Question

Your team is deploying a new Azure Machine Learning workspace with Azure CLI (ml extension). You must create a datastore that connects to an existing Azure Data Lake Storage Gen2 container using a service principal. Company policy forbids storing the client secret in any YAML file, Bicep template, or command-line argument that could end up in source control. How should you supply the service principal credential when running 'az ml datastore create'?

Accepted Answer

Retrieve the secret from Azure Key Vault at pipeline runtime and pass it into the datastore YAML via an environment-variable substitution that is never committed to Git.

Answer

Store the client secret in Azure Key Vault and reference it in the datastore YAML using an inline plaintext value pulled at deploy time.

Answer

Hardcode the client secret in the datastore YAML file but add that file to .gitignore so it is excluded from source control.

Answer

Grant the workspace managed identity access to the storage account so no service principal credential is required at all.