{"id":20917044,"url":"https://github.com/bluegranite/amls_admin","last_synced_at":"2026-04-12T23:50:45.414Z","repository":{"id":133234186,"uuid":"197823343","full_name":"BlueGranite/amls_admin","owner":"BlueGranite","description":"Enterprise Configuration of Azure Machine Learning Service Workspaces","archived":false,"fork":false,"pushed_at":"2019-07-20T15:38:47.000Z","size":964,"stargazers_count":0,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-12T23:30:46.094Z","etag":null,"topics":["azure","azure-machine-learning","azure-machine-learning-services","machine-learning"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/BlueGranite.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-07-19T18:25:19.000Z","updated_at":"2019-07-20T15:38:49.000Z","dependencies_parsed_at":null,"dependency_job_id":"fa8c5d3c-1baa-4031-9f5b-5a8a666e2b99","html_url":"https://github.com/BlueGranite/amls_admin","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/BlueGranite/amls_admin","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BlueGranite%2Famls_admin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BlueGranite%2Famls_admin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BlueGranite%2Famls_admin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BlueGranite%2Famls_admin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/BlueGranite","download_url":"https://codeload.github.com/BlueGranite/amls_admin/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BlueGranite%2Famls_admin/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":274609465,"owners_count":25316621,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-11T02:00:13.660Z","response_time":74,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure","azure-machine-learning","azure-machine-learning-services","machine-learning"],"created_at":"2024-11-18T16:29:43.106Z","updated_at":"2026-04-12T23:50:40.358Z","avatar_url":"https://github.com/BlueGranite.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Enterprise Configuration of Azure Machine Learning Service Workspaces\n\n## Administration Tutorial\n\n[![Deploy to Azure](http://azuredeploy.net/deploybutton.png)](https://deploy.azure.com/?repository=https://github.com/BlueGranite/dogbreeds/tree/colby#/form/setup)\n\nThe purpose of this tutorial is to guide administrators on creating and preparing Azure Machine Learning (AzureML) service workspaces for data scientists. AzureML empowers teams to collaboratively build, train, and deploy machine learning models.\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003e\u003cem\u003eTable of Contents\u003c/em\u003e\u003c/strong\u003e\u003c/summary\u003e\n\n* [Scenarios](#scenarios)\n* [Access Azure CLI and Clone Repository](#1-access-the-azure-command-line-interface-cli-in-the-azure-portal-and-clone-the-file-repository)\n* [Setup AMLS Workspaces](#2-setup-azureml-workspaces)\n* [Setup AMLS Compute](#3-setup-compute)\n* [Assigning User Roles](#4-assigning-user-roles)\n* [Additional Considerations](#5-additional-considerations-for-workspace-design)\n\n\u003c/details\u003e\n\nThis tutorial provides instructions for automating workspace creation along with customization options for creating compute targets and assigning roles to users.\n\nStep-by-step instructions are provided for the following scripts included in this repository:\n\n- [Workspace Creation using `newamllabworkspace.sh`](#2-setup-azureml-workspaces) - Creates a customized workspace and a *Data Scientist* user role.\n\n- [Compute Creation using `newamllabcompute.sh`](#3-setup-compute) - Creates one or more remote compute targets.\n\n- [Role Assignment using `assignamlworkspaceroles.sh`](#4-assigning-user-roles) - Assigns one or more users to the *Team Lead* and *Data Scientist* roles.\n\n### Scenarios:\n\nAn enterprise can have multiple organizations responsible for its own profit \u0026 loss. Each organization can have its own subscription to track its resource capacity utilization and billing. All Azure Machine Learning resources can be shared across a  subscription, but proper workspace configuration is required to monitor resource usage and control spend. For example, in Microsoft Research, there are multiple subscriptions, each representing subgroups within Microsoft responsible for resource capacity planning. The way resources are distributed and shared is differs by group. In one subscription, each resource group represents one team and there will be one workspace in that resource group for the entire team.\n\nIn another subscription, each workspace represents a specific type and quantity of GPU VM family with a limit on compute nodes. In this scenario, different users are  temporarily assigned to the resource groups based on their computing requirements. Access to the resource group and the workspace will change on a regular basis.\n\nEnterprises often have a fixed budget for each fiscal time period. Thus, being able to control access impacting the spend and utilization of compute resources is important for enterprises. There are two activities that can cause the spend to go beyond the upper limit of the budget: requesting more quota for the AML service and creating clusters which do not auto scale.\n\nOnce a subscription is available, when adding an AML service, a quota request approval is required. The AML service comes with three built-in roles: Owner, Contributor and Reader. Subscription Owner and Contributor and Workspace Owner and Contributor can request quota change. Please see [this reference](https://docs.microsoft.com/en-us/azure/machine-learning/service/how-to-manage-quotas) for more information on managing quotas.\n\nCreating the right cluster definition is critical. We recommend setting the minimum number of nodes to 0 (the default) and idle seconds before scale down  to 120 (the default).  The ensures the compute cluster will automatically scale down during period of inactivity and not incur charges. Subscription Owner and Contributor, and Workspace Owner and Contributor can create and modify the cluster configuration. Please see [this reference](https://docs.microsoft.com/en-us/azure/machine-learning/service/how-to-set-up-training-targets) for more information on setting up compute clusters.\n\nAccess management for cloud resources is a critical function for any organization that is using the cloud. [Role-based access control (RBAC)](https://docs.microsoft.com/en-us/azure/role-based-access-control/overview) helps you manage who has access to Azure resources, what they can do with those resources, and what areas they have access to. In an enterprise scenario for AML, we would like to manage which users can perform actions such as requesting resource quota and creating/modifying compute clusters. Data scientists should be able to prepare data, build, train, deploy and inference models in the workspaces within the  approved resources and using clusters already setup by Administrators.\n\nIn this  tutorial, Administrators are those who are assigned the role of Subscription and Workspace Owners. A custom role of ‘Data Scientist’ will be created. Thus, we will have three RBAC roles in play for the AML service.  Owner  (built-in role) for the Admin  persona, Reader  (built-in role) for applications or those with read access only, and Data Scientist (custom role) for data scientist persona.\n\n#### This tutorial will cover automation and management related to:\n\n- Creating custom user roles,  such as a data scientist, with defined permissions related to compute resources\n\n- Creating resource groups for AzureML-related resources\n\n- Creating AzureML workspaces\n\n- Assigning user permissions at various scopes, such as subscription or workspace\n\n__Important concepts:__\n\n- [AzureML workspaces](https://docs.microsoft.com/en-us/azure/machine-learning/service/concept-workspace) allow collaboration through data set and model registration\n\n- Understand user roles: owner, reader, and the custom role of data scientist\n\n- How to enforce compute resource quota across team members\n\n__Assumptions:__\n\n- Users of this guide will already have an assigned subscription ID and compute quota.\n\n#### This guide will focus on roles for two personas: ‘*Team Lead*’ and ‘*Data Scientist*’.\n\n__Team Lead persona:__\n\n- create and manage access to resource groups and AzureML workspaces for data science teams\n\n- create and allocate compute resources within quota (monitor and report)\n\n- create and manage shared datastores for workspace artifacts and experiment data\n\n- manage spend on compute resources by creating custom roles with access controls\n\n- provide shared resource information (such as secure data stores) to team members\n\n- provide AzureML training resources to team members\n\n__Data Scientist persona:__\n\n- Use workspace to run machine learning experiments, especially at scale with remote compute resources\n\n- Use dedicated and shared Azure data sources for collaborative model building\n\n- Cannot request compute quota\n\n- Cannot create or modify AzureML compute resources\n\n- Cannot create support tickets\n\n### Overview of activities performed in this setup:\n\n1. Access the Azure Command Line Interface (CLI) in the Azure Portal and clone the file repository\n\n2. Setup Azure ML workspace using a provided template script. This script includes creating a custom ‘Data Scientist’ role.  \n\n3. Setup compute resources using a provided template script.\n\n4. Assigning Users to Roles\n\n5. Additional Considerations for Workspace Design.\n\n**IMPORTANT:** The admin scripts run in Bash.\n\n---\n\n## Activities for Setup:\n\n### 1. Access the Azure Command Line Interface (CLI) in the Azure Portal and Clone the File Repository\n\nThe Azure CLI is a command-line tool providing a great experience for managing Azure resources. The CLI is designed to make scripting easy, query data, support long-running operations, and more.\n\nLog into the Azure Portal and click on the cloud shell icon in the top right panel:\n\n![](img/1_AccessCLI.png)\n\n[Cloud Shell](https://docs.microsoft.com/en-us/azure/cloud-shell/persisting-shell-storage) machines are temporary and require an Azure File share to be mounted as `clouddrive`. On the first launch of Cloud Shell the following items are automatically created for this purpose. If prompted to create resources for file share enter yes.\n\n![](img/2_AccessCLI.png)\n\n### 2. Setup AzureML Workspaces\n\nThe _workspace_ is the top-level resource for Azure Machine Learning service. For ideas on workspace organization see the following two links: [What is an Azure Machine Learning service workspace?](https://docs.microsoft.com/en-us/azure/machine-learning/service/concept-workspace) and [How Azure Machine Learning service works: Architecture and concepts](https://docs.microsoft.com/en-us/azure/machine-learning/service/concept-azure-machine-learning-architecture). A workspace provides a centralized place to work with the artifacts created while using Azure Machine Learning service. These artifacts include metrics and logs associated with a training run. This aids in determining the best model when testing multiple options. A workspace can be created in multiple ways including through a Resource Manager template, the Azure Portal, and Azure CLI.\n\nFor this setup, a template script `newamllabworkspace.sh` is provided in the script repository.\n\n- This script provisions the following resources using parameters specified in the `config.yml` file (editing instructions to customize your workspace are shown [below](#workspace-parameters)):\n\n| Resource            | Description                                                                                                                                                              |\n| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |\n| Resource Group      | The top-level resource that provides a centralized location for all the resources                                                                                        |\n| ML Workspace        | The service for Machine Learning in Azure, includesexperiment tracking, model management, operationalization, and more.                                                  |\n| Storage Account     | Two accounts are created, `devdata` and `devwork`. The `devdata` is used to store data for analysis. The `devwork` is used to store any artifacts created from the runs. |\n| Container Registry  | Used to build, store, and manage images for container deployments.                                                                                                       |\n| Key Vault           | Used to encrypt and store authentication keys, storage account keys, and secrets                                                                                         |\n| App Insights        | Used to monitor the live web application, including detecting anomalies and understanding user interaction.                                                              |\n| Data Scientist Role | Can use the workspace and shared resources but cannot request compute quota, modify compute resources or create support tickets                                          |\n\n- The Data Scientist role is created as a custom role. Users can be [assigned to this role](https://docs.microsoft.com/en-us/azure/machine-learning/service/how-to-assign-roles) within the Azure Portal or using the `assignamlworkspaceroles.sh` (as shown in [step 4](#4-assigning-user-roles) below).\n\n#### To Begin...\n\nClone the git directory in the Azure CLI use the following command:\n\n`git clone --single-branch --branch colby https://github.com/BlueGranite/dogbreeds.git`\n\nThis workspace template script receives the required workspace creation and naming parameters such as subscription id, department, team, region, and admin from a configuration file. You will need to update the `config.yml` file with your own account information as follows:\n\n- Open the `config.yml` in the CLI editor and update the values with your own subscription and naming information. This file, along with the other required template files, are located in the downloaded directory from above in *lab/admin*.\n  - *Note*: To edit your `config.yml` file, you can use your favorite command line text editor such as `nano`. Use the command `nano config.yml`and the file will open in the text editior. Update the parameters to the desired values. Once you are finished editing, press `ctrl-x` to exit and then `y` to save.\n  \n  - ##### Workspace Parameters:\n    \n    | Parameter      | Description                                                                                                                                                                                                                                                                                              | Example                                          |\n    |:--------------:|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|:------------------------------------------------:|\n    | subscription   | Your Azure subscription where the resources are to be created                                                                                                                                                                                                                                            | 8b41ca0c-0c5a-4c01-b49b-5bb8d329cc27             |\n    | custom_name    | Give a custom name to the resources. Can be used to suppress Microsoft’s automatic, conventional naming scheme of concatenating the other parameters. This parameter is useful in ensuring multiple workspaces with common names are not trying to be created which would result in an error. (Optional) | myamlsresource                                   |\n    | department     | 4 characters to specify the department name at your organization                                                                                                                                                                                                                                         | dpt2                                             |\n    | team           | 10 characters to specify the team name at your organization                                                                                                                                                                                                                                              | myteam                                           |\n    | region         | The region where the resources are to be created.                                                                                                                                                                                                                                                        | eastus2                                          |\n    | region_abbv    | 2 characters abbreviation of the desired region                                                                                                                                                                                                                                                          | e2                                               |\n    | environment    | 3 characters to specify the type of environment                                                                                                                                                                                                                                                          | select from `res`, `dev`, or `pro`               |\n    | admin          | The admin Microsoft account that will be used to create the resources                                                                                                                                                                                                                                    | user@domain.com                                  |\n    | security_group | Name of the security group on premises to map a group in Azure Active Directory (Optional)                                                                                                                                                                                                               | datasciencegroup                                 |\n    | create_dls     | Should the script create an additional Azure Data Lake Store for housing large datasets?                                                                                                                                                                                                                 | `y` to create the data lake store or `n` to skip |\n  \n  - Compute Parameters:\n    \n    *Note:* Each of these parameters can either be a single value or a comma-separated list of values if you want to create multiple computes at once.\n    \n    | Parameter    | Description                                                                                                                                                  | Example                                                                       |\n    |:------------:|:------------------------------------------------------------------------------------------------------------------------------------------------------------:|:-----------------------------------------------------------------------------:|\n    | nodes        | List of maximum number of nodes to which each cluster will scale                                                                                             | 1, 2, 1                                                                       |\n    | priority     | List of priority levels of the cluster resources                                                                                                             | lowpriority, dedicated, lowpriority\u003cbr/\u003e(either `lowpriority` or `dedicated`) |\n    | vm_sku       | List of VM SKUs from `az vm list-sizes --location,--output table` or from [this list](https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sizes) | STANDARD_DS3_V2, STANDARD_D13_V2, STANDARD_NV6                                |\n    | cluster_name | List of cluster names to be created, up to 16 characters each.                                                                                               | ds3-v2-cluster, ds13-v2-2ndclust, nv6-gpucluster                              |\n  \n  - Role Parameters:\n    \n    *Note:* Each of these parameters can either be a single value or a comma-separated list of values if you want to assign multiple users at once.\n    \n    | Parameter       | Description                                                | Example                         |\n    | --------------- | ---------------------------------------------------------- | ------------------------------- |\n    | team_leads      | List of accounts to be assigned to the Team Lead role      | admin1@site.com, user1@site.com |\n    | data_scientists | List of accounts to be assigned to the Data Scientist role | user1@site.com, user2@site.com  |\n\nRun the workspace creation script by using `bash newamllabworkspace.sh`. The script will automatically look for the `config.yml` file to read in your settings.\n\nThe user also has the option to specify a different YAML file for the script to use. Simply create your YAML file and pass the filename in as you call the script using `bash newamllabworkspace.sh \u003cYOUR CONFIG FILENAME\u003e.yml`. \n\nEnter ‘`y`’ to continue. A prompt will appear to follow the Microsoft link to login with the provided authentication code.\n\n![](img/1_SetupWorkspaces.png)\n\nThis will create the workspace along with the necessary resources.\n\n![](img/2_SetupWorkspaces.png)\n\nBy navigating to the specified subscription and resource group in the Azure portal window all the resources created can be viewed:\n\n![](img/3_SetupWorkspaces.png)\n\n### 3. Setup Compute\n\nA [compute target](https://docs.microsoft.com/en-us/azure/machine-learning/service/concept-compute-target) specifies the compute resource where a training script will be run. The target could either be on a local machine or cloud-based. Compute targets allow for an easy transition among environments without altering code.\n\nFor this setup, a template script `newamllabcompute.sh` is provided in the script repository.\n\n- This script creates one or more remote compute targets using parameters specified in the `config.yml` file (editing instructions to customize your compute targets are explained [above](#workspace-parameters)).\n\nThe parameters required for the compute script include:\n\n- Maximum number of nodes\n\n- Priority of the node: either lowpriority or dedicated\n\n- VM SKU: Options for this parameter can be found using the command `az vm list-sizes --location \u003cregion\u003e --output table`\n\n- Cluster Name: Up to 16 characters allowed\n\n*Note:* Multiple computes can be created by using comma-separated lists for each of these parameters.\n\nSimilarly, to the workspace script, these parameters can be customized in the `config.yml` file or your own YAML file.\n\nTo run the compute script, enter `bash newamllabcompute.sh` or `bash newamllabcompute.sh \u003cYOUR CONFIG FILENAME\u003e.yml` (if using a different YAML file from the `config.yml`). Again, follow the Microsoft hyperlink to the login page and enter the provided authentication code.\n\n![](img/1_SetupCompute.png)\n\nThe compute parameters are displayed and pressing enter to verify the parameters are correct launches the creation of the compute target\n\n![](img/2_SetupCompute.png)\n\nAttributes and properties of the cluster can be viewed by navigating to the machine learning workspace and clicking on the Compute icon on the left side panel.\n\n![](img/3_SetupCompute.png)\n\nTo create additional computes in the same workspace:\n\n- Edit the `config.yml` and add your additional compute specifications to the parameter lists.\n\n- The name of the new compute must be different from the existing computes\n\n- In Azure CLI, re-run the command `bash newamllabcompute.sh` and the script will then create any computes that don't already exist.\n  \n  Note: The script will skip over any computes that already exist (based on cluster name).\n\n### 4. Assigning User Roles\n\nYou may want to configure different user privileges across data stores using [role-based access control](https://docs.microsoft.com/en-us/azure/role-based-access-control/overview#how-rbac-works) (RBAC). For example, an administrator may want to control access to storage with personally identifiable information and allow access to only certain members or teams within a workspace. The _team lead_ and *data scientist* roles can be assigned using the `assignamlworkspaceroles.sh` script.\n\nFor this setup, a template script `assignamlworkspaceroles.sh` is provided in the script repository.\n\n- This script assigns one or more users to either the *Team Lead* role or the *Data Scientist* role using parameters specified in the `config.yml` file (editing instructions to customize your compute targets are explained [above](#workspace-parameters)).\n\nAs in creating multiple computes, in the `config.yml` file, list the accounts desired for each role in a comma-separated list. Then run in the Azure CLI:\n\n`bash assignamlworkspaceroles.sh` or `bash assignamlworkspaceroles.sh \u003cYOUR CONFIG FILENAME\u003e.yml`\n\nCurrently, as mentioned above, the only roles assigned by the script are *Team Lead* and *Data Scientist*. In future installments, there will be two types of B.C. Administration Roles; one at the subscription level and one at the resource group level. The subscription-level admin role will have the ability to request and create more quota. The resource group-level admin role will not be able to increase quota but can create clusters.\n\n### 5. Additional Considerations for Workspace Design\n\n- You may want to configure workspaces differently for different organizational scenarios. Common examples include team-based and project-based design. \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbluegranite%2Famls_admin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbluegranite%2Famls_admin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbluegranite%2Famls_admin/lists"}