Network Isolation and Git Source Control

What it is

By default a workspace is reachable over the public internet (with Microsoft Entra authentication). Two controls restrict it: a private endpoint that gives the workspace a private IP in your virtual network, and a managed virtual network that Azure creates to isolate compute. Separately, Git keeps code, pipeline definitions and infrastructure under version control so every change is reviewed and reversible.

How it works

Block public access

Set public network access to disabled and create a private endpoint for the workspace (sub resource amlworkspace). Clients then reach the studio, SDK and CLI only from networks that can resolve and route to the private IP.

# workspace.yml (fragment)
name: mlw-prod
location: eastus
public_network_access: disabled

Private DNS must resolve the workspace names to the private IP. The relevant private DNS zones are privatelink.api.azureml.ms and privatelink.notebooks.azure.net. If DNS still returns a public IP, the private endpoint is bypassed, which is the most common cause of "cannot reach the workspace" in this setup. A private endpoint only covers data plane access: management operations such as creating compute still use the public Azure control plane. With private dependencies, image builds cannot use Container Registry tasks, so set image_build_compute to a compute cluster.

Managed virtual network

A workspace managed virtual network is created and run by Azure Machine Learning, and compute instances, clusters, serverless jobs and managed online endpoints can run inside it. You pick an isolation mode.

managed_network:
  isolation_mode: allow_only_approved_outbound

Outbound rules are of three kinds: private endpoint (to your storage, Key Vault, Azure AI Search and so on), service tag and FQDN. The managed network is provisioned when the first compute is created, or earlier with az ml workspace provision-network. For maximum control (for example to stop data exfiltration), use allow only approved outbound.

Related controls

• Give the dependent storage account, Key Vault and container registry private endpoints as well, otherwise jobs cannot reach them.
• Online endpoints have their own public_network_access setting. Set it to disabled to accept only private traffic.
• Clusters in your own virtual network use enable_node_public_ip: false so nodes have no public IP.
• Azure Policy can require private networking so new workspaces cannot be created without it.

Git for machine learning projects

A typical repository layout:

repo/
  infra/            Bicep templates
  src/              training and scoring code
  components/       component YAML
  jobs/             job and pipeline YAML
  notebooks/        exploration (outputs cleared)
  .github/workflows/

Jobs submitted from a Git working directory record the repository, branch and commit with the run, which links a model back to the code that trained it.

A worked example

A bank requires that no ML traffic crosses the internet. The team disables public access on the workspace, adds private endpoints for the workspace, storage, Key Vault and registry, sets the managed network to allow only approved outbound, and adds one FQDN rule for the Python package mirror they use. Code changes flow through pull requests into a protected main branch.

How the exam asks about this

• "The workspace must not be reachable from the internet." Disable public network access and use a private endpoint.
• "Compute may reach only listed destinations." Managed network with allow only approved outbound and outbound rules.
• "Show which code produced a registered model." Run from Git so the commit is recorded with the job.