Manage Azure Machine Learning hub workspaces in the portal

In this article, you create, view, and delete Azure Machine Learning hub workspaces for Azure Machine Learning, with the Azure portal.

As your needs change or your automation requirements increase, you can manage workspaces with the CLI, Azure PowerShell, or via the Visual Studio Code extension.

Prerequisites

• An Azure subscription. If you don't have an Azure subscription, create a free account before you begin. Try the free or paid version of Azure Machine Learning today.

Limitations

• When you create a new workspace, you can either automatically create services needed by the workspace or use existing services. If you want to use existing services from a different Azure subscription than the workspace, you must register the Azure Machine Learning namespace in the subscription that contains those services. For example, if you create a workspace in subscription A that uses a storage account in subscription B, the Azure Machine Learning namespace must be registered in subscription B before the workspace can use the storage account.

  The resource provider for Azure Machine Learning is Microsoft.MachineLearningServices. For information on seeing whether it's registered or registering it, see Azure resource providers and types.

  Important

  This information applies only to resources provided during workspace creation: Azure Storage Accounts, Azure Container Registry, Azure Key Vault, and Application Insights.

• For network isolation with online endpoints, you can use workspace-associated resources (Azure Container Registry (ACR), Storage account, Key Vault, and Application Insights) from a resource group different from your workspace. However, these resources must belong to the same subscription and tenant as your workspace. For information about the limitations that apply to securing managed online endpoints, using a workspace's managed virtual network, see Network isolation with managed online endpoints.

• Workspace creation also creates an Azure Container Registry (ACR) by default. Since ACR doesn't currently support unicode characters in resource group names, use a resource group that avoids these characters.

• Azure Machine Learning doesn't support hierarchical namespace (Azure Data Lake Storage Gen2 feature) for the default storage account of the workspace.

Create a hub

Use the following steps to create a hub from the Azure portal:

1. From the Azure portal, search for Azure AI Studio and create a new resource by selecting + New Azure AI

2. Enter your AI hub name, subscription, resource group, and location details.

3. For advanced settings, select Next: Resources to specify resources, networking, encryption, identity, and tags.

   

4. Select an existing Azure AI services resource or create a new one. New Azure AI services include multiple API endpoints for Speech, Content Safety and Azure OpenAI. You can also bring an existing Azure OpenAI resource. Optionally, choose an existing Storage account, Key vault, Container Registry, and Application insights to host artifacts generated when you use AI Studio.

   Tip

   You can skip selecting Azure AI Services if you plan to only work in Azure Machine Learning studio. Azure AI Services is required for Azure AI Studio, and provide access to pre-built AI models for use in prompt flow.

   

5. Set up Network isolation. Read more on network isolation. For a walkthrough of creating a secure Azure AI hub, see Create a secure Azure AI hub.

   

6. Set up data encryption. You can either use Microsoft-managed keys or enable Customer-managed keys.

   

7. By default, System assigned identity is enabled, but you can switch to User assigned identity if existing storage, key vault, and container registry are selected in Resources.

   

   Note

   If you select User assigned identity and also selected an Azure AI Service, your identity needs to have the Cognitive Services Contributor role in order to successfully create a new Azure AI hub.

8. Add tags.

   

9. Select Review + create

Manage your hub from the Azure portal

Manage access control

Manage role assignments from Access control (IAM) within the Azure portal. Learn more about hub role-based access control.

To add grant users permissions:

1. Select + Add to add users to your hub.

2. Select the Role you want to assign.

   

3. Select the Members you want to give the role to.

   

4. Review + assign. It can take up to an hour for permissions to be applied to users.

Networking

Hub networking settings can be set during resource creation or changed in the Networking tab in the Azure portal view. Creating a new hub invokes a managed virtual network. This streamlines and automates your network isolation configuration with a built-in managed virtual network. The managed virtual network settings are applied to all project workspaces created within a hub.

At hub creation, select between the networking isolation modes: Public, Private with Internet Outbound, and Private with Approved Outbound. To secure your resource, select either Private with Internet Outbound or Private with Approved Outbound for your networking needs. For the private isolation modes, a private endpoint should be created for inbound access. For more information on network isolation, see Managed virtual network isolation. To create a secure hub, see Create a secure Azure AI hub.

At hub creation in the Azure portal, creation of associated Azure AI services, Storage account, Key vault, Application insights, and Container registry is given. These resources are found on the Resources tab during creation.

To connect to Azure AI services (Azure OpenAI, Azure AI Search, and Azure AI Content Safety) or storage accounts in Azure AI Studio, create a private endpoint in your virtual network. Ensure the public network access (PNA) flag is disabled when creating the private endpoint connection. For more about Azure AI services connections, see Azure AI services and virtual networks. You can optionally bring your own (BYO) search, but this requires a private endpoint connection from your virtual network.

Encryption

Projects that use the same hub, share their encryption configuration. Encryption mode can be set only at the time of hub creation between Microsoft-managed keys and Customer-managed keys.

From the Azure portal view, navigate to the encryption tab, to find the encryption settings for your hub. For hubs that use customer-managed key encryption mode, you can update the encryption key to a new key version. This update operation is constrained to keys and key versions within the same Key Vault instance as the original key.

Update Azure Application Insights and Azure Container Registry

To use custom environments for Prompt Flow, you're required to configure an Azure Container Registry for your AI hub. To use Azure Application Insights for Prompt Flow deployments, a configured Azure Application Insights resource is required for your AI hub.

You can configure your hub for these resources during creation or update after creation. To update Azure Application Insights from the Azure portal, navigate to the Properties for your hub in the Azure portal, then select Change Application Insights. You can also use the Azure SDK/CLI options or infrastructure-as-code templates to update both Azure Application Insights and Azure Container Registry for the AI Hub.

Next steps

Once you have a workspace hub, you can Create a project using Azure Machine Learning studio, AI Studio, Azure SDK, or Using automation templates.