Skip to content

Commit ee2dafb

Browse files
author
v-meluri
committed
Bug fixes
1 parent c400fba commit ee2dafb

6 files changed

Lines changed: 4 additions & 4 deletions

File tree

learn-pr/wwl-azure/implement-identity-based-security-azure-machine-learning/includes/3-implement-conditional-access-policies-azure.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ Security groups control who can access your Azure Machine Learning workspace, bu
22

33
## Evaluate sign-in context with Conditional Access
44

5-
Conditional Access acts as a policy enforcement checkpoint between users and your Azure ML workspace. When a data scientist attempts to sign in, the policy engine evaluates multiple signals simultaneously. It checks whether the user is connecting from a trusted network or an unfamiliar location. It verifies whether their device meets your organization's security standards—is antivirus software up to date, is the disk encrypted, are operating system patches current? It examines authentication strength—did the user provide just a password, or did they complete multifactor authentication? Based on these signals, the policy grants access, requires additional verification, or blocks the connection entirely.
5+
Conditional Access acts as a policy enforcement checkpoint between users and your Azure Machine Learning workspace. When a data scientist attempts to sign in, the policy engine evaluates multiple signals simultaneously. It checks whether the user is connecting from a trusted network or an unfamiliar location. It verifies whether their device meets your organization's security standards—is antivirus software up to date, is the disk encrypted, are operating system patches current? It examines authentication strength—did the user provide just a password, or did they complete multifactor authentication? Based on these signals, the policy grants access, requires additional verification, or blocks the connection entirely.
66

7-
:::image type="content" source="../media/conditional-access-policy-enforcement-checkpoint.png" alt-text="Diagram showing how Conditional Access acts as a policy enforcement checkpoint between users and an Azure ML workspace.":::
7+
:::image type="content" source="../media/conditional-access-policy-enforcement-checkpoint.png" alt-text="Diagram showing how Conditional Access acts as a policy enforcement checkpoint between users and an Azure Machine Learning workspace.":::
88

99
Unlike static security groups, Conditional Access adapts to changing conditions. A data scientist signing in from your corporate office on a managed laptop requires minimal verification. The same user connecting from a coffee shop on a personal device triggers stricter controls. This dynamic approach maintains security without creating friction for legitimate users in low-risk scenarios. At the same time, it raises barriers when risk indicators suggest potential compromise—for example, simultaneous sign-in attempts from geographically distant locations within minutes.
1010

learn-pr/wwl-azure/implement-identity-based-security-azure-machine-learning/includes/8-summary.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ By implementing identity-based controls, you've demonstrated that AI infrastruct
44

55
Remember these core principles as you secure more AI workspaces:
66

7-
- **Organize users through security groups mapped to Azure ML RBAC roles**—this separates identity management from permission management and scales efficiently as teams grow
7+
- **Organize users through security groups mapped to Azure Machine Learning RBAC roles**—this separates identity management from permission management and scales efficiently as teams grow
88
- **Enforce multi-factor authentication through Conditional Access policies**—protect credentials without impacting productivity by adapting requirements based on location and device compliance
99
- **Use managed identities for automated workloads**—eliminate credential storage risks and reduce operational overhead compared to service principals with secrets or certificates
1010
- **Monitor continuously through Microsoft Entra audit logs**—validate that security controls work as designed and detect anomalies before they become incidents
@@ -13,7 +13,7 @@ Remember these core principles as you secure more AI workspaces:
1313

1414
Expand your Azure Machine Learning security posture with these advanced capabilities:
1515

16-
- **Configure Private Link for Azure ML workspaces** to isolate network traffic and prevent public internet exposure of training data and models
16+
- **Configure Private Link for Azure Machine Learning workspaces** to isolate network traffic and prevent public internet exposure of training data and models
1717
- **Implement customer-managed keys** for workspace encryption to meet data sovereignty requirements and maintain cryptographic control
1818
- **Set up Microsoft Defender for Cloud integration** to detect security threats and misconfigurations across your AI infrastructure with automated remediation recommendations
1919
- **Explore Azure Policy for ML governance** to enforce security baselines automatically—prevent workspace creation without required network isolation or audit log configuration
Loading
368 KB
Loading
-23.9 KB
Loading
Loading

0 commit comments

Comments
 (0)