How to create a secure workspace by using template

Templates provide a convenient way to create reproducible service deployments. The template defines what will be created, with some information provided by you when you use the template. For example, specifying a unique name for the Azure Machine Learning workspace.

In this tutorial, you learn how to use a Microsoft Bicep and Hashicorp Terraform template to create the following Azure resources:

  • Azure Virtual Network. The following resources are secured behind this VNet:
    • Azure Machine Learning workspace
      • Azure Machine Learning compute instance
      • Azure Machine Learning compute cluster
    • Azure Storage Account
    • Azure Key Vault
    • Azure Application Insights
    • Azure Container Registry
    • Azure Bastion host
    • Azure Machine Learning Virtual Machine (Data Science Virtual Machine)
    • The Bicep template also creates an Azure Kubernetes Service cluster, and a separate resource group for it.


Before using the steps in this article, you must have an Azure subscription. If you don't have an Azure subscription, create a free account.

You must also have either a Bash or Azure PowerShell command line.


When reading this article, use the tabs in each section to select whether to view information on using Bicep or Terraform templates.

  1. To install the command-line tools, see Set up Bicep development and deployment environments.

  2. The Bicep template used in this article is located at Use the following commands to clone the GitHub repo to your development environment:


    If you do not have the git command on your development environment, you can install it from

    git clone
    cd azure-quickstart-templates/quickstarts/microsoft.machinelearningservices/machine-learning-end-to-end-secure

Understanding the template

The Bicep template is made up of the main.bicep and the .bicep files in the modules subdirectory. The following table describes what each file is responsible for:

File Description
main.bicep Parameters and variables. Passing parameters & variables to other modules in the modules subdirectory.
vnet.bicep Defines the Azure Virtual Network and subnets.
nsg.bicep Defines the network security group rules for the VNet.
bastion.bicep Defines the Azure Bastion host and subnet. Azure Bastion allows you to easily access a VM inside the VNet using your web browser.
dsvmjumpbox.bicep Defines the Data Science Virtual Machine (DSVM). Azure Bastion is used to access this VM through your web browser.
storage.bicep Defines the Azure Storage account used by the workspace for default storage.
keyvault.bicep Defines the Azure Key Vault used by the workspace.
containerregistry.bicep Defines the Azure Container Registry used by the workspace.
applicationinsights.bicep Defines the Azure Application Insights instance used by the workspace.
machinelearningnetworking.bicep Defines te private endpoints and DNS zones for the Azure Machine Learning workspace.
Machinelearning.bicep Defines the Azure Machine Learning workspace.
machinelearningcompute.bicep Defines an Azure Machine Learning compute cluster and compute instance.
privateaks.bicep Defines an Azure Kubernetes Services cluster instance.


The DSVM and Azure Bastion is used as an easy way to connect to the secured workspace for this tutorial. In a production environment, we recommend using an Azure VPN gateway or Azure ExpressRoute to access the resources inside the VNet directly from your on-premises network.

Configure the template

To run the Terraform template, use the following commands from the machine-learning-end-to-end-secure where the main.bicep file is:

  1. To create a new Azure Resource Group, use the following command. Replace exampleRG with your resource group name, and eastus with the Azure region you want to use:

    az group create --name exampleRG --location eastus
  2. To run the template, use the following command:

    az deployment group create \
        --resource-group exampleRG \
        --template-file main.bicep \
        --parameters \
        prefix=myprefix \
        dsvmJumpboxUsername=azureadmin \

Connect to the workspace

After the template completes, use the following steps to connect to the DSVM:

  1. From the Azure portal, select the Azure Resource Group you used with the template. Then, select the Data Science Virtual Machine that was created by the template. If you have trouble finding it, use the filters section to filter the Type to virtual machine.

    Screenshot of filtering and selecting the vm.

  2. From the Overview section of the Virtual Machine, select Connect, and then select Bastion from the dropdown.

    Screenshot of selecting to connect using Bastion.

  3. When prompted, provide the username and password you specified when configuring the template and then select Connect.


    The first time you connect to the DSVM desktop, a PowerShell window opens and begins running a script. Allow this to complete before continuing with the next step.

  4. From the DSVM desktop, start Microsoft Edge and enter as the address. Sign in to your Azure subscription, and then select the workspace created by the template. The studio for your workspace is displayed.

Next steps


The Data Science Virtual Machine (DSVM) and any compute instance resources bill you for every hour that they are running. To avoid excess charges, you should stop these resources when they are not in use. For more information, see the following articles:

To continue learning how to use the secured workspace from the DSVM, see Tutorial: Get started with a Python script in Azure Machine Learning.

To learn more about common secure workspace configurations and input/output requirements, see Azure Machine Learning secure workspace traffic flow.