Workspace Managed Virtual Network Isolation

• An Azure subscription. If you don't have an Azure subscription, create a free account before you begin. Try the free or paid version of Azure Machine Learning.

• The Microsoft.Network resource provider must be registered for your Azure subscription. This resource provider is used by the workspace when creating private endpoints for the managed virtual network.

  For information on registering resource providers, see Resolve errors for resource provider registration.

• The Azure identity you use when deploying a managed network requires the following Azure role-based access control (Azure RBAC) actions to create private endpoints:

  • Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read
  • Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write

• The Azure CLI and the ml extension to the Azure CLI. For more information, see Install, set up, and use the CLI (v2).

  Tip

  Azure Machine Learning managed VNet was introduced on May 23rd, 2023. If you have an older version of the ml extension, you may need to update it for the examples in this article work. To update the extension, use the following Azure CLI command:

  az extension update -n ml
  

• The CLI examples in this article assume that you're using the Bash (or compatible) shell. For example, from a Linux system or Windows Subsystem for Linux.

• The Azure CLI examples in this article use ws to represent the name of the workspace, and rg to represent the name of the resource group. Change these values as needed when using the commands with your Azure subscription.

• An Azure subscription. If you don't have an Azure subscription, create a free account before you begin. Try the free or paid version of Azure Machine Learning.

• The Microsoft.Network resource provider must be registered for your Azure subscription. This resource provider is used by the workspace when creating private endpoints for the managed virtual network.

  For information on registering resource providers, see Resolve errors for resource provider registration.

• The Azure identity you use when deploying a managed network requires the following Azure role-based access control (Azure RBAC) actions to create private endpoints:

  • Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read
  • Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write

• The Azure Machine Learning Python SDK v2. For more information on the SDK, see Install the Python SDK v2 for Azure Machine Learning.

  Tip

  Azure Machine learning managed VNet was introduced on May 23rd, 2023. If you have an older version of the SDK installed, you may need to update it for the examples in this article to work. To update the SDK, use the following command:

  pip install --upgrade azure-ai-ml azure-identity
  

• The examples in this article assume that your code begins with the following Python. This code imports the classes required when creating a workspace with managed virtual network, sets variables for your Azure subscription and resource group, and creates the ml_client:

  from azure.ai.ml import MLClient
  from azure.ai.ml.entities import (
      Workspace,
      ManagedNetwork,
      IsolationMode,
      ServiceTagDestination,
      PrivateEndpointDestination,
      FqdnDestination
  )
  from azure.identity import DefaultAzureCredential
  
  # Replace with the values for your Azure subscription and resource group.
  subscription_id = "<SUBSCRIPTION_ID>"
  resource_group = "<RESOURCE_GROUP>"
  
  # get a handle to the subscription
  ml_client = MLClient(DefaultAzureCredential(), subscription_id=subscription_id, resource_group_name=resource_group)
  

• An Azure subscription. If you don't have an Azure subscription, create a free account before you begin. Try the free or paid version of Azure Machine Learning.

• The Microsoft.Network resource provider must be registered for your Azure subscription. This resource provider is used by the workspace when creating private endpoints for the managed virtual network.

  For information on registering resource providers, see Resolve errors for resource provider registration.

• The Azure identity you use when deploying a managed network requires the following Azure role-based access control (Azure RBAC) actions to create private endpoints:

  • Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read
  • Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write

To configure a managed virtual network that allows internet outbound communications, you can use either the --managed-network allow_internet_outbound parameter or a YAML configuration file that contains the following entries:

managed_network:
  isolation_mode: allow_internet_outbound

You can also define outbound rules to other Azure services that the workspace relies on. These rules define private endpoints that allow an Azure resource to securely communicate with the managed virtual network. The following rule demonstrates adding a private endpoint to an Azure Blob resource.

managed_network:
  isolation_mode: allow_internet_outbound
  outbound_rules:
  - name: added-perule
    destination:
      service_resource_id: /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Storage/storageAccounts/<STORAGE_ACCOUNT_NAME>
      spark_enabled: true
      subresource_target: blob
    type: private_endpoint

You can configure a managed virtual network using either the az ml workspace create or az ml workspace update commands:

• Create a new workspace:

  The following example creates a new workspace. The --managed-network allow_internet_outbound parameter configures a managed virtual network for the workspace:

  az ml workspace create --name ws --resource-group rg --managed-network allow_internet_outbound
  

  To create a workspace using a YAML file instead, use the --file parameter and specify the YAML file that contains the configuration settings:

  az ml workspace create --file workspace.yaml --resource-group rg --name ws
  

  The following YAML example defines a workspace with a managed virtual network:

  name: myworkspace
  location: EastUS
  managed_network:
    isolation_mode: allow_internet_outbound
  

• Update an existing workspace:

  Warning

  Before updating an existing workspace to use a managed virtual network, you must delete all computing resources for the workspace. This includes compute instance, compute cluster, and managed online endpoints.

  The following example updates an existing workspace. The --managed-network allow_internet_outbound parameter configures a managed virtual network for the workspace:

  az ml workspace update --name ws --resource-group rg --managed-network allow_internet_outbound
  

  To update an existing workspace using the YAML file, use the --file parameter and specify the YAML file that contains the configuration settings:

  az ml workspace update --file workspace.yaml --name ws --resource-group MyGroup
  

  The following YAML example defines a managed virtual network for the workspace. It also demonstrates how to add a private endpoint connection to a resource used by the workspace; in this example, a private endpoint for a blob store:

  name: myworkspace
  managed_network:
    isolation_mode: allow_internet_outbound
    outbound_rules:
    - name: added-perule
      destination:
        service_resource_id: /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Storage/storageAccounts/<STORAGE_ACCOUNT_NAME>
        spark_enabled: true
        subresource_target: blob
      type: private_endpoint
  

To configure a managed virtual network that allows internet outbound communications, use the ManagedNetwork class to define a network with IsolationMode.ALLOW_INTERNET_OUTBOUND. You can then use the ManagedNetwork object to create a new workspace or update an existing one. To define outbound rules to Azure services that the workspace relies on, use the PrivateEndpointDestination class to define a new private endpoint to the service.

• Create a new workspace:

  The following example creates a new workspace named myworkspace, with an outbound rule named myrule that adds a private endpoint for an Azure Blob store:

  # Basic managed VNet configuration
  network = ManagedNetwork(IsolationMode.ALLOW_INTERNET_OUTBOUND)
  
  # Workspace configuration
  ws = Workspace(
      name="myworkspace",
      location="eastus",
      managed_network=network
  )
  
  # Example private endpoint outbound to a blob
  rule_name = "myrule"
  service_resource_id = "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Storage/storageAccounts/<STORAGE_ACCOUNT_NAME>"
  subresource_target = "blob"
  spark_enabled = True
  
  # Add the outbound 
  ws.managed_network.outbound_rules = [PrivateEndpointDestination(
      name=rule_name, 
      service_resource_id=service_resource_id, 
      subresource_target=subresource_target, 
      spark_enabled=spark_enabled)]
  
  # Create the workspace
  ws = ml_client.workspaces.begin_create(ws).result()
  

• Update an existing workspace:

  Warning

  Before updating an existing workspace to use a managed virtual network, you must delete all computing resources for the workspace. This includes compute instance, compute cluster, and managed online endpoints.

  The following example demonstrates how to create a managed virtual network for an existing Azure Machine Learning workspace named myworkspace:

  # Get the existing workspace
  ml_client = MLClient(DefaultAzureCredential(), subscription_id=subscription_id, resource_group_name=resource_group, workspace_name="myworkspace")
  ws = ml_client.workspaces.get()
  
  # Basic managed VNet configuration
  ws.managed_network = ManagedNetwork(IsolationMode.ALLOW_INTERNET_OUTBOUND)
  
  # Example private endpoint outbound to a blob
  rule_name = "myrule"
  service_resource_id = "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Storage/storageAccounts/<STORAGE_ACCOUNT_NAME>"
  subresource_target = "blob"
  spark_enabled = True
  
  # Add the outbound 
  ws.managed_network.outbound_rules = [PrivateEndpointDestination(
      name=rule_name, 
      service_resource_id=service_resource_id, 
      subresource_target=subresource_target, 
      spark_enabled=spark_enabled)]
  
  # Create the workspace
  ml_client.workspaces.begin_update(ws)
  

• Create a new workspace:

  1. Sign in to the Azure portal, and choose Azure Machine Learning from Create a resource menu.

  2. Provide the required information on the Basics tab.

  3. From the Networking tab, select Private with Internet Outbound.

     

  4. To add an outbound rule, select Add user-defined outbound rules from the Networking tab. From the Workspace outbound rules sidebar, provide the following information:

     • Rule name: A name for the rule. The name must be unique for this workspace.
     • Destination type: Private Endpoint is the only option when the network isolation is private with internet outbound. Azure Machine Learning managed virtual network doesn't support creating a private endpoint to all Azure resource types. For a list of supported resources, see the Private endpoints section.
     • Subscription: The subscription that contains the Azure resource you want to add a private endpoint for.
     • Resource group: The resource group that contains the Azure resource you want to add a private endpoint for.
     • Resource type: The type of the Azure resource.
     • Resource name: The name of the Azure resource.
     • Sub Resource: The sub resource of the Azure resource type.
     • Spark enabled: Select this option if you want to enable serverless Spark jobs for the workspace. This option is only available if the resource type is Azure Storage.

     

     Select Save to save the rule. You can continue using Add user-defined outbound rules to add rules.

  5. Continue creating the workspace as normal.

• Update an existing workspace:

  Warning

  Before updating an existing workspace to use a managed virtual network, you must delete all computing resources for the workspace. This includes compute instance, compute cluster, and managed online endpoints.

  1. Sign in to the Azure portal, and select the Azure Machine Learning workspace that you want to enable managed virtual network isolation for.

  2. Select Networking, Workspace managed outbound access, and then Allow Internet Outbound.

     

     • To add an outbound rule, select Add user-defined outbound rules. From the Workspace outbound rules sidebar, provide the same information as used when creating a workspace in the 'Create a new workspace' section.

       

     • To delete an outbound rule, select delete for the rule.

       

  3. Select Save at the top of the page to save the changes to the managed virtual network.

To configure a managed virtual network that allows only approved outbound communications, you can use either the --managed-network allow_only_approved_outbound parameter or a YAML configuration file that contains the following entries:

managed_network:
  isolation_mode: allow_only_approved_outbound

You can also define outbound rules to define approved outbound communication. An outbound rule can be created for a type of service_tag, fqdn, and private_endpoint. The following rule demonstrates adding a private endpoint to an Azure Blob resource, a service tag to Azure Data Factory, and an FQDN to pypi.org:

managed_network:
  isolation_mode: allow_only_approved_outbound
  outbound_rules:
  - name: added-servicetagrule
    destination:
      port_ranges: 80, 8080
      protocol: TCP
      service_tag: DataFactory
    type: service_tag
  - name: add-fqdnrule
    destination: 'pypi.org'
    type: fqdn
  - name: added-perule
    destination:
      service_resource_id: /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Storage/storageAccounts/<STORAGE_ACCOUNT_NAME>
      spark_enabled: true
      subresource_target: blob
    type: private_endpoint

You can configure a managed virtual network using either the az ml workspace create or az ml workspace update commands:

• Create a new workspace:

  The following example uses the --managed-network allow_only_approved_outbound parameter to configure the managed virtual network:

  az ml workspace create --name ws --resource-group rg --managed-network allow_only_approved_outbound
  

  The following YAML file defines a workspace with a managed virtual network:

  name: myworkspace
  location: EastUS
  managed_network:
    isolation_mode: allow_only_approved_outbound
  

  To create a workspace using the YAML file, use the --file parameter:

  az ml workspace create --file workspace.yaml --resource-group rg --name ws
  

• Update an existing workspace

  Warning

  Before updating an existing workspace to use a managed virtual network, you must delete all computing resources for the workspace. This includes compute instance, compute cluster, and managed online endpoints.

  The following example uses the --managed-network allow_only_approved_outbound parameter to configure the managed virtual network for an existing workspace:

  az ml workspace update --name ws --resource-group rg --managed-network allow_only_approved_outbound
  

  The following YAML file defines a managed virtual network for the workspace. It also demonstrates how to add an approved outbound to the managed virtual network. In this example, an outbound rule is added for both a service tag:

  Warning

  FQDN outbound rules are implemented using Azure Firewall. If you use outbound FQDN rules, charges for Azure Firewall are added to your billing.For more information, see Pricing.

  name: myworkspace_dep
  managed_network:
    isolation_mode: allow_only_approved_outbound
    outbound_rules:
    - name: added-servicetagrule
      destination:
        port_ranges: 80, 8080
        protocol: TCP
        service_tag: DataFactory
      type: service_tag
    - name: add-fqdnrule
      destination: 'pypi.org'
      type: fqdn
    - name: added-perule
      destination:
        service_resource_id: /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Storage/storageAccounts/<STORAGE_ACCOUNT_NAME>
        spark_enabled: true
        subresource_target: blob
      type: private_endpoint
  

To configure a managed virtual network that allows only approved outbound communications, use the ManagedNetwork class to define a network with IsolationMode.ALLOw_ONLY_APPROVED_OUTBOUND. You can then use the ManagedNetwork object to create a new workspace or update an existing one. To define outbound rules, use the following classes:

• Create a new workspace:

  The following example creates a new workspace named myworkspace, with several outbound rules:

  • myrule - Adds a private endpoint for an Azure Blob store.
  • datafactory - Adds a service tag rule to communicate with Azure Data Factory.

  Important

  • Adding an outbound for a service tag or FQDN is only valid when the managed VNet is configured to IsolationMode.ALLOW_ONLY_APPROVED_OUTBOUND.
  • If you add outbound rules, Microsoft can't guarantee data exfiltration.

  Warning

  FQDN outbound rules are implemented using Azure Firewall. If you use outbound FQDN rules, charges for Azure Firewall are added to your billing. For more information, see Pricing.

  # Basic managed VNet configuration
  network = ManagedNetwork(IsolationMode.ALLOW_ONLY_APPROVED_OUTBOUND)
  
  # Workspace configuration
  ws = Workspace(
      name="myworkspace",
      location="eastus",
      managed_network=network
  )
  
  # Append some rules
  ws.managed_network.outbound_rules = []
  # Example private endpoint outbound to a blob
  rule_name = "myrule"
  service_resource_id = "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Storage/storageAccounts/<STORAGE_ACCOUNT_NAME>"
  subresource_target = "blob"
  spark_enabled = True
  ws.managed_network.outbound_rules.append(
      PrivateEndpointDestination(
          name=rule_name, 
          service_resource_id=service_resource_id, 
          subresource_target=subresource_target, 
          spark_enabled=spark_enabled
      )
  )
  
  # Example service tag rule
  rule_name = "datafactory"
  service_tag = "DataFactory"
  protocol = "TCP"
  port_ranges = "80, 8080-8089"
  ws.managed_network.outbound_rules.append(
      ServiceTagDestination(
          name=rule_name, 
          service_tag=service_tag, 
          protocol=protocol, 
          port_ranges=port_ranges
      )
  )
  
  # Example FQDN rule
  ws.managed_network.outbound_rules.append(
      FqdnDestination(
          name="fqdnrule", 
          destination="pypi.org"
      )
  )
  
  # Create the workspace
  ws = ml_client.workspaces.begin_create(ws).result()
  

• Update an existing workspace:

  Warning

  Before updating an existing workspace to use a managed virtual network, you must delete all computing resources for the workspace. This includes compute instance, compute cluster, and managed online endpoints.

  The following example demonstrates how to create a managed virtual network for an existing Azure Machine Learning workspace named myworkspace. The example also adds several outbound rules for the managed virtual network:

  • myrule - Adds a private endpoint for an Azure Blob store.
  • datafactory - Adds a service tag rule to communicate with Azure Data Factory.

  Tip

  Adding an outbound for a service tag or FQDN is only valid when the managed VNet is configured to IsolationMode.ALLOW_ONLY_APPROVED_OUTBOUND.

  Warning

  FQDN outbound rules are implemented using Azure Firewall. If you use outbound FQDN rules, charges for Azure Firewall are added to your billing. For more information, see Pricing.

  # Get the existing workspace
  ml_client = MLClient(DefaultAzureCredential(), subscription_id=subscription_id, resource_group_name=resource_group, workspace_name="myworkspace")
  ws = ml_client.workspaces.get()
  
  # Basic managed VNet configuration
  ws.managed_network = ManagedNetwork(IsolationMode.ALLOW_ONLY_APPROVED_OUTBOUND)
  
  # Append some rules
  ws.managed_network.outbound_rules = []
  # Example private endpoint outbound to a blob
  rule_name = "myrule"
  service_resource_id = "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Storage/storageAccounts/<STORAGE_ACCOUNT_NAME>"
  subresource_target = "blob"
  spark_enabled = True
  ws.managed_network.outbound_rules.append(
      PrivateEndpointDestination(
          name=rule_name, 
          service_resource_id=service_resource_id, 
          subresource_target=subresource_target, 
          spark_enabled=spark_enabled
      )
  )
  
  # Example service tag rule
  rule_name = "datafactory"
  service_tag = "DataFactory"
  protocol = "TCP"
  port_ranges = "80, 8080-8089"
  ws.managed_network.outbound_rules.append(
      ServiceTagDestination(
          name=rule_name, 
          service_tag=service_tag, 
          protocol=protocol, 
          port_ranges=port_ranges
      )
  )
  
  # Example FQDN rule
  ws.managed_network.outbound_rules.append(
      FqdnDestination(
          name="fqdnrule", 
          destination="pypi.org"
      )
  )
  
  # Update the workspace
  ml_client.workspaces.begin_update(ws)
  

• Create a new workspace:

  1. Sign in to the Azure portal, and choose Azure Machine Learning from Create a resource menu.

  2. Provide the required information on the Basics tab.

  3. From the Networking tab, select Private with Approved Outbound.

     

  4. To add an outbound rule, select Add user-defined outbound rules from the Networking tab. From the Workspace outbound rules sidebar, provide the following information:

     • Rule name: A name for the rule. The name must be unique for this workspace.
     • Destination type: Private Endpoint, Service Tag, or FQDN. Service Tag and FQDN are only available when the network isolation is private with approved outbound.

     If the destination type is Private Endpoint, provide the following information:

     • Subscription: The subscription that contains the Azure resource you want to add a private endpoint for.
     • Resource group: The resource group that contains the Azure resource you want to add a private endpoint for.
     • Resource type: The type of the Azure resource.
     • Resource name: The name of the Azure resource.
     • Sub Resource: The sub resource of the Azure resource type.
     • Spark enabled: Select this option if you want to enable serverless Spark jobs for the workspace. This option is only available if the resource type is Azure Storage.

     Tip

     Azure Machine Learning managed VNet doesn't support creating a private endpoint to all Azure resource types. For a list of supported resources, see the Private endpoints section.

     

     If the destination type is Service Tag, provide the following information:

     • Service tag: The service tag to add to the approved outbound rules.
     • Protocol: The protocol to allow for the service tag.
     • Port ranges: The port ranges to allow for the service tag.

     

     If the destination type is FQDN, provide the following information:

     Warning

     FQDN outbound rules are implemented using Azure Firewall. If you use outbound FQDN rules, charges for Azure Firewall are added to your billing. For more information, see Pricing.

     • FQDN destination: The fully qualified domain name to add to the approved outbound rules.

     

     Select Save to save the rule. You can continue using Add user-defined outbound rules to add rules.

  5. Continue creating the workspace as normal.

• Update an existing workspace:

  Warning

  Before updating an existing workspace to use a managed virtual network, you must delete all computing resources for the workspace. This includes compute instance, compute cluster, and managed online endpoints.

  1. Sign in to the Azure portal, and select the Azure Machine Learning workspace that you want to enable managed virtual network isolation for.

  2. Select Networking, Workspace managed outbound access, and then select Private with Approved Outbound.

     

     • To add an outbound rule, select Add user-defined outbound rules from the Networking tab. From the Workspace outbound rules sidebar, provide the same information as when creating a workspace in the previous 'Create a new workspace' section.

     • To delete an outbound rule, select delete for the rule.

       

  3. Select Save at the top of the page to save the changes to the managed virtual network.

The following example shows how to provision a managed virtual network during workspace creation. The --provision-network-now flag is in preview.

az ml workspace create -n myworkspace -g my_resource_group --managed-network AllowInternetOutbound --provision-network-now

The following example shows how to manually provision a managed virtual network.

az ml workspace provision-network -g my_resource_group -n my_workspace_name

To verify that the provisioning completed, use the following command:

az ml workspace show -n my_workspace_name -g my_resource_group --query managed_network

To provision the managed network during workspace creation, set the provision_network_now flag to True. This flag is in preview.

provision_network_now: True

The following example shows how to provision a managed virtual network:

# Connect to a workspace named "myworkspace"
ml_client = MLClient(DefaultAzureCredential(), subscription_id=subscription_id, resource_group_name=resource_group, workspace_name="myworkspace")

# whether to provision Spark vnet as well
include_spark = True

provision_network_result = ml_client.workspaces.begin_provision_network(workspace_name=ws_name, include_spark=include_spark).result()

To verify that the workspace has been provisioned, use ml_client.workspaces.get() to get the workspace information. The managed_network property contains the status of the managed network.

ws = ml_client.workspaces.get()
print(ws.managed_network.status)

During workspace creation, select Provision managed network proactively at creation to provision the managed network. Charges are incurred from network resources, such as private endpoints, once the virtual network is provisioned. This configuration option is only available during workspace creation, and is in preview.

To update a workspace to use a compute cluster or compute instance to build Docker images, use the az ml workspace update command with the --image-build-compute parameter:

az ml workspace update --name ws --resource-group rg --image-build-compute mycompute

The following example demonstrates how to update a workspace to use a compute cluster to build images:

# import required libraries
from azure.ai.ml import MLClient
from azure.identity import DefaultAzureCredential

subscription_id = "<your subscription ID>"
resource_group = "<your resource group name>"
workspace = "<your workspace name>"

ml_client = MLClient(
    DefaultAzureCredential(), subscription_id=subscription_id, resource_group_name=resource_group, workspace_name=workspace
)

# Get workspace info
ws=ml_client.workspaces.get(name=workspace)
# Update to use cpu-cluster for image builds
ws.image_build_compute="mycompute"
ml_client.workspaces.begin_update(ws)
# To switch back to using ACR to build (if ACR is not in the virtual network):
# ws.image_build_compute = ''
# ml_client.workspaces.begin_update(ws)

Currently there isn't a way to set the image build compute from the Azure portal. Use the Azure CLI or Python SDK tabs to learn how to manually configure image builds.

To list the managed virtual network outbound rules for a workspace, use the following command:

az ml workspace outbound-rule list --workspace-name ws --resource-group rg

To view the details of a managed virtual network outbound rule, use the following command:

az ml workspace outbound-rule show --rule rule-name --workspace-name ws --resource-group rg

To remove an outbound rule from the managed virtual network, use the following command:

az ml workspace outbound-rule remove --rule rule-name --workspace-name ws --resource-group rg

The following example demonstrates how to manage outbound rules for a workspace named myworkspace:

# Connect to the workspace
ml_client = MLClient(DefaultAzureCredential(), subscription_id=subscription_id, resource_group_name=resource_group, workspace_name="myworkspace")

# Specify the rule name
rule_name = "<some-rule-name>"

# Get a rule by name
rule = ml_client._workspace_outbound_rules.get(resource_group, ws_name, rule_name)

# List rules for a workspace
rule_list = ml_client._workspace_outbound_rules.list(resource_group, ws_name)

# Delete a rule from a workspace
ml_client._workspace_outbound_rules.begin_remove(resource_group, ws_name, rule_name).result()

1. Sign in to the Azure portal, and select the Azure Machine Learning workspace that you want to enable managed virtual network isolation for.

2. Select Networking. The Workspace Outbound access section allows you to manage outbound rules.

   

• To add an outbound rule, select Add user-defined outbound rules from the Networking tab. From the Workspace outbound rules sidebar, provide the following information:

• To enable or disable a rule, use the toggle in the Active column.

• To delete an outbound rule, select delete for the rule.

After selecting the allow only approved outbound mode, an option to select the Azure Firewall version (SKU) appears. Select Standard to use the standard version or Basic to use the basic version. Select Save to save your configuration.

To configure the firewall version from the CLI, use a YAML file and specify the firewall_sku. The following example demonstrates a YAML file that sets the firewall SKU to basic:

name: test-ws
resource_group: test-rg
location: eastus2 
managed_network:
  isolation_mode: allow_only_approved_outbound
  outbound_rules:
  - category: required
    destination: 'contoso.com'
    name: contosofqdn
    type: fqdn
  firewall_sku: basic
tags: {}

To configure the firewall version from the Python SDK, set the firewall_sku property of the ManagedNetwork object. The following example demonstrates how to set the firewall SKU to basic:

network = ManagedNetwork(isolation_mode=IsolationMode.ALLOW_INTERNET_OUTBOUND,
                         firewall_sku='basic')