination = {
    serviceResourceId = "string"
    sparkEnabled = bool
    sparkStatus = "string"
    subresourceTarget = "string"
  }
  parentRuleNames = [
    "string"
  ]

For ServiceTag, use:

  type = "ServiceTag"
  destination = {
    action = "string"
    portRanges = "string"
    protocol = "string"
    serviceTag = "string"
  }

Property values

workspaces

Name	Description	Value
type	The resource type	"Microsoft.MachineLearningServices/workspaces@2024-07-01-preview"
name	The resource name	string (required) Character limit: 3-33 Valid characters: Alphanumerics, hyphens, and underscores.
location		string
parent_id	To deploy to a resource group, use the ID of that resource group.	string (required)
tags	Dictionary of {string}	Dictionary of tag names and values.
sku	Optional. This field is required to be implemented by the RP because AML is supporting more than one tier	Sku
kind		string
identity	Managed service identity (system assigned and/or user assigned identities)	ManagedServiceIdentity
properties	Additional attributes of the entity.	WorkspaceProperties (required)

ManagedServiceIdentity

Name	Description	Value
type	Type of managed service identity (where both SystemAssigned and UserAssigned types are allowed).	"SystemAssigned" "SystemAssigned,UserAssigned" "UserAssigned" (required)
identity_ids	The set of user assigned identities associated with the resource. The userAssignedIdentities dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. The dictionary values can be empty objects ({}) in requests.	Array of user identity IDs.

UserAssignedIdentities

Name	Description	Value
{customized property}		UserAssignedIdentity

UserAssignedIdentity

This object doesn't contain any properties to set during deployment. All properties are ReadOnly.

WorkspaceProperties

Name	Description	Value
allowPublicAccessWhenBehindVnet	The flag to indicate whether to allow public access when behind VNet.	bool
allowRoleAssignmentOnRG	The flag to indicate whether we will do role assignment for the workspace MSI on resource group level.	bool
applicationInsights	ARM id of the application insights associated with this workspace.	string
associatedWorkspaces		string[]
containerRegistries		string[]
containerRegistry	ARM id of the container registry associated with this workspace.	string
description	The description of this workspace.	string
discoveryUrl	Url for the discovery service to identify regional endpoints for machine learning experimentation services	string
enableDataIsolation		bool
enableServiceSideCMKEncryption		bool
enableSimplifiedCmk	Flag to tell if simplified CMK should be enabled for this workspace.	bool
enableSoftwareBillOfMaterials	Flag to tell if SoftwareBillOfMaterials should be enabled for this workspace.	bool
encryption		EncryptionProperty
existingWorkspaces		string[]
featureStoreSettings	Settings for feature store type workspace.	FeatureStoreSettings
friendlyName	The friendly name for this workspace. This name in mutable	string
hbiWorkspace	The flag to signal HBI data in the workspace and reduce diagnostic data collected by the service	bool
hubResourceId		string
imageBuildCompute	The compute name for image build	string
ipAllowlist	The list of IPv4 addresses that are allowed to access the workspace.	string[]
keyVault	ARM id of the key vault associated with this workspace. This cannot be changed once the workspace has been created	string
keyVaults		string[]
managedNetwork	Managed Network settings for a machine learning workspace.	ManagedNetworkSettings
primaryUserAssignedIdentity	The user assigned identity resource id that represents the workspace identity.	string
publicNetworkAccess	Whether requests from Public Network are allowed.	"Disabled" "Enabled"
serverlessComputeSettings	Settings for serverless compute in a workspace	ServerlessComputeSettings
serviceManagedResourcesSettings	The service managed resource settings.	ServiceManagedResourcesSettings
sharedPrivateLinkResources	The list of shared private link resources in this workspace.	SharedPrivateLinkResource[]
softDeleteRetentionInDays	Retention time in days after workspace get soft deleted.	int
storageAccount	ARM id of the storage account associated with this workspace. This cannot be changed once the workspace has been created	string
storageAccounts		string[]
systemDatastoresAuthMode	The auth mode used for accessing the system datastores of the workspace.	string
v1LegacyMode	Enabling v1_legacy_mode may prevent you from using features provided by the v2 API.	bool
workspaceHubConfig	WorkspaceHub's configuration object.	WorkspaceHubConfig

EncryptionProperty

Name	Description	Value
cosmosDbResourceId	The byok cosmosdb account that customer brings to store customer's data with encryption	string
identity	Identity to be used with the keyVault	IdentityForCmk
keyVaultProperties	KeyVault details to do the encryption	KeyVaultProperties (required)
searchAccountResourceId	The byok search account that customer brings to store customer's data with encryption	string
status	Indicates whether or not the encryption is enabled for the workspace.	"Disabled" "Enabled" (required)
storageAccountResourceId	The byok storage account that customer brings to store customer's data with encryption	string

IdentityForCmk

Name	Description	Value
userAssignedIdentity	UserAssignedIdentity to be used to fetch the encryption key from keyVault	string

KeyVaultProperties

Name	Description	Value
identityClientId	Currently, we support only SystemAssigned MSI. We need this when we support UserAssignedIdentities	string
keyIdentifier	KeyVault key identifier to encrypt the data	string (required) Constraints: Min length = 1 Pattern = `[a-zA-Z0-9_]`
keyVaultArmId	KeyVault Arm Id that contains the data encryption key	string (required) Constraints: Min length = 1 Pattern = `[a-zA-Z0-9_]`

FeatureStoreSettings

Name	Description	Value
computeRuntime		ComputeRuntimeDto
offlineStoreConnectionName		string
onlineStoreConnectionName		string

ComputeRuntimeDto

Name	Description	Value
sparkRuntimeVersion		string

ManagedNetworkSettings

Name	Description	Value
isolationMode	Isolation mode for the managed network of a machine learning workspace.	"AllowInternetOutbound" "AllowOnlyApprovedOutbound" "Disabled"
outboundRules	Dictionary of {OutboundRule}	ManagedNetworkSettingsOutboundRules
status	Status of the Provisioning for the managed network of a machine learning workspace.	ManagedNetworkProvisionStatus

ManagedNetworkSettingsOutboundRules

Name	Description	Value
{customized property}		OutboundRule

OutboundRule

Name	Description	Value
category	Category of a managed network Outbound Rule of a machine learning workspace.	"Dependency" "Recommended" "Required" "UserDefined"
status	Type of a managed network Outbound Rule of a machine learning workspace.	"Active" "Inactive"
type	Set the object type	FQDN PrivateEndpoint ServiceTag (required)

FqdnOutboundRule

Name	Description	Value
type	Type of a managed network Outbound Rule of a machine learning workspace.	"FQDN" (required)
destination		string

PrivateEndpointOutboundRule

Name	Description	Value
type	Type of a managed network Outbound Rule of a machine learning workspace.	"PrivateEndpoint" (required)
destination	Private Endpoint destination for a Private Endpoint Outbound Rule for the managed network of a machine learning workspace.	PrivateEndpointDestination
parentRuleNames		string[]

PrivateEndpointDestination

Name	Description	Value
serviceResourceId		string
sparkEnabled		bool
sparkStatus	Type of a managed network Outbound Rule of a machine learning workspace.	"Active" "Inactive"
subresourceTarget		string

ServiceTagOutboundRule

Name	Description	Value
type	Type of a managed network Outbound Rule of a machine learning workspace.	"ServiceTag" (required)
destination	Service Tag destination for a Service Tag Outbound Rule for the managed network of a machine learning workspace.	ServiceTagDestination

ServiceTagDestination

Name	Description	Value
action	The action enum for networking rule.	"Allow" "Deny"
portRanges		string
protocol		string
serviceTag		string

ManagedNetworkProvisionStatus

Name	Description	Value
sparkReady		bool
status	Status for the managed network of a machine learning workspace.	"Active" "Inactive"

ServerlessComputeSettings

Name	Description	Value
serverlessComputeCustomSubnet	The resource ID of an existing virtual network subnet in which serverless compute nodes should be deployed	string
serverlessComputeNoPublicIP	The flag to signal if serverless compute nodes deployed in custom vNet would have no public IP addresses for a workspace with private endpoint	bool

ServiceManagedResourcesSettings

Name	Description	Value
cosmosDb		CosmosDbSettings

CosmosDbSettings

Name	Description	Value
collectionsThroughput		int

SharedPrivateLinkResource

Name	Description	Value
name	Unique name of the private link	string
properties	Properties of a shared private link resource.	SharedPrivateLinkResourceProperty

SharedPrivateLinkResourceProperty

Name	Description	Value
groupId	group id of the private link	string
privateLinkResourceId	the resource id that private link links to	string
requestMessage	Request message	string
status	Connection status of the service consumer with the service provider	"Approved" "Disconnected" "Pending" "Rejected" "Timeout"

WorkspaceHubConfig

Name	Description	Value
additionalWorkspaceStorageAccounts		string[]
defaultWorkspaceResourceGroup		string

Sku

Name	Description	Value
capacity	If the SKU supports scale out/in then the capacity integer should be included. If scale out/in is not possible for the resource this may be omitted.	int
family	If the service has different generations of hardware, for the same SKU, then that can be captured here.	string
name	The name of the SKU. Ex - P3. It is typically a letter+number code	string (required)
size	The SKU size. When the name field is the combination of tier and some other value, this would be the standalone code.	string
tier	This field is required to be implemented by the Resource Provider if the service has more than one tier, but is not required on a PUT.	"Basic" "Free" "Premium" "Standard"

Share via

Microsoft.MachineLearningServices workspaces

Bicep resource definition

Resource format

OutboundRule objects

Property values

workspaces

ManagedServiceIdentity

UserAssignedIdentities

UserAssignedIdentity

WorkspaceProperties

EncryptionProperty

IdentityForCmk

KeyVaultProperties

FeatureStoreSettings

ComputeRuntimeDto

ManagedNetworkSettings

ManagedNetworkSettingsOutboundRules

OutboundRule

FqdnOutboundRule

PrivateEndpointOutboundRule

PrivateEndpointDestination

ServiceTagOutboundRule

ServiceTagDestination

ManagedNetworkProvisionStatus

ServerlessComputeSettings

ServiceManagedResourcesSettings

CosmosDbSettings

SharedPrivateLinkResource

SharedPrivateLinkResourceProperty

WorkspaceHubConfig

Sku

Quickstart templates

ARM template resource definition

Resource format

OutboundRule objects

Property values

workspaces

ManagedServiceIdentity

UserAssignedIdentities

UserAssignedIdentity

WorkspaceProperties

EncryptionProperty

IdentityForCmk

KeyVaultProperties

FeatureStoreSettings

ComputeRuntimeDto

ManagedNetworkSettings

ManagedNetworkSettingsOutboundRules

OutboundRule

FqdnOutboundRule

PrivateEndpointOutboundRule

PrivateEndpointDestination

ServiceTagOutboundRule

ServiceTagDestination

ManagedNetworkProvisionStatus

ServerlessComputeSettings

ServiceManagedResourcesSettings

CosmosDbSettings

SharedPrivateLinkResource

SharedPrivateLinkResourceProperty

WorkspaceHubConfig

Sku

Quickstart templates

Terraform (AzAPI provider) resource definition

Resource format

OutboundRule objects

Property values

workspaces

ManagedServiceIdentity

UserAssignedIdentities

UserAssignedIdentity

WorkspaceProperties

EncryptionProperty

IdentityForCmk

KeyVaultProperties

FeatureStoreSettings

ComputeRuntimeDto

ManagedNetworkSettings

ManagedNetworkSettingsOutboundRules