3 - Secure: managed VNet, approved outbound only

Workspace managed virtual network (AllowOnlyApprovedOutbound) with an FQDN and service tag allow-list.

Outbound traffic is limited to the allow-list. A managed Azure Firewall is created per environment, which is the largest fixed cost of any scenario.

Use it

New-MLOpsInputFile -Scenario managed-vnet-approved -Path inputs.yaml -Iac terraform -Cicd github

Inputs to review

• allowed_outbound_fqdns: see Options

See the cost estimates and the prerequisites.

Microsoft documentation

• https://learn.microsoft.com/azure/machine-learning/how-to-managed-network
• https://learn.microsoft.com/azure/machine-learning/how-to-access-azureml-behind-firewall