Disable local authentication on ML Compute

March 21, 2025 ยท View on GitHub

SYNOPSIS

Azure Machine Learning compute resources should have local authentication methods disabled.

DESCRIPTION

Azure Machine Learning (ML) compute can have local authentication enabled or disabled. When enabled local authentication methods must be managed and audited separately.

Disabling local authentication ensures that Entra ID (previously Azure Active Directory) is used exclusively for authentication. Using Entra ID, provides consistency as a single authoritative source which:

  • Increases clarity and reduces security risks from human errors and configuration complexity.
  • Provides support for advanced identity security and governance features.

RECOMMENDATION

Consider disabling local authentication on ML - Compute as part of a broader security strategy.

EXAMPLES

Configure with Azure template

To deploy ML - compute that passes this rule:

  • Set the properties.disableLocalAuth property to true.

For example:

{
  "type": "Microsoft.MachineLearningServices/workspaces/computes",
  "apiVersion": "2023-06-01-preview",
  "name": "[format('{0}/{1}', parameters('name'), parameters('name'))]",
  "location": "[parameters('location')]",
  "properties": {
    "computeType": "ComputeInstance",
    "disableLocalAuth": true,
    "properties": {
      "vmSize": "[parameters('vmSize')]",
      "idleTimeBeforeShutdown": "PT15M"
    }
  },
  "dependsOn": [
    "[resourceId('Microsoft.MachineLearningServices/workspaces', parameters('name'))]"
  ]
}

Configure with Bicep

To deploy ML - compute that passes this rule:

  • Set the properties.disableLocalAuth property to true.

For example:

resource compute_instance 'Microsoft.MachineLearningServices/workspaces/computes@2023-06-01-preview' = {
  parent: workspace
  name: name
  location: location
  properties: {
    computeType: 'ComputeInstance'
    disableLocalAuth: true
    properties: {
      vmSize: vmSize
      idleTimeBeforeShutdown: 'PT15M'
      subnet: {
        id: subnet.id
      }
    }
  }
}