Question

Your organization's security policy requires that all traffic to an Azure Machine Learning workspace stay on the corporate virtual network, with no inbound access from the public internet. Data scientists connect from on-premises workstations through an ExpressRoute-connected hub VNet. You need to configure the workspace so inbound connections are only possible from within the private network. Which approach meets this requirement?

Accepted Answer

Create a private endpoint for the workspace in the VNet and set the workspace public network access to Disabled.

Answer

Add the on-premises IP ranges to the workspace's IP-based firewall allow list while leaving public network access Enabled.

Answer

Assign a user-assigned managed identity to the workspace and grant it the Network Contributor role on the VNet.

Answer

Enable a service endpoint for Microsoft.MachineLearningServices on the workspace subnet and keep the default public access.