Question

Your team runs Azure Machine Learning training jobs that read from an Azure Blob Storage account. Security policy prohibits storing storage account keys or SAS tokens in the workspace. You register the storage as a datastore and need the compute cluster to authenticate to the blob container without embedded credentials. What should you do?

Accepted Answer

Enable a system-assigned managed identity on the compute cluster and grant it the Storage Blob Data Reader role on the storage account, then register a credential-less datastore using identity-based access.

Answer

Create the datastore using the storage account key and store the key in Azure Key Vault referenced by the workspace.

Answer

Generate a short-lived SAS token for the container and configure the datastore to refresh it automatically through a scheduled pipeline.

Answer

Set the workspace to public network access and use the storage account's connection string in the job's environment variables.