What's changed: Added per-section figures (cert-figure-retrofit). New AI-300 Chapter 1 (Domain 1 "MLOps infrastructure": workspace/datastores/compute targets/IAM; asset management = data assets/environments/components/registries; IaC and automation = Bicep-Azure CLI/GitHub Actions/workload identity federation/network restriction/Git)
1.1Machine Learning workspaces and resources
Understand creating and managing an Azure Machine Learning (AML) workspace, datastores, compute targets, and identity and access management for the workspace (managed identities / RBAC)—the foundation of MLOps infrastructure.
AI-300 extends DP-100 (data scientist) toward operationalization (MLOps + GenAIOps). Beyond "building" models, it asks you to design infrastructure, automate the lifecycle, and ensure quality and observability. The starting point is the Azure Machine Learning (AML) workspace, the working foundation for machine learning.
1.1.1Workspace and datastores
A workspace is the central resource bundling ML assets—experiments, models, endpoints, and compute. Connect to data via datastores (securely managing connection info to Blob Storage, Data Lake, etc. without embedding credentials), on top of which you define data assets. The workspace works with Key Vault, Storage, Container Registry, and Application Insights.
1.1.2Compute targets
- Compute instance: a personal dev box (notebooks)—a single-user work machine.
- Compute cluster: multi-node, auto-scaling for training jobs; scales in to 0 after use to cut cost.
- Inference cluster (AKS) / managed endpoints: where production inference runs—real-time or batch.
1.1.3Identity and access management
Assign least-privilege access with Azure RBAC (built-in Reader/Contributor/Owner and AzureML-specific roles). When the workspace or jobs access other resources (Storage, Key Vault), use managed identities to authenticate without secrets. Store sensitive secrets in Key Vault. These underpin safe MLOps automation.
| Purpose | Compute | Key point |
|---|---|---|
| Personal dev (notebooks) | Compute instance | Single-user; watch always-on cost |
| Training jobs | Compute cluster | Auto-scale; scale in to 0 |
| Production inference | Managed endpoints / AKS | Real-time/batch |
| Data connection | Datastores | No embedded credentials |
| Resource auth | Managed identity | Secretless |
Watch the mix-ups: (1) compute instance (single-user dev) vs compute cluster (auto-scaling for training)—instances often incur always-on cost. (2) datastore (connection info) vs data asset (a reference to specific data). (3) Prefer managed identities (secretless) for resource access.
Map requirement → resource: "run training jobs cheaply with auto-scale" = compute cluster; "individual notebook dev" = compute instance; "connect to Storage without secrets" = managed identity + datastore; "grant least-privilege access" = Azure RBAC.
1.1.4Section summary
- AML workspace = center of ML assets; connect data via datastores (no embedded credentials)
- Compute: instance (personal dev) / cluster (training, auto-scale) / managed endpoints (production inference)
- Access via least-privilege Azure RBAC; resource auth via managed identities (secretless); secrets in Key Vault
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which auto-scales for training jobs and scales in to 0 nodes after use to cut cost?
Q2. Which single-user work machine is used for individual notebook development?
Q3. Which AML construct securely manages connection info to Blob Storage, etc., without embedding credentials?
Q4. Which lets the workspace or jobs authenticate to Storage or Key Vault without secrets?
Q5. Which is used to grant least-privilege access to an AML workspace?
Q6. Which statement about an AML workspace is correct?