Workspaces - List By Subscription

Lists all the available machine learning workspaces under the specified subscription.

GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.MachineLearningServices/workspaces?api-version=2026-09-01
GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.MachineLearningServices/workspaces?api-version=2026-09-01&kind={kind}&$skip={$skip}&aiCapabilities={aiCapabilities}

URI Parameters

Name In Required Type Description
subscriptionId
path True

string

minLength: 1

The ID of the target subscription.

api-version
query True

string

minLength: 1

The API version to use for this operation.

$skip
query

string

Continuation token for pagination.

aiCapabilities
query

string

kind
query

string

Kind of workspace.

Responses

Name Type Description
200 OK

WorkspaceListResult

Azure operation completed successfully.

Other Status Codes

ErrorResponse

An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Get Workspaces by subscription

Sample request

GET https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/providers/Microsoft.MachineLearningServices/workspaces?api-version=2026-09-01

Sample response

{
  "nextLink": "https://management.azure.com/subscriptions/34adfa4f-cedf-4dc0-ba29-b6d1a69ab345/providers/Microsoft.MachineLearningServices/workspaces?api-version=2026-09-01&$skip=2",
  "value": [
    {
      "name": "testworkspace",
      "type": "Microsoft.MachineLearningServices/workspaces",
      "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/workspace-1234/providers/Microsoft.MachineLearningServices/workspaces/testworkspace",
      "location": "eastus2euap",
      "properties": {
        "description": "test description",
        "applicationInsights": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/workspace-1234/providers/microsoft.insights/components/testinsights",
        "containerRegistry": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/workspace-1234/providers/Microsoft.ContainerRegistry/registries/testRegistry",
        "discoveryUrl": "http://example.com",
        "friendlyName": "HelloName",
        "keyVault": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/workspace-1234/providers/Microsoft.KeyVault/vaults/testkv",
        "storageAccount": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/accountcrud-1234/providers/Microsoft.Storage/storageAccounts/testStorageAccount"
      }
    },
    {
      "name": "testworkspace",
      "type": "Microsoft.MachineLearningServices/workspaces",
      "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/workspace-5678/providers/Microsoft.MachineLearningServices/workspaces/testworkspace",
      "location": "eastus2euap",
      "properties": {
        "description": "test description",
        "applicationInsights": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/workspace-1234/providers/microsoft.insights/components/testinsights",
        "containerRegistry": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/workspace-1234/providers/Microsoft.ContainerRegistry/registries/testRegistryNew",
        "discoveryUrl": "http://example.com",
        "friendlyName": "HelloName",
        "keyVault": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/workspace-1234/providers/Microsoft.KeyVault/vaults/testkvNew",
        "storageAccount": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/accountcrud-1234/providers/Microsoft.Storage/storageAccounts/testStorageAccountOld"
      }
    }
  ]
}

Definitions

Name Description
ComputeRuntimeDto
CosmosDbSettings
createdByType

The type of identity that created the resource.

EncryptionProperty
EncryptionStatus

Indicates whether or not the encryption is enabled for the workspace.

EndpointServiceConnectionStatus

Connection status of the service consumer with the service provider

ErrorAdditionalInfo

The resource management error additional info.

ErrorDetail

The error detail.

ErrorResponse

Error response

FeatureStoreSettings
FirewallSku

Firewall Sku used for FQDN Rules

FqdnOutboundRule

FQDN Outbound Rule for the managed network of a machine learning workspace.

IdentityForCmk

Identity object used for encryption.

IsolationMode

Isolation mode for the managed network of a machine learning workspace.

KeyVaultProperties

Customer Key vault properties.

ManagedNetworkKind

The Kind of the managed network. Users can switch from V1 to V2 for granular access controls, but cannot switch back to V1 once V2 is enabled.

ManagedNetworkProvisionStatus

Status of the Provisioning for the managed network of a machine learning workspace.

ManagedNetworkSettings

Managed Network settings for a machine learning workspace.

ManagedNetworkStatus

Status for the managed network of a machine learning workspace.

ManagedServiceIdentity

Managed service identity (system assigned and/or user assigned identities)

ManagedServiceIdentityType

Type of managed service identity (where both SystemAssigned and UserAssigned types are allowed).

NotebookPreparationError
NotebookResourceInfo
PrivateEndpointConnection

The Private Endpoint Connection resource.

PrivateEndpointConnectionProvisioningState

The current provisioning state.

PrivateEndpointDestination

Private Endpoint destination for a Private Endpoint Outbound Rule for the managed network of a machine learning workspace.

PrivateEndpointOutboundRule

Private Endpoint Outbound Rule for the managed network of a machine learning workspace.

PrivateLinkServiceConnectionState

A collection of information about the state of the connection between service consumer and provider.

ProvisioningState

The provision state of the cluster. Valid values are Unknown, Updating, Provisioning, Succeeded, and Failed.

PublicNetworkAccessType

Enum to determine whether PublicNetworkAccess is Enabled or Disabled.

RuleAction

The action enum for networking rule.

RuleCategory

Category of a managed network Outbound Rule of a machine learning workspace.

RuleStatus

Type of a managed network Outbound Rule of a machine learning workspace.

RuleType

Type of a managed network Outbound Rule of a machine learning workspace.

ServerlessComputeSettings
ServiceManagedResourcesSettings
ServiceTagDestination

Service Tag destination for a Service Tag Outbound Rule for the managed network of a machine learning workspace.

ServiceTagOutboundRule

Service Tag Outbound Rule for the managed network of a machine learning workspace.

SharedPrivateLinkResource
Sku

The resource model definition representing SKU

SkuTier

This field is required to be implemented by the Resource Provider if the service has more than one tier, but is not required on a PUT.

systemData

Metadata pertaining to creation and last modification of the resource.

SystemDatastoresAuthMode

The auth mode used for accessing the system datastores of the workspace.

UserAssignedIdentity

User assigned identity properties

Workspace

An object that represents a machine learning workspace.

WorkspaceHubConfig

WorkspaceHub's configuration object.

WorkspaceListResult

The response of a Workspace list operation.

WorkspacePrivateEndpointResource

The Private Endpoint resource.

ComputeRuntimeDto

Name Type Description
sparkRuntimeVersion

string

CosmosDbSettings

Name Type Description
collectionsThroughput

integer (int32)

createdByType

The type of identity that created the resource.

Value Description
User
Application
ManagedIdentity
Key

EncryptionProperty

Name Type Description
cosmosDbResourceId

string

The byok cosmosdb account that customer brings to store customer's data with encryption

identity

IdentityForCmk

Identity to be used with the keyVault

keyVaultProperties

KeyVaultProperties

KeyVault details to do the encryption

searchAccountResourceId

string

The byok search account that customer brings to store customer's data with encryption

status

EncryptionStatus

Indicates whether or not the encryption is enabled for the workspace.

storageAccountResourceId

string

The byok storage account that customer brings to store customer's data with encryption

EncryptionStatus

Indicates whether or not the encryption is enabled for the workspace.

Value Description
Enabled
Disabled

EndpointServiceConnectionStatus

Connection status of the service consumer with the service provider

Value Description
Approved
Pending
Rejected
Disconnected
Timeout

ErrorAdditionalInfo

The resource management error additional info.

Name Type Description
info

object

The additional info.

type

string

The additional info type.

ErrorDetail

The error detail.

Name Type Description
additionalInfo

ErrorAdditionalInfo[]

The error additional info.

code

string

The error code.

details

ErrorDetail[]

The error details.

message

string

The error message.

target

string

The error target.

ErrorResponse

Error response

Name Type Description
error

ErrorDetail

The error object.

FeatureStoreSettings

Name Type Description
computeRuntime

ComputeRuntimeDto

offlineStoreConnectionName

string

onlineStoreConnectionName

string

FirewallSku

Firewall Sku used for FQDN Rules

Value Description
Standard
Basic

FqdnOutboundRule

FQDN Outbound Rule for the managed network of a machine learning workspace.

Name Type Description
category

RuleCategory

Category of a managed network Outbound Rule of a machine learning workspace.

destination

string

errorInformation

string

Error information about an outbound rule of a machine learning workspace if RuleStatus is failed.

parentRuleNames

string[]

status

RuleStatus

Type of a managed network Outbound Rule of a machine learning workspace.

type string:

FQDN

Type of a managed network Outbound Rule of a machine learning workspace.

IdentityForCmk

Identity object used for encryption.

Name Type Description
userAssignedIdentity

string

UserAssignedIdentity to be used to fetch the encryption key from keyVault

IsolationMode

Isolation mode for the managed network of a machine learning workspace.

Value Description
Disabled
AllowInternetOutbound
AllowOnlyApprovedOutbound

KeyVaultProperties

Customer Key vault properties.

Name Type Description
identityClientId

string

Currently, we support only SystemAssigned MSI. We need this when we support UserAssignedIdentities

keyIdentifier

string

minLength: 1
pattern: [a-zA-Z0-9_]

KeyVault key identifier to encrypt the data

keyVaultArmId

string

minLength: 1
pattern: [a-zA-Z0-9_]

KeyVault Arm Id that contains the data encryption key

ManagedNetworkKind

The Kind of the managed network. Users can switch from V1 to V2 for granular access controls, but cannot switch back to V1 once V2 is enabled.

Value Description
V1
V2

ManagedNetworkProvisionStatus

Status of the Provisioning for the managed network of a machine learning workspace.

Name Type Description
sparkReady

boolean

status

ManagedNetworkStatus

Status for the managed network of a machine learning workspace.

ManagedNetworkSettings

Managed Network settings for a machine learning workspace.

Name Type Default value Description
enableNetworkMonitor

boolean

False

A flag to indicate if monitoring needs to be enabled for the managed network.

firewallPublicIpAddress

string

Public IP address assigned to the Azure Firewall.

firewallSku

FirewallSku

Firewall Sku used for FQDN Rules

isolationMode

IsolationMode

Isolation mode for the managed network of a machine learning workspace.

managedNetworkKind

ManagedNetworkKind

The Kind of the managed network. Users can switch from V1 to V2 for granular access controls, but cannot switch back to V1 once V2 is enabled.

networkId

string

outboundRules

object

Dictionary of <OutboundRule>

status

ManagedNetworkProvisionStatus

Status of the Provisioning for the managed network of a machine learning workspace.

ManagedNetworkStatus

Status for the managed network of a machine learning workspace.

Value Description
Inactive
Active

ManagedServiceIdentity

Managed service identity (system assigned and/or user assigned identities)

Name Type Description
principalId

string (uuid)

The service principal ID of the system assigned identity. This property will only be provided for a system assigned identity.

tenantId

string (uuid)

The tenant ID of the system assigned identity. This property will only be provided for a system assigned identity.

type

ManagedServiceIdentityType

Type of managed service identity (where both SystemAssigned and UserAssigned types are allowed).

userAssignedIdentities

<string,  UserAssignedIdentity>

User-Assigned Identities
The set of user assigned identities associated with the resource. The userAssignedIdentities dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. The dictionary values can be empty objects ({}) in requests.

ManagedServiceIdentityType

Type of managed service identity (where both SystemAssigned and UserAssigned types are allowed).

Value Description
None
SystemAssigned
UserAssigned
SystemAssigned,UserAssigned

NotebookPreparationError

Name Type Description
errorMessage

string

statusCode

integer (int32)

NotebookResourceInfo

Name Type Description
fqdn

string

isPrivateLinkEnabled

boolean

notebookPreparationError

NotebookPreparationError

The error that occurs when preparing notebook.

resourceId

string

the data plane resourceId that used to initialize notebook component

PrivateEndpointConnection

The Private Endpoint Connection resource.

Name Type Description
id

string

Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}

identity

ManagedServiceIdentity

The managed service identities assigned to this resource.

location

string

*Same as workspace location.

name

string

The name of the resource

properties.privateEndpoint

WorkspacePrivateEndpointResource

The Private Endpoint resource.

properties.privateLinkServiceConnectionState

PrivateLinkServiceConnectionState

The connection state.

properties.provisioningState

PrivateEndpointConnectionProvisioningState

The current provisioning state.

sku

Sku

Optional. This field is required to be implemented by the RP because AML is supporting more than one tier

systemData

systemData

Azure Resource Manager metadata containing createdBy and modifiedBy information.

tags

object

type

string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

PrivateEndpointConnectionProvisioningState

The current provisioning state.

Value Description
Succeeded
Creating
Deleting
Failed

PrivateEndpointDestination

Private Endpoint destination for a Private Endpoint Outbound Rule for the managed network of a machine learning workspace.

Name Type Description
serviceResourceId

string (arm-id)

A type definition that refers the id to an Azure Resource Manager resource.

sparkEnabled

boolean

sparkStatus

RuleStatus

Type of a managed network Outbound Rule of a machine learning workspace.

subresourceTarget

string

PrivateEndpointOutboundRule

Private Endpoint Outbound Rule for the managed network of a machine learning workspace.

Name Type Description
category

RuleCategory

Category of a managed network Outbound Rule of a machine learning workspace.

destination

PrivateEndpointDestination

Private Endpoint destination for a Private Endpoint Outbound Rule for the managed network of a machine learning workspace.

errorInformation

string

Error information about an outbound rule of a machine learning workspace if RuleStatus is failed.

fqdns

string[]

parentRuleNames

string[]

status

RuleStatus

Type of a managed network Outbound Rule of a machine learning workspace.

type string:

PrivateEndpoint

Type of a managed network Outbound Rule of a machine learning workspace.

PrivateLinkServiceConnectionState

A collection of information about the state of the connection between service consumer and provider.

Name Type Description
actionsRequired

string

Some RP chose "None". Other RPs use this for region expansion.

description

string

User-defined message that, per NRP doc, may be used for approval-related message.

status

EndpointServiceConnectionStatus

Connection status of the service consumer with the service provider\r\nPossible state transitions\r\nPending -> Approved (Service provider approves the connection request)\r\nPending -> Rejected (Service provider rejects the connection request)\r\nPending -> Disconnected (Service provider deletes the connection)\r\nApproved -> Rejected (Service provider rejects the approved connection)\r\nApproved -> Disconnected (Service provider deletes the connection)\r\nRejected -> Pending (Service consumer re-initiates the connection request that was rejected)\r\nRejected -> Disconnected (Service provider deletes the connection)

ProvisioningState

The provision state of the cluster. Valid values are Unknown, Updating, Provisioning, Succeeded, and Failed.

Value Description
Unknown
Updating
Creating
Deleting
Succeeded
Failed
Canceled

PublicNetworkAccessType

Enum to determine whether PublicNetworkAccess is Enabled or Disabled.

Value Description
Enabled
Disabled

RuleAction

The action enum for networking rule.

Value Description
Allow
Deny

RuleCategory

Category of a managed network Outbound Rule of a machine learning workspace.

Value Description
Required
Recommended
UserDefined
Dependency

RuleStatus

Type of a managed network Outbound Rule of a machine learning workspace.

Value Description
Inactive
Active
Provisioning
Deleting
Failed

RuleType

Type of a managed network Outbound Rule of a machine learning workspace.

Value Description
FQDN
PrivateEndpoint
ServiceTag

ServerlessComputeSettings

Name Type Description
serverlessComputeCustomSubnet

string (arm-id)

The resource ID of an existing virtual network subnet in which serverless compute nodes should be deployed

serverlessComputeNoPublicIP

boolean

The flag to signal if serverless compute nodes deployed in custom vNet would have no public IP addresses for a workspace with private endpoint

ServiceManagedResourcesSettings

Name Type Description
cosmosDb

CosmosDbSettings

ServiceTagDestination

Service Tag destination for a Service Tag Outbound Rule for the managed network of a machine learning workspace.

Name Type Description
action

RuleAction

The action enum for networking rule.

addressPrefixes

string[]

Optional, if provided, the ServiceTag property will be ignored.

portRanges

string

protocol

string

serviceTag

string

ServiceTagOutboundRule

Service Tag Outbound Rule for the managed network of a machine learning workspace.

Name Type Description
category

RuleCategory

Category of a managed network Outbound Rule of a machine learning workspace.

destination

ServiceTagDestination

Service Tag destination for a Service Tag Outbound Rule for the managed network of a machine learning workspace.

errorInformation

string

Error information about an outbound rule of a machine learning workspace if RuleStatus is failed.

parentRuleNames

string[]

status

RuleStatus

Type of a managed network Outbound Rule of a machine learning workspace.

type string:

ServiceTag

Type of a managed network Outbound Rule of a machine learning workspace.

SharedPrivateLinkResource

Name Type Description
name

string

Unique name of the private link

properties.groupId

string

group id of the private link

properties.privateLinkResourceId

string

the resource id that private link links to

properties.requestMessage

string

Request message

properties.status

EndpointServiceConnectionStatus

Connection status of the service consumer with the service provider\r\nPossible state transitions\r\nPending -> Approved (Service provider approves the connection request)\r\nPending -> Rejected (Service provider rejects the connection request)\r\nPending -> Disconnected (Service provider deletes the connection)\r\nApproved -> Rejected (Service provider rejects the approved connection)\r\nApproved -> Disconnected (Service provider deletes the connection)\r\nRejected -> Pending (Service consumer re-initiates the connection request that was rejected)\r\nRejected -> Disconnected (Service provider deletes the connection)

Sku

The resource model definition representing SKU

Name Type Description
capacity

integer (int32)

If the SKU supports scale out/in then the capacity integer should be included. If scale out/in is not possible for the resource this may be omitted.

family

string

If the service has different generations of hardware, for the same SKU, then that can be captured here.

name

string

The name of the SKU. Ex - P3. It is typically a letter+number code

size

string

The SKU size. When the name field is the combination of tier and some other value, this would be the standalone code.

tier

SkuTier

This field is required to be implemented by the Resource Provider if the service has more than one tier, but is not required on a PUT.

SkuTier

This field is required to be implemented by the Resource Provider if the service has more than one tier, but is not required on a PUT.

Value Description
Free
Basic
Standard
Premium

systemData

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt

string (date-time)

The timestamp of resource creation (UTC).

createdBy

string

The identity that created the resource.

createdByType

createdByType

The type of identity that created the resource.

lastModifiedAt

string (date-time)

The timestamp of resource last modification (UTC)

lastModifiedBy

string

The identity that last modified the resource.

lastModifiedByType

createdByType

The type of identity that last modified the resource.

SystemDatastoresAuthMode

The auth mode used for accessing the system datastores of the workspace.

Value Description
AccessKey
Identity
UserDelegationSAS

UserAssignedIdentity

User assigned identity properties

Name Type Description
clientId

string (uuid)

The client ID of the assigned identity.

principalId

string (uuid)

The principal ID of the assigned identity.

Workspace

An object that represents a machine learning workspace.

Name Type Description
id

string

Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}

identity

ManagedServiceIdentity

The managed service identities assigned to this resource.

kind

string

location

string

name

string

The name of the resource

properties.allowPublicAccessWhenBehindVnet

boolean

The flag to indicate whether to allow public access when behind VNet.

properties.applicationInsights

string

ARM id of the application insights associated with this workspace.

properties.associatedWorkspaces

string[]

properties.containerRegistry

string

ARM id of the container registry associated with this workspace.

properties.description

string

The description of this workspace.

properties.discoveryUrl

string

Url for the discovery service to identify regional endpoints for machine learning experimentation services

properties.enableDataIsolation

boolean

properties.enableServiceSideCMKEncryption

boolean

properties.encryption

EncryptionProperty

properties.featureStoreSettings

FeatureStoreSettings

Settings for feature store type workspace.

properties.friendlyName

string

The friendly name for this workspace. This name in mutable

properties.hbiWorkspace

boolean

The flag to signal HBI data in the workspace and reduce diagnostic data collected by the service

properties.hubResourceId

string

properties.imageBuildCompute

string

The compute name for image build

properties.keyVault

string

ARM id of the key vault associated with this workspace. This cannot be changed once the workspace has been created

properties.managedNetwork

ManagedNetworkSettings

Managed Network settings for a machine learning workspace.

properties.mlFlowTrackingUri

string

The URI associated with this workspace that machine learning flow must point at to set up tracking.

properties.notebookInfo

NotebookResourceInfo

The notebook info of Azure ML workspace.

properties.primaryUserAssignedIdentity

string

The user assigned identity resource id that represents the workspace identity.

properties.privateEndpointConnections

PrivateEndpointConnection[]

The list of private endpoint connections in the workspace.

properties.privateLinkCount

integer (int32)

Count of private connections in the workspace

properties.provisionNetworkNow

boolean

Set to trigger the provisioning of the managed VNet with the default Options when creating a Workspace with the managed VNet enabled, or else it does nothing.

properties.provisioningState

ProvisioningState

The current deployment state of workspace resource. The provisioningState is to indicate states for resource provisioning.

properties.publicNetworkAccess

PublicNetworkAccessType

Whether requests from Public Network are allowed.

properties.serverlessComputeSettings

ServerlessComputeSettings

Settings for serverless compute in a workspace

properties.serviceManagedResourcesSettings

ServiceManagedResourcesSettings

The service managed resource settings.

properties.serviceProvisionedResourceGroup

string

The name of the managed resource group created by workspace RP in customer subscription if the workspace is CMK workspace

properties.sharedPrivateLinkResources

SharedPrivateLinkResource[]

The list of shared private link resources in this workspace.

properties.storageAccount

string

ARM id of the storage account associated with this workspace. This cannot be changed once the workspace has been created

properties.storageHnsEnabled

boolean

If the storage associated with the workspace has hierarchical namespace(HNS) enabled.

properties.systemDatastoresAuthMode

SystemDatastoresAuthMode

The auth mode used for accessing the system datastores of the workspace.

properties.tenantId

string

The tenant id associated with this workspace.

properties.v1LegacyMode

boolean

Enabling v1_legacy_mode may prevent you from using features provided by the v2 API.

properties.workspaceHubConfig

WorkspaceHubConfig

WorkspaceHub's configuration object.

properties.workspaceId

string

The immutable id associated with this workspace.

sku

Sku

Optional. This field is required to be implemented by the RP because AML is supporting more than one tier

systemData

systemData

Azure Resource Manager metadata containing createdBy and modifiedBy information.

tags

object

type

string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

WorkspaceHubConfig

WorkspaceHub's configuration object.

Name Type Description
additionalWorkspaceStorageAccounts

string[]

defaultWorkspaceResourceGroup

string

WorkspaceListResult

The response of a Workspace list operation.

Name Type Description
nextLink

string (uri)

The link to the next page of items

value

Workspace[]

The Workspace items on this page

WorkspacePrivateEndpointResource

The Private Endpoint resource.

Name Type Description
id

string

e.g. /subscriptions/{networkSubscriptionId}/resourceGroups/{rgName}/providers/Microsoft.Network/privateEndpoints/{privateEndpointName}

subnetArmId

string

The subnetId that the private endpoint is connected to.