Reference :: MLOps v3 Accelerator

Commands

Mon, 01 Jan 0001 00:00:00 +0000

The module exports these commands. Use Get-Help -Full for parameters and examples. Command Purpose Test-MLOpsAcceleratorRequirement Pre-flight check of tools, az login, tokens and network. Also runs before -Deploy. Test-MLOpsModelQuota Checks regional model and Azure AI Search quota for the rag-llmops scenario. Also runs before -Deploy for that scenario. Get-MLOpsScenario List the scenarios and their ids. New-MLOpsInputFile Write an inputs file for a scenario. Test-MLOpsAcceleratorInput Validate an inputs file against the schema. Deploy-MLOpsAccelerator Generate the project. -Deploy plans, asks for approval and applies the bootstrap (-AutoApprove skips the prompt). -Upgrade regenerates an existing project. -Destroy tears down the bootstrap. -Interactive prompts for the inputs. Remove-MLOpsAccelerator Destroy the bootstrap and optionally delete the local folder. Grant-MLOpsStorageAccess Give the workspace identity Storage Blob Data Reader for data_source: adls. Test-MLOpsAcceleratorVersion Compare the pinned versions in versions.lock.json with the latest releases. Update-MLOpsAcceleratorVersion Update the pinned versions that still resolve together. Design Security: OIDC and workload identity federation with no stored secrets, Key Vault with RBAC and purge protection, Terraform state in Azure Storage with Entra authentication, a security scan in CI (Checkov for Terraform, PSRule for Azure for Bicep), and per-environment approvals. Operations: Log Analytics and Application Insights, promotion from dev to test to prod, and one state file per environment. MLOps: a training pipeline (prepare, train, evaluate, register), a model registry and a managed online endpoint with safe rollout. Azure Verified Modules: see Azure Verified Modules. Versions: versions.lock.json is the single source of truth. Python is pinned to 3.14 because 3.15 is still a release candidate and pyarrow has no wheels for it.

Azure Verified Modules

Mon, 01 Jan 0001 00:00:00 +0000

The infrastructure and bootstrap code use Azure Verified Modules (AVM) resource modules (Azure/avm-res-*, br/public:avm/res/*) and utility modules (avm-utl-regions, Azure/naming). Pattern modules are used only where one fits (AI Foundry). No AVM pattern covers a plain Azure ML workspace. AVM telemetry is on by default; set enable_telemetry = false (Terraform) or enableTelemetry = false (Bicep) to disable it. Exact versions are in versions.lock.json. Finding modules AVM publishes an llms.txt and a machine-readable module catalog with the source, status and owners of every Bicep and Terraform module. This site publishes its own llms.txt.

Comparison with the ALZ PowerShell accelerator

Mon, 01 Jan 0001 00:00:00 +0000

This page compares the accelerator with Azure/ALZ-PowerShell-Module (Deploy-Accelerator). ALZ keeps bootstrap and starter modules in separate repositories and downloads them by version. This accelerator ships its templates inside the module. ALZ capability Here Status Interactive prompts for missing inputs Deploy-MLOpsAccelerator with no inputs file, or -Interactive Done Requirements check (PowerShell, Azure CLI, Git, GitHub CLI, the YAML module, tokens and network) Test-MLOpsAcceleratorRequirement, run before -Deploy unless skipped Done Destroy and cleanup commands -Destroy and Remove-MLOpsAccelerator Done Upgrade of a generated project -Upgrade, with Git as the merge tool (see the upgrade guide) Done Plan then approve for the bootstrap -Deploy plans first; -AutoApprove skips the prompt Done Grant roles helper Grant-MLOpsStorageAccess; other role prerequisites are documented in Azure subscriptions and permissions Partly done Community files and release packaging README, CONTRIBUTING, SECURITY, SUPPORT, code of conduct and a release.yml that builds a zip on each v* tag Done Pin checks Test-MLOpsAcceleratorVersion and Update-MLOpsAcceleratorVersion Done Publish to the PowerShell Gallery The module is pre-release v0.2.0, tagged but not yet published. Waiting on the PSGALLERY_API_KEY secret (issue 35) Open End-to-end tests against real Azure The e2e.yml workflow applies, verifies and destroys scenarios 1 to 12 on Terraform and Bicep. The GitHub and Azure DevOps bootstraps and the Bicep pipeline on both are also verified live. Not yet tested live: private runners and state storage, endpoint deployment and the rai option (issue 31) Partly done Azure DevOps Managed DevOps Pools Not generated (issue 33) Open Separate plan and apply identities One deploy identity today (issue 32) Open Wiki Deferred. docs/ is the documentation set Not planned Deliberately not done Versioned, downloadable template packs with overrides, tfvars-to-JSON conversion, computed region data, HTTP retry options and Terraform version management. The templates ship inside the module, so these add no value yet. Revisit them if the templates move to their own repository.

Responsible AI

Mon, 01 Jan 0001 00:00:00 +0000

The accelerator does not yet automate Responsible AI (RAI) controls. This page lists what is and is not covered, and what is planned. What you get today Area Covered by Notes Infrastructure guardrails policy_mode Private access, no local auth, required tags. Not model behavior. Network isolation, identity, logging Scenarios 2, 3, 4 and 9 Security posture, not fairness or safety. Model fairness, explainability, error analysis Nothing Bring your own. GenAI content filtering and safety evaluation Nothing Scenario 10 deploys AI Foundry without a content filter policy. Planned additions The plan is an rai option, off by default, because RAI applies across scenarios. It is not implemented or verified live.

Configuration files

Mon, 01 Jan 0001 00:00:00 +0000

The accelerator has one input file and several generated files. This is simpler than ALZ, which has separate bootstrap, platform and library files. Inputs file inputs.yaml (or inputs.json) is the only file you write. It is validated against schema/inputs.schema.json before anything is generated. Create one for a scenario with New-MLOpsInputFile -Scenario -Path inputs.yaml. Start from inputs.example.yaml, which lists every input with comments. All inputs are documented in Options; the scenario list is in Scenarios. YAML or JSON If you cannot install the powershell-yaml module, use a .json file with the same keys. Files ending in .json are read as JSON, anything else as YAML. Finish your edits in YAML before you convert.

Resource providers

Mon, 01 Jan 0001 00:00:00 +0000

Azure only lets you deploy a resource type if the subscription is registered for its resource provider. Azure often registers providers on first use, but that needs permission and can fail mid-deployment, so register them up front in every subscription you deploy to (one per environment if you use separate subscriptions). Required providers Provider Needed for Scenarios Microsoft.MachineLearningServices Workspace, compute, registry All Microsoft.Storage Workspace storage, Terraform state, ADLS data All Microsoft.KeyVault Workspace Key Vault All Microsoft.ContainerRegistry Workspace container registry All Microsoft.OperationalInsights Log Analytics All Microsoft.Insights Application Insights, diagnostics All Microsoft.ManagedIdentity Deploy identity, workspace identities All Microsoft.Authorization Role assignments, policy assignments (registered by default) All Microsoft.PolicyInsights Policy compliance results All unless policy_mode: none Microsoft.Network VNets, private endpoints, private DNS 2, 3, 4, 9 and any private scenario Microsoft.CognitiveServices AI Foundry, model deployments 10, 12 Microsoft.Search Azure AI Search 12 Microsoft.Consumption Budget alerts 9, or when budget_amount is set Providers marked “registered by default” need no action. See the Azure list of providers by service.