Skip to content

Commit d9bf755

Browse files
v-shilsv-shils
authored
Merge pull request #312735 from wiboris/BatchEndpointConfigDocUpdate
Update Azure Batch pool endpoint configuration doc
2 parents dcb770f + 099d7d4 commit d9bf755

1 file changed

Lines changed: 223 additions & 75 deletions

File tree

‎articles/batch/pool-endpoint-configuration.md‎

Lines changed: 223 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22
title: Configure node endpoints in Azure Batch pool
33
description: How to configure node endpoints such as access to SSH or RDP ports on compute nodes in an Azure Batch pool.
44
ms.topic: how-to
5-
ms.date: 01/12/2026
5+
ms.date: 03/06/2026
66
# Customer intent: As an IT administrator, I want to configure remote access endpoints for compute nodes in an Azure Batch pool, so that I can control external connectivity while ensuring security and compliance in my environment.
77
---
88

99
# Configure remote access to compute nodes in an Azure Batch pool
1010

11-
If configured, you can allow a [node user](/rest/api/batchservice/computenode/adduser) with network connectivity to connect
11+
If configured, you can allow a [node user](/rest/api/batchservice/nodes/create-node-user) with network connectivity to connect
1212
externally to a compute node in a Batch pool. For example, a user can connect by Remote Desktop (RDP) on port 3389 to a
1313
compute node in a Windows pool. Similarly, by default, a user can connect by Secure Shell (SSH) on port 22 to a compute
1414
node in a Linux pool.
@@ -21,86 +21,160 @@ node in a Linux pool.
2121
2222
In your environment, you might need to enable, restrict, or disable external access settings or any other ports you wish
2323
on the Batch pool. You can modify these settings by using the Batch APIs to set the
24-
[PoolEndpointConfiguration](/rest/api/batchservice/pools/create-pool#batchpoolendpointconfiguration) property.
24+
[NetworkConfiguration](/rest/api/batchmanagement/pool/create#networkconfiguration) property.
2525

2626
## Batch pool endpoint configuration
27-
The endpoint configuration consists of one or more [network address translation (NAT) pools](/rest/api/batchservice/pools/create-pool#batchinboundnatpool)
27+
28+
The endpoint configuration consists of one or more [network address translation (NAT) pools](/rest/api/batchmanagement/pool/create#inboundnatpool)
2829
of frontend ports. Don't confuse a NAT pool with the Batch pool of compute nodes. You set up each NAT pool to override
2930
the default connection settings on the pool's compute nodes.
3031

31-
Each NAT pool configuration includes one or more [network security group (NSG) rules](/rest/api/batchservice/pools/create-pool#networksecuritygrouprule). Each NSG rule allows or denies certain network traffic to the endpoint. You can choose to allow or deny all traffic, traffic identified by a [service tag](../virtual-network/network-security-groups-overview.md#service-tags) (such as "Internet"), or traffic from specific IP addresses or subnets.
32+
Each NAT pool configuration includes one or more [network security group (NSG) rules](/rest/api/batchmanagement/pool/create#networksecuritygrouprule). Each NSG rule allows or denies certain network traffic to the endpoint. You can choose to allow or deny all traffic, traffic identified by a [service tag](../virtual-network/network-security-groups-overview.md#service-tags) (such as "Internet"), or traffic from specific IP addresses or subnets.
3233

3334
### Considerations
34-
* The pool endpoint configuration is part of the pool's [network configuration](/rest/api/batchservice/pools/create-pool#networkconfiguration). The network configuration can optionally include settings to join the pool to an [Azure virtual network](batch-virtual-network.md). If you set up the pool in a virtual network, you can create NSG rules that use address settings in the virtual network.
35-
* You can configure multiple NSG rules when you configure a NAT pool. The rules are checked in the order of priority. Once a rule applies, no more rules are tested for matching.
35+
36+
- The pool endpoint configuration is part of the pool's [network configuration](/rest/api/batchmanagement/pool/create#networkconfiguration). The network configuration can optionally include settings to join the pool to an [Azure virtual network](batch-virtual-network.md). If you set up the pool in a virtual network, you can create NSG rules that use address settings in the virtual network.
37+
- You can configure multiple NSG rules when you configure a NAT pool. The rules are checked in the order of priority. Once a rule applies, no more rules are tested for matching.
3638

3739
## Example: Allow RDP traffic from a specific IP address
3840

39-
The following C# snippet shows how to configure the RDP endpoint on compute nodes in a Windows pool to allow RDP access only from IP address *198.168.100.7*. The second NSG rule denies traffic that doesn't match the IP address.
41+
The following C# snippet shows how to configure the RDP endpoint on compute nodes in a Windows pool to allow RDP access only from IP address _198.168.100.7_. The second NSG rule denies traffic that doesn't match the IP address.
4042

4143
```csharp
42-
using Microsoft.Azure.Batch;
43-
using Microsoft.Azure.Batch.Common;
44+
using System;
45+
using Azure.Core;
46+
using Azure.Identity;
47+
using Azure.ResourceManager.Batch;
48+
using Azure.ResourceManager.Batch.Models;
4449

4550
namespace AzureBatch
4651
{
4752
public void SetPortsPool()
4853
{
49-
pool.NetworkConfiguration = new NetworkConfiguration
54+
// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
55+
TokenCredential cred = new DefaultAzureCredential();
56+
57+
// authenticate your client
58+
ArmClient client = new ArmClient(cred);
59+
60+
// this example assumes you already have this BatchAccountResource created on azure
61+
// for more information of creating BatchAccountResource, please refer to the document of BatchAccountResource
62+
string subscriptionId = "12345678-1234-1234-1234-123456789012";
63+
string resourceGroupName = "default-azurebatch-japaneast";
64+
string accountName = "sampleacct";
65+
ResourceIdentifier batchAccountResourceId = BatchAccountResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, accountName);
66+
BatchAccountResource batchAccount = client.GetBatchAccountResource(batchAccountResourceId);
67+
68+
// get the collection of this BatchAccountPoolResource
69+
BatchAccountPoolCollection collection = batchAccount.GetBatchAccountPools();
70+
71+
// invoke the operation
72+
string poolName = "testpool";
73+
BatchAccountPoolData pool = new BatchAccountPoolData
5074
{
51-
EndpointConfiguration = new PoolEndpointConfiguration(new InboundNatPool[]
75+
VmSize = "STANDARD_D4",
76+
DeploymentVmConfiguration = new BatchVmConfiguration(new BatchImageReference
5277
{
53-
new InboundNatPool("RDP", InboundEndpointProtocol.Tcp, 3389, 7500, 8000, new NetworkSecurityGroupRule[]
78+
Publisher = "MicrosoftWindowsServer",
79+
Offer = "WindowsServer",
80+
Sku = "2016-Datacenter-SmallDisk",
81+
Version = "latest",
82+
}, "batch.node.windows amd64"),
83+
NetworkConfiguration = new BatchNetworkConfiguration
84+
{
85+
EndpointConfiguration = new PoolEndpointConfiguration(new BatchInboundNatPool[]
5486
{
55-
new NetworkSecurityGroupRule(179, NetworkSecurityGroupRuleAccess.Allow, "198.168.100.7"),
56-
new NetworkSecurityGroupRule(180, NetworkSecurityGroupRuleAccess.Deny, "*")
57-
})
58-
})
87+
new BatchInboundNatPool("RDP", BatchInboundEndpointProtocol.Tcp, 3389, 7500, 8000)
88+
{
89+
NetworkSecurityGroupRules =
90+
{
91+
new BatchNetworkSecurityGroupRule(179, BatchNetworkSecurityGroupRuleAccess.Allow, "198.168.100.7"),
92+
new BatchNetworkSecurityGroupRule(180, BatchNetworkSecurityGroupRuleAccess.Deny, "*")
93+
}
94+
}
95+
}
96+
)
5997
};
98+
99+
ArmOperation<BatchAccountPoolResource> lro = await collection.CreateOrUpdateAsync(WaitUntil.Completed, poolName, data);
100+
BatchAccountPoolResource result = lro.Value;
101+
102+
// the variable result is a resource, you could call other operations on this instance as well
103+
// but just for demo, we get its data from this resource instance
104+
BatchAccountPoolData resourceData = result.Data;
60105
}
61106
}
62107
```
63108

64109
## Example: Allow SSH traffic from a specific subnet
65110

66-
The following Python snippet shows how to configure the SSH endpoint on compute nodes in a Linux pool to allow access only from the subnet *192.168.1.0/24*. The second NSG rule denies traffic that doesn't match the subnet.
111+
The following Python snippet shows how to configure the SSH endpoint on compute nodes in a Linux pool to allow access only from the subnet _192.168.1.0/24_. The second NSG rule denies traffic that doesn't match the subnet.
67112

68113
```python
69-
from azure.batch import models as batchmodels
70-
71-
class AzureBatch(object):
72-
def set_ports_pool(self, **kwargs):
73-
pool.network_configuration = batchmodels.NetworkConfiguration(
74-
endpoint_configuration=batchmodels.PoolEndpointConfiguration(
75-
inbound_nat_pools=[batchmodels.InboundNATPool(
76-
name='SSH',
77-
protocol='tcp',
78-
backend_port=22,
79-
frontend_port_range_start=4000,
80-
frontend_port_range_end=4100,
81-
network_security_group_rules=[
82-
batchmodels.NetworkSecurityGroupRule(
83-
priority=170,
84-
access='allow',
85-
source_address_prefix='192.168.1.0/24'
86-
),
87-
batchmodels.NetworkSecurityGroupRule(
88-
priority=175,
89-
access='deny',
90-
source_address_prefix='*'
91-
)
92-
]
93-
)
114+
from azure.identity import DefaultAzureCredential
115+
from azure.mgmt.batch import BatchManagementClient
116+
from azure.mgmt.batch import models as batchmodels
117+
118+
# Authenticate using DefaultAzureCredential
119+
credential = DefaultAzureCredential()
120+
subscription_id = "12345678-1234-1234-1234-123456789012"
121+
client = BatchManagementClient(credential, subscription_id)
122+
123+
resource_group_name = "default-azurebatch-japaneast"
124+
account_name = "sampleacct"
125+
pool_name = "testpool"
126+
127+
pool_parameters = batchmodels.Pool(
128+
vm_size="STANDARD_D4",
129+
deployment_configuration=batchmodels.DeploymentConfiguration(
130+
virtual_machine_configuration=batchmodels.VirtualMachineConfiguration(
131+
image_reference=batchmodels.ImageReference(
132+
publisher="Canonical",
133+
offer="0001-com-ubuntu-server-jammy",
134+
sku="22_04-lts",
135+
version="latest"
136+
),
137+
node_agent_sku_id="batch.node.ubuntu 22.04"
138+
)
139+
),
140+
network_configuration=batchmodels.NetworkConfiguration(
141+
endpoint_configuration=batchmodels.PoolEndpointConfiguration(
142+
inbound_nat_pools=[batchmodels.InboundNatPool(
143+
name='SSH',
144+
protocol=batchmodels.InboundEndpointProtocol.TCP,
145+
backend_port=22,
146+
frontend_port_range_start=4000,
147+
frontend_port_range_end=4100,
148+
network_security_group_rules=[
149+
batchmodels.NetworkSecurityGroupRule(
150+
priority=170,
151+
access=batchmodels.NetworkSecurityGroupRuleAccess.ALLOW,
152+
source_address_prefix='192.168.1.0/24'
153+
),
154+
batchmodels.NetworkSecurityGroupRule(
155+
priority=175,
156+
access=batchmodels.NetworkSecurityGroupRuleAccess.DENY,
157+
source_address_prefix='*'
158+
)
94159
]
95-
)
160+
)]
96161
)
97-
```
162+
)
163+
)
98164

165+
result = client.pool.create(
166+
resource_group_name=resource_group_name,
167+
account_name=account_name,
168+
pool_name=pool_name,
169+
parameters=pool_parameters
170+
)
99171

172+
print(f"Pool '{result.name}' created successfully.")
173+
```
100174

101175
## Example: Deny all RDP traffic
102176

103-
The following C# snippet shows how to configure the RDP endpoint on compute nodes in a Windows pool to deny all network traffic. The endpoint uses a frontend pool of ports in the range *60000 - 60099*.
177+
The following C# snippet shows how to configure the RDP endpoint on compute nodes in a Windows pool to deny all network traffic. The endpoint uses a frontend pool of ports in the range _60000 - 60099_.
104178

105179
> [!NOTE]
106180
> As of Batch API version `2024-07-01`, port 3389 typically associated with RDP is no longer mapped by default.
@@ -109,30 +183,73 @@ The following C# snippet shows how to configure the RDP endpoint on compute node
109183
> from other sources.
110184
111185
```csharp
112-
using Microsoft.Azure.Batch;
113-
using Microsoft.Azure.Batch.Common;
186+
using System;
187+
using Azure.Core;
188+
using Azure.Identity;
189+
using Azure.ResourceManager.Batch;
190+
using Azure.ResourceManager.Batch.Models;
114191

115192
namespace AzureBatch
116193
{
117194
public void SetPortsPool()
118195
{
119-
pool.NetworkConfiguration = new NetworkConfiguration
196+
// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
197+
TokenCredential cred = new DefaultAzureCredential();
198+
199+
// authenticate your client
200+
ArmClient client = new ArmClient(cred);
201+
202+
// this example assumes you already have this BatchAccountResource created on azure
203+
// for more information of creating BatchAccountResource, please refer to the document of BatchAccountResource
204+
string subscriptionId = "12345678-1234-1234-1234-123456789012";
205+
string resourceGroupName = "default-azurebatch-japaneast";
206+
string accountName = "sampleacct";
207+
ResourceIdentifier batchAccountResourceId = BatchAccountResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, accountName);
208+
BatchAccountResource batchAccount = client.GetBatchAccountResource(batchAccountResourceId);
209+
210+
// get the collection of this BatchAccountPoolResource
211+
BatchAccountPoolCollection collection = batchAccount.GetBatchAccountPools();
212+
213+
// invoke the operation
214+
string poolName = "testpool";
215+
BatchAccountPoolData pool = new BatchAccountPoolData
120216
{
121-
EndpointConfiguration = new PoolEndpointConfiguration(new InboundNatPool[]
217+
VmSize = "STANDARD_D4",
218+
DeploymentVmConfiguration = new BatchVmConfiguration(new BatchImageReference
122219
{
123-
new InboundNatPool("RDP", InboundEndpointProtocol.Tcp, 3389, 60000, 60099, new NetworkSecurityGroupRule[]
220+
Publisher = "MicrosoftWindowsServer",
221+
Offer = "WindowsServer",
222+
Sku = "2016-Datacenter-SmallDisk",
223+
Version = "latest",
224+
}, "batch.node.windows amd64"),
225+
NetworkConfiguration = new BatchNetworkConfiguration
226+
{
227+
EndpointConfiguration = new PoolEndpointConfiguration(new BatchInboundNatPool[]
124228
{
125-
new NetworkSecurityGroupRule(162, NetworkSecurityGroupRuleAccess.Deny, "*"),
229+
new BatchInboundNatPool("RDP", BatchInboundEndpointProtocol.Tcp, 3389, 60000, 60099)
230+
{
231+
NetworkSecurityGroupRules =
232+
{
233+
new BatchNetworkSecurityGroupRule(162, BatchNetworkSecurityGroupRuleAccess.Deny, "*")
234+
}
235+
}
126236
})
127-
})
237+
}
128238
};
239+
240+
ArmOperation<BatchAccountPoolResource> lro = await collection.CreateOrUpdateAsync(WaitUntil.Completed, poolName, pool);
241+
BatchAccountPoolResource result = lro.Value;
242+
243+
// the variable result is a resource, you could call other operations on this instance as well
244+
// but just for demo, we get its data from this resource instance
245+
BatchAccountPoolData resourceData = result.Data;
129246
}
130247
}
131248
```
132249

133250
## Example: Deny all SSH traffic from the internet
134251

135-
The following Python snippet shows how to configure the SSH endpoint on compute nodes in a Linux pool to deny all internet traffic. The endpoint uses a frontend pool of ports in the range *4000 - 4100*.
252+
The following Python snippet shows how to configure the SSH endpoint on compute nodes in a Linux pool to deny all internet traffic. The endpoint uses a frontend pool of ports in the range _4000 - 4100_.
136253

137254
> [!NOTE]
138255
> As of Batch API version `2024-07-01`, port 22 typically associated with SSH is no longer mapped by default.
@@ -141,29 +258,60 @@ The following Python snippet shows how to configure the SSH endpoint on compute
141258
> from other sources.
142259
143260
```python
144-
from azure.batch import models as batchmodels
145-
146-
class AzureBatch(object):
147-
def set_ports_pool(self, **kwargs):
148-
pool.network_configuration = batchmodels.NetworkConfiguration(
149-
endpoint_configuration=batchmodels.PoolEndpointConfiguration(
150-
inbound_nat_pools=[batchmodels.InboundNATPool(
151-
name='SSH',
152-
protocol='tcp',
153-
backend_port=22,
154-
frontend_port_range_start=4000,
155-
frontend_port_range_end=4100,
156-
network_security_group_rules=[
157-
batchmodels.NetworkSecurityGroupRule(
158-
priority=170,
159-
access=batchmodels.NetworkSecurityGroupRuleAccess.deny,
160-
source_address_prefix='Internet'
161-
)
162-
]
163-
)
261+
from azure.identity import DefaultAzureCredential
262+
from azure.mgmt.batch import BatchManagementClient
263+
from azure.mgmt.batch import models as batchmodels
264+
265+
# Authenticate using DefaultAzureCredential
266+
credential = DefaultAzureCredential()
267+
subscription_id = "12345678-1234-1234-1234-123456789012"
268+
client = BatchManagementClient(credential, subscription_id)
269+
270+
resource_group_name = "default-azurebatch-japaneast"
271+
account_name = "sampleacct"
272+
pool_name = "testpool"
273+
274+
pool_parameters = batchmodels.Pool(
275+
vm_size="STANDARD_D4",
276+
deployment_configuration=batchmodels.DeploymentConfiguration(
277+
virtual_machine_configuration=batchmodels.VirtualMachineConfiguration(
278+
image_reference=batchmodels.ImageReference(
279+
publisher="Canonical",
280+
offer="0001-com-ubuntu-server-jammy",
281+
sku="22_04-lts",
282+
version="latest"
283+
),
284+
node_agent_sku_id="batch.node.ubuntu 22.04"
285+
)
286+
),
287+
network_configuration=batchmodels.NetworkConfiguration(
288+
endpoint_configuration=batchmodels.PoolEndpointConfiguration(
289+
inbound_nat_pools=[batchmodels.InboundNatPool(
290+
name='SSH',
291+
protocol=batchmodels.InboundEndpointProtocol.TCP,
292+
backend_port=22,
293+
frontend_port_range_start=4000,
294+
frontend_port_range_end=4100,
295+
network_security_group_rules=[
296+
batchmodels.NetworkSecurityGroupRule(
297+
priority=170,
298+
access=batchmodels.NetworkSecurityGroupRuleAccess.DENY,
299+
source_address_prefix='Internet'
300+
)
164301
]
165-
)
302+
)]
166303
)
304+
)
305+
)
306+
307+
result = client.pool.create(
308+
resource_group_name=resource_group_name,
309+
account_name=account_name,
310+
pool_name=pool_name,
311+
parameters=pool_parameters
312+
)
313+
314+
print(f"Pool '{result.name}' created successfully.")
167315
```
168316

169317
## Next steps

0 commit comments

Comments
 (0)