How to have different outbound rules for spoke workspaces?

Shivam Singh 0 Microsoft Employee

What I reckon from the hub workspace learn article https://learn.microsoft.com/en-us/azure/machine-learning/concept-hub-workspace?view=azureml-api-2 the spokes inherit the network configuration from the hub. How do spokes have different outbound network configuration in a managed vnet scenario? Users don't have visibility to the Network or Firewall and therefore can't edit the subnets in it. or am I completely missing it?

I wanna have an architecture diagram with AML workspaces each of them in a managed VNeT configuration but I want to decrease the cost associated with provisioning firewall for each workspace.

SriLakshmi C 745 Reputation points Microsoft Vendor

2024-11-12T12:34:32.5133333+00:00

Hi Shivam Singh,

Welcome to Microsoft Q&A! Thanks for posting the question.

The spoke workspaces typically inherit the network configuration from the hub workspace. However, you can still configure different outbound rules for each spoke workspace by using Azure Machine Learning's outbound rule settings, here is some steps:

Use the Azure Command-Line Interface to set specific outbound rules for each AML workspace in the spoke VNets. This allows you to define different destinations and protocols for each workspace.

Manage outbound rules in Azure Machine Learning workspaces using the Azure CLI

Please refer this document for more information azml workspace outbound-rule.

By setting specific outbound rules for your workspace helps in three main ways: it gives you precise control over where data from your workspace can go, which reduces unnecessary traffic. This targeted approach also improves security by restricting access and data flow only to approved destinations. Finally, limiting outbound traffic can help manage costs by avoiding unnecessary data egress charges, ensuring resources are only used where they are needed.

Also please refer this document How to configure a managed network for Azure AI Studio hubs.

Do let us know if you any further queries. Thank you!
SriLakshmi C 745 Reputation points Microsoft Vendor

2024-11-13T11:09:33.6933333+00:00

Hi Shivam Singh,

Following up to see if the above response was helpful. Thank you!
Shivam Singh 0 Reputation points Microsoft Employee

2024-11-13T13:39:51.1266667+00:00
Hi @SriLakshmi C What you suggested seems to work because when I list the outbound rules for both the workspaces or spokes I see different rules. The next problem is the rule is Inactive and I can't get it to active mode. I was under the impression that it would automatically happen once I create a compute after applying the rule. Is my understanding flawed?

Check the logs:

{ "category": "UserDefined", "destination": "pypi.org", "name": "pypi", "status": "Inactive", "type": "FQDN" },
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Shivam Singh 0 Reputation points Microsoft Employee

2024-11-13T13:56:50.5333333+00:00

Is there a way to see these rules for the spokes in the UI? I can only access the network tab for the hub.
SriLakshmi C 745 Reputation points Microsoft Vendor

2024-11-14T12:07:37.1533333+00:00

Hi Shivam Singh,Rules may initially appear as inactive until they are actively enforced by the system. To ensure your rule transitions to an active state, verify that the Azure Firewall has been properly configured in the hub network, particularly with rules that allow access to specific endpoints, such as pypi.org. Once this configuration is complete and the firewall begins routing traffic as specified, the rule’s status should update accordingly.

An inactive rule status could also result from a delay or incomplete application. Rules typically become active once the associated compute resources are created and the rule is applied accurately. If this delay persists, it may be useful to review configuration settings and confirm correct setup to support seamless activation.

Thank you!

Share via

How to have different outbound rules for spoke workspaces?

Your answer