Question

Your team's security policy prohibits storing storage account access keys or SAS tokens anywhere in the Azure Machine Learning workspace. Data scientists must still be able to read training data from an existing Azure Data Lake Storage Gen2 container through a registered datastore. Users each have their own Microsoft Entra ID identity. What should you configure when registering the datastore so that data access is authorized using the user's own identity rather than stored credentials?

Accepted Answer

Register a credential-less datastore and grant each user's Entra ID the Storage Blob Data Reader role on the storage account

Answer

Register the datastore with an account key stored in Azure Key Vault and reference it via a secret

Answer

Register the datastore using a service principal with a client secret shared by the team

Answer

Register the datastore with a SAS token scoped to the container with read-only permissions