MLOps v3 documentation :: MLOps v3 Accelerator

What's new

Mon, 01 Jan 0001 00:00:00 +0000

Newest first. The latest release is v0.2.0 (2026-10-15); the first was v0.1.0 (2026-10-14). Releases are tagged v0.x.y until the first gold release (v1.0.0), which also needs the bootstrap, private runners and Azure DevOps verified live. The module is pre-release and is not on the PowerShell Gallery yet. Entries are tagged [Important] when you must act, or [Preview] for features that are not applied to a live subscription yet. Workload and GitHub bootstrap applied live All generated output is validated offline (render, terraform validate, az bicep build, pytest). Scenarios 1 to 12 are also verified live for Terraform and Bicep by the e2e.yml workflow. The GitHub and Azure DevOps bootstraps and the Bicep infra pipeline on both (dev and prod) are verified live too. Private runners and private state storage, separate plan and apply identities, Managed DevOps Pools, the rai option, the scenario 7 feature-set pack and endpoint deployment are not verified live; see Known issues.

Known issues

Mon, 01 Jan 0001 00:00:00 +0000

Issues you may hit, with workarounds. Each entry says when it was found and when it was fixed. For fixes and changes, see What’s new. Live coverage is partial Scenarios 1 to 12 have been applied to a real subscription on Terraform and Bicep. Scenario 12 (rag-llmops) passed once in centralus after eastus2 ran out of Azure AI Search capacity. The sample documents are for a fictional company; replace them with your own. Several other parts have not; see Live deployment coverage.

Release notes

Mon, 01 Jan 0001 00:00:00 +0000

This page lists only breaking changes, the ones that need action when you upgrade. Everything else is in What’s new. The releases so far (v0.1.0, v0.2.0) are pre-releases. The entries below are changes that affect projects you generated earlier. Each tagged release is on the GitHub releases page. Unreleased Policy guardrails assigned by default New projects get built-in Azure Policy assignments in audit mode (none for existing-platform). Set policy_mode to choose; see Policy mode.

Upgrade guide

Mon, 01 Jan 0001 00:00:00 +0000

How to move an existing project to a newer version of the accelerator. Check the Release notes first for breaking changes. Steps Install the new version of the module, then check it: Get-Module MLOpsAccelerator -ListAvailable. In your project, create a branch and commit everything. -Upgrade overwrites files, so Git is your merge tool. Regenerate into the same folder with your existing inputs: Deploy-MLOpsAccelerator -InputFile inputs.yaml -OutputPath . -Upgrade The folder must contain .mlops-v3/, which marks it as a project this tool generated. Review git diff. Keep your own changes and take the new template changes. If the release notes say so, re-run the bootstrap (it is idempotent) so new roles and variables are applied. Open a pull request. CI plans the change per environment. Read the plan before approving it.

Phase 0 - Planning

Mon, 01 Jan 0001 00:00:00 +0000

Plan your deployment by working through the decisions below. Note This phase is optional. If you already know what you want, skip to Phase 1. Terms Accelerator module: the MLOpsAccelerator PowerShell module (Deploy-MLOpsAccelerator). Inputs file: the one inputs.yaml that drives everything. Scenario: one of 11 Azure ML network, serving and governance patterns. Bootstrap: the Terraform that creates the repository, environments, identity and Azure access before any ML infrastructure exists. Generated project: the repository the accelerator writes: infrastructure, CI/CD and ML workload. Environment: a full Azure ML workspace and its dependencies, one per stage (dev, test, prod). Skills that help Terraform or Bicep workflow: Terraform fundamentals, Bicep learning path Azure Machine Learning: Azure ML learning path CI/CD and git: Introduction to DevOps, Introduction to git Decisions Each decision maps to a key in inputs.yaml. The parameter checklist lists them all in one place, and the decision flow shows how the choices connect.

Phase 1 - Prerequisites

Mon, 01 Jan 0001 00:00:00 +0000

Work through the three steps, then continue to Quick start. Run Test-MLOpsAcceleratorRequirement at any point to check the tools, sign-ins and tokens below. 1 - Tools and internet access Install these and make sure they are on the PATH of a PowerShell 7.4 or newer (pwsh) terminal: Tool Version Direct download PowerShell 7.4 or newer (tested on 7.4.6). Windows PowerShell 5.1 does not work. PowerShell 7.4.6 releases powershell-yaml module 0.4.7 or newer 0.4.7 on the PowerShell Gallery, or Install-PSResource powershell-yaml -Version 0.4.7 Terraform 1.16.0 or newer (tested on 1.16.5) Terraform 1.16.5 downloads Azure CLI tested on 2.90.0; newer releases should work Windows installer, 2.90.0 release (macOS and Linux: install steps) Bicep current, only for iac: bicep az bicep install, or the Bicep releases git current git downloads GitHub CLI (gh) optional, 2.x (tested on 2.102.0) GitHub CLI releases The Azure ML CLI extension (ml 2.45.1) is installed by the generated pipelines, so you do not install it yourself. Python 3.14 and the package versions are pinned in versions.lock.json and are used only by the pipelines.

Phase 2 - Bootstrap

Mon, 01 Jan 0001 00:00:00 +0000

Generates your project and, for the Terraform bootstrap, creates the version control repository, Azure identity and state storage. 1. Install the module (local, until it is published) git clone ; cd mlops-v3 ./install-local.ps1 # copies the module and templates to your user module path # ./install-local.ps1 -Uninstall Requires PowerShell 7.4 or newer and Install-PSResource (in-box from PowerShell 7.4). The other tools you need (Terraform, Azure CLI, git and so on) are listed with install links in prerequisites. Re-run after git pull to update.

Advanced

Mon, 01 Jan 0001 00:00:00 +0000

Options beyond the basic bootstrap and run steps. Private networking for the bootstrap Set use_private_networking: true (GitHub) to deploy self-hosted Azure Container Instances runners in a new VNet with a NAT gateway, using the AVM cicd-agents-and-runners module as the ALZ Accelerator does. The state storage account then gets a private endpoint and public access is turned off. runner_label defaults to self-hosted.

Phase 3 - Run

Mon, 01 Jan 0001 00:00:00 +0000

Bootstrap has created the repository, identity and environments. Now push the generated project and run its pipelines. Warning The module is pre-release (v0.2.0). Scenarios 1 to 12 are applied live, and the GitHub bootstrap with the Bicep pipeline is too, but Azure DevOps and endpoint deployment are not verified yet. Run it first in a throwaway subscription. 1. Push the generated project cd ./my-mlops git init -b main; git add .; git commit -m "Initial commit" git remote add origin ; git push -u origin main 2. Add approvals (recommended) The bootstrap creates one environment per stage (dev, test, prod by default) but does not add required reviewers. Add them yourself before the first run: in GitHub, open Settings, then Environments, select prod and add Required reviewers; in Azure DevOps, open Pipelines, then Environments, and use Approvals and checks. The approval gates the job that follows it, which here runs terraform plan and apply together, so reviewers approve before the plan runs.

FAQ

Mon, 01 Jan 0001 00:00:00 +0000

Frequently asked questions, grouped by topic. Cleanup: remove what the accelerator created. Permissions: who needs which role, and why. Customization: change generated output safely. Miscellaneous: everything else.

Troubleshooting

Mon, 01 Jan 0001 00:00:00 +0000

Symptom Likely cause What to do terraform init fails with 403 on the state account Policy disables public access to storage Use use_private_networking: true or a self-hosted runner_label. See Advanced Deploy fails with an authorization error on policy Missing Resource Policy Contributor role Re-run the bootstrap, or set policy_mode: none RequestDisallowedByPolicy policy_mode: deny blocked a resource Check the activity log, fix the resource, or use audit Name conflict on Key Vault or workspace Soft-deleted resources hold the name Purge them, or set a new name_suffix Jobs never start and the message mentions payments or spending limit GitHub Actions minutes or budget exhausted Check Billing, or use self-hosted runners Pipelines missing in Azure DevOps Bootstrap does not register pipelines Create them from the YAML in pipelines/ Private scenario ml-train cannot reach the workspace Hosted agents have no network path Use a self-hosted runner or agent in a network that reaches the private endpoints Compliance shows non-compliant right after deploy Evaluation delay of up to about 30 minutes az policy state trigger-scan More detail: known issues and the FAQ.

Quick start

Mon, 01 Jan 0001 00:00:00 +0000

1. Prerequisites Install these tools, sign in with az login, and create a GitHub token or Azure DevOps PAT. See the parameter checklist and prerequisites for details. Tool Version Direct download PowerShell 7.4 or newer (tested on 7.4.6). Windows PowerShell 5.1 does not work. PowerShell 7.4.6 releases powershell-yaml module 0.4.7 or newer 0.4.7 on the PowerShell Gallery, or Install-PSResource powershell-yaml -Version 0.4.7 Terraform 1.16.0 or newer (tested on 1.16.5) Terraform 1.16.5 downloads Azure CLI tested on 2.90.0; newer releases should work Windows installer, 2.90.0 release (macOS and Linux: install steps) Bicep current, only for iac: bicep az bicep install, or the Bicep releases git current git downloads GitHub CLI (gh) optional, 2.x (tested on 2.102.0) GitHub CLI releases The Azure ML CLI extension (ml 2.45.1) is installed by the generated pipelines, so you do not install it yourself. Python 3.14 and the package versions are pinned in versions.lock.json and are used only by the pipelines.

Scenarios

Mon, 01 Jan 0001 00:00:00 +0000

Pick one with scenario: in the inputs file. List them with Get-MLOpsScenario. Scaffold an inputs file with New-MLOpsInputFile -Scenario -Path inputs.yaml -Iac -Cicd . # Id Network Serving Adds 1 basic-public public none Workspace, storage, Key Vault, Azure Container Registry, Application Insights, CPU cluster, training pipeline 2 managed-vnet-internet managed VNet, internet outbound online Private endpoints, public access disabled 3 managed-vnet-approved managed VNet, approved outbound only online FQDN and service tag allow-list (allowed_outbound_fqdns) 4 byo-vnet your VNet (created) online Spoke VNet, subnets, private DNS zones, private endpoints (vnet_address_space) 5 batch-scoring public batch Batch endpoint and deployment, nightly scoring workflow 6 online-bluegreen public online (blue/green) Deploy workflow shifts 10% then 100% of traffic and retires the old deployment 7 feature-store public online Managed feature store workspace 8 registry-promotion public online Shared Azure ML registry in the first environment, ml-promote workflow, deploy from the registry 9 governance public online Diagnostics, budget alerts (budget_amount, alert_emails), resource lock, policy 10 genai-foundry public none AI Foundry hub, AI Services account and project 11 existing-platform existing subnet and DNS online Reuses existing_platform subnet, private DNS zones and Log Analytics; governance on 12 rag-llmops public none AI Foundry plus Azure AI Search, model deployments, sample index and an evaluation quality gate Choosing a scenario Start here if… Scenario Relative fixed cost You are learning or prototyping and data is not sensitive 1 basic-public Lowest (about $60 per month for 3 environments) You need real-time scoring with a REST endpoint 6 online-bluegreen (safe rollouts) or 2 to 4 (private) Low to medium Scoring runs on a schedule, not in real time 5 batch-scoring Low (compute only while running) Security requires no public access, and you have no existing network 2 managed-vnet-internet, or 3 for locked-down egress Medium; 3 adds a managed firewall, which is the largest fixed cost You must control the network yourself 4 byo-vnet Medium (private endpoints and DNS zones) A platform team already owns the subnet, DNS and Log Analytics 11 existing-platform Medium; reuses shared services Several teams share models across workspaces or environments 8 registry-promotion Low added cost You need reusable features across models 7 feature-store Low added cost Finance or audit needs budgets, policy and diagnostics 9 governance Low added cost You are building generative AI apps 10 genai-foundry Depends on the models you deploy You are building a chat app over your own documents with an evaluation gate 12 rag-llmops Adds Azure AI Search (basic tier is roughly 75 USD per month) plus model token use Costs are relative and exclude training compute and endpoint instance hours, which dominate once you deploy. The default is three environments (see the parameter checklist). Set two to cut the fixed cost.

Azure Policy

Mon, 01 Jan 0001 00:00:00 +0000

This section documents the Azure Policy guardrails the accelerator assigns to each environment. Note Policy is a guardrail layer, not the main purpose of the accelerator. It uses built-in policy definitions only, at resource group scope. It does not create custom definitions, initiatives or management-group assignments. Policy mode Set policy_mode in inputs.yaml:

Options

Mon, 01 Jan 0001 00:00:00 +0000

Every option is a change to inputs.yaml followed by a regenerate, or a small edit to the generated files. This page shows which. How to change an option Edit inputs.yaml. Validate: Test-MLOpsAcceleratorInput -InputFile inputs.yaml. Regenerate over an existing project (commit first, then review the diff): Deploy-MLOpsAccelerator -InputFile inputs.yaml -OutputPath ./my-mlops -Upgrade Add -Deploy only if you also need to re-run the bootstrap (new repository, environments or identity). Changes to the workload and infrastructure are rolled out by the pipelines after you merge to main.

Reference

Mon, 01 Jan 0001 00:00:00 +0000

Background material: Configuration files, Resource providers, Responsible AI, Azure Verified Modules and the comparison with the ALZ PowerShell accelerator.