Question

Your team must provision an Azure Machine Learning workspace using Bicep as part of a GitHub Actions pipeline. Company security policy requires that the workspace and its associated resources (storage account, key vault) not be reachable from the public internet, and that all traffic flow through the corporate virtual network. Which combination should you configure in the Bicep template to meet this requirement?

Accepted Answer

Set the workspace 'publicNetworkAccess' property to 'Disabled' and deploy a private endpoint for the workspace and its dependent resources into the corporate VNet subnet.

Answer

Set the workspace SKU to 'Basic' and assign a system-assigned managed identity to the workspace.

Answer

Enable a service endpoint for Microsoft.MachineLearningServices on the subnet and leave 'publicNetworkAccess' at its default value.

Answer

Configure IP firewall rules on the storage account to allow only the GitHub Actions runner IP ranges.