Audit and manage Microsoft Foundry hubs and projects

As a platform administrator, you can use policies to lay out guardrails for teams to manage their own resources. Azure Policy helps audit and govern resource state. This article explains how you can use audit controls and governance practices for Microsoft Foundry.

Policies for Foundry hubs and projects

Azure Policy is a governance tool that allows you to ensure that Azure resources are compliant with your policies.

Azure Policy provides a set of policies that you can use for common scenarios with Foundry hubs and projects. You can assign these policy definitions to your existing subscription or use them as the basis to create your own custom definitions.

The following table lists the built-in policies that apply to both Foundry and Azure Machine Learning. For a list of all Azure built-in policies, see Built-in policies.

Policies can be set at different scopes, such as at the subscription or resource group level. For more information, see the Azure Policy documentation.

Assign built-in policies

To view the built-in policy definitions, use the following steps:

1. Go to Azure Policy in the Azure portal.
2. Select Definitions.
3. For Type, select Built-in. For Category, select Machine Learning.

Select a policy definition to view it. While viewing a definition, select Assign to assign the policy to a scope and configure its parameters. For more information, see Create a policy assignment to identify noncompliant resources using Azure portal.

Assign policies by using Azure PowerShell, Azure CLI, or templates.

Conditional access policies

Control access to Foundry hubs and projects by using Microsoft Entra Conditional Access. For hubs, assign the Conditional Access policy to these apps:

Configure built-in policies

Compute instance should have idle shutdown

This policy controls whether a compute instance should have idle shutdown enabled. Idle shutdown automatically stops the compute instance when it's idle for a specified period of time. This policy is useful for cost savings and to ensure that resources aren't being used unnecessarily.

To configure this policy, set the effect parameter to Audit, Deny, or Disabled. If you set the effect to Audit, you can create a compute instance without idle shutdown. The service creates a warning event in the activity log.

Compute instances should be recreated to get software updates

Controls whether compute instances should be audited to make sure they're running the latest available software updates. This policy is useful to ensure that compute instances are running the latest software updates to maintain security and performance. For more information, see Vulnerability management.

To configure this policy, set the effect parameter to Audit or Disabled. If set to Audit, a warning event is created in the activity log when a compute isn't running the latest software updates.

Compute cluster and instance should be in a virtual network

Controls auditing of compute cluster and instance resources behind a virtual network.

To configure this policy, set the effect parameter to Audit or Disabled. If set to Audit, you can create a compute that isn't configured behind a virtual network and a warning event is created in the activity log.

Compute clusters and instances should have local authentication disabled

Controls whether a compute cluster or instance should disable local authentication (SSH).

To configure this policy, set the effect parameter to Audit, Deny, or Disabled. If set to Audit, you can create a compute with SSH enabled and a warning event is created in the activity log.

If the policy is set to Deny, then you can't create a compute unless SSH is disabled. Attempting to create a compute with SSH enabled results in an error. The error is also logged in the activity log. The policy identifier is returned as part of this error.

Hubs should be encrypted with a customer-managed key

Controls whether a hub and its projects should be encrypted with a customer-managed key, or with a Microsoft-managed key to encrypt metrics and metadata. For more information on using customer-managed key, see the Customer-managed keys article.

To configure this policy, set the effect parameter to Audit or Deny. If set to Audit, you can create a hub without a customer-managed key and a warning event is created in the activity log.

If the policy is set to Deny, then you can't create a hub unless it specifies a customer-managed key. Attempting to create a hub without a customer-managed key results in an error similar to Resource 'clustername' was disallowed by policy and creates an error in the activity log. The policy identifier is also returned as part of this error.

Configure hubs to disable public network access

Controls whether a hub and its projects should disable network access from the public internet.

To configure this policy, set the effect parameter to Audit, Deny, or Disabled. If set to Audit, you can create a hub with public access and a warning event is created in the activity log.

If the policy is set to Deny, then you can't create a hub that allows network access from the public internet.

Hubs should use Azure Private Link

Controls whether a hub and its projects should use Azure Private Link to communicate with Azure Virtual Network. For more information on using private link, see Configure a private endpoint.

To configure this policy, set the effect parameter to Audit or Deny. If set to Audit, you can create a hub without using private link and a warning event is created in the activity log.

If the policy is set to Deny, then you can't create a hub unless it uses a private link. Attempting to create a hub without a private link results in an error. The error is also logged in the activity log. The policy identifier is returned as part of this error.

Hubs should use a user-assigned managed identity

Controls whether a hub is created using a system-assigned managed identity (default) or a user-assigned managed identity. The managed identity for the hub is used to access associated resources such as Azure Storage, Azure Container Registry, Azure Key Vault, and Azure Application Insights.

To configure this policy, set the effect parameter to Audit, Deny, or Disabled. If set to Audit, you can create a hub without specifying a user-assigned managed identity. A system-assigned identity is used, and a warning event is created in the activity log.

If the policy is set to Deny, then you can't create a hub unless you provide a user-assigned identity during the creation process. Attempting to create a hub without providing a user-assigned identity results in an error. The error is also logged to the activity log. The policy identifier is returned as part of this error.

Configure compute resources to modify or disable local authentication

This policy modifies any compute cluster or instance creation request to disable local authentication (SSH).

To configure this policy, set the effect parameter to Modify or Disabled. If set Modify, any creation of a compute cluster or instance within the scope where the policy applies automatically has local authentication disabled.

Configure a hub to use private DNS zones

This policy configures a hub to use a private DNS zone, overriding the default DNS resolution for a private endpoint.

To configure this policy, set the effect parameter to DeployIfNotExists. Set the privateDnsZoneId to the Azure Resource Manager ID of the private DNS zone to use.

Configure a hub to disable public network access

Configures a hub and its projects to disable network access from the public internet. Disabling public network access helps protect against data leakage risks. You can instead access your hub and projects by creating private endpoints. For more information, see Configure a private endpoint.

To configure this policy, set the effect parameter to Modify or Disabled. If set to Modify, any creation of a hub within the scope where the policy applies automatically has public network access disabled.

Configure a hub with private endpoints

Configures a hub to create a private endpoint within the specified subnet of an Azure Virtual Network.

To configure this policy, set the effect parameter to DeployIfNotExists. Set the privateEndpointSubnetID to the Azure Resource Manager ID of the subnet.

Configure diagnostic hub to send logs to Log Analytics workspaces

Configures the diagnostic settings for a hub to send logs to a Log Analytics workspace.

To configure this policy, set the effect parameter to DeployIfNotExists or Disabled. If set to DeployIfNotExists, the policy creates a diagnostic setting to send logs to a Log Analytics workspace if it doesn't already exist.

Resource logs in a hub should be enabled

Audits whether resource logs are enabled for a hub. Resource logs provide detailed information about operations performed on resources in the hub.

To configure this policy, set the effect parameter to AuditIfNotExists or Disabled. If set to AuditIfNotExists, the policy audits if resource logs aren't enabled for the hub.

Create custom definitions

Create custom policies by using the Azure Policy definition structure. Use the Azure Policy Visual Studio Code extension to author and test policies.

List policy aliases for Azure Machine Learning with this Azure CLI command:

az provider show --namespace Microsoft.MachineLearningServices --expand "resourceTypes/aliases" --query "resourceTypes[].aliases[].name"

Find allowed values for a specific alias in the Azure Machine Learning REST API reference.

For a general tutorial on creating custom policies, see Create a custom policy definition.

Example: Deny serverless Spark compute jobs

{
    "properties": {
        "displayName": "Deny serverless Spark compute jobs",
        "description": "Deny serverless Spark compute jobs",
        "mode": "All",
        "policyRule": {
            "if": {
                "allOf": [
                    {
                        "field": "Microsoft.MachineLearningServices/workspaces/jobs/jobType",
                        "in": [
                            "Spark"
                        ]
                    }
                ]
            },
            "then": {
                "effect": "Deny"
            }
        },
        "parameters": {}
    }
}

Example: Deny public IPs for managed computes

{
    "properties": {
        "displayName": "Deny compute instance and compute cluster creation with public IP",
        "description": "Deny compute instance and compute cluster creation with public IP",
        "mode": "All",
        "parameters": {
            "effectType": {
                "type": "string",
                "defaultValue": "Deny",
                "allowedValues": [
                    "Deny",
                    "Disabled"
                ],
                "metadata": {
                    "displayName": "Effect",
                    "description": "Enable or disable the execution of the policy"
                }
            }
        },
        "policyRule": {
            "if": {
                "allOf": [
                  {
                    "field": "type",
                    "equals": "Microsoft.MachineLearningServices/workspaces/computes"
                  },
                  {
                    "allOf": [
                      {
                        "field": "Microsoft.MachineLearningServices/workspaces/computes/computeType",
                        "notEquals": "AKS"
                      },
                      {
                        "field": "Microsoft.MachineLearningServices/workspaces/computes/enableNodePublicIP",
                        "equals": true
                      }
                    ]
                  }
                ]
              },
            "then": {
                "effect": "[parameters('effectType')]"
            }
        }
    }
}

Related content

• Azure Policy documentation
• Working with security policies with Microsoft Defender for Cloud
• The Cloud Adoption Framework scenario for data management and analytics outlines considerations for running data and analytics workloads in the cloud.
• Use policy to integrate Azure Private Link with Azure Private DNS zones