Error Accessing Notebooks in Azure Machine Learning Workspace: Add NSG Rules for Storage Account in VNET

Introduction

When creating an Azure Machine Learning (ML) workspace and trying to access Jupyter Notebooks or other resources, you might encounter an error message indicating that your Storage account is not reachable from the virtual network (VNET) associated with your ML workspace. In this article, we will discuss the causes of this issue and how to resolve it by adding Network Security Group (NSG) rules to your Storage account.

Causes

Azure Machine Learning workspaces are hosted in Azure Virtual Networks (VNETs). These VNETs provide a secure and isolated environment for your ML workloads. When you create an ML workspace, an Azure Resource Manager (ARM) template is used to create various resources, including a Storage account for storing your data. By default, the Storage account is not directly accessible from the internet or from the ML workspace's VNET.

To access the resources in the Storage account, you need to add NSG rules to the Storage account's subnet. These rules allow inbound traffic from the ML workspace's VNET, ensuring that you can access your Notebooks, experiments, and other resources stored in the Storage account.

Prerequisites

Before you begin, make sure you have the following prerequisites:

• An Azure subscription
• Azure CLI installed and configured
• Access to the Azure portal

Steps to Add NSG Rules to Storage Account VNET

Find Storage Account Subnet ID

To add NSG rules to the Storage account's subnet, you first need to find the subnet ID. Follow these steps:

1. Navigate to the Azure portal (https://portal.azure.com/)
2. Search for and open your ML workspace
3. Go to the "Networking" tab
4. Find the "Subnet" section and note down the "Subnet ID" value

Create or Update NSG

Create or update the NSG associated with the ML workspace's VNET to add the required rules to allow traffic from the Storage account subnet:

1. Search for and open the NSG in the Azure portal
2. Go to the "Inbound security rules" tab
3. Click "Add" to create a new rule

Name: MLWorkspaceToStorageAccount

Priority: 1001

Source: Subnet

Destination port ranges: 443

Protocol: All

Action: Allow

4. Repeat the process to add another rule for the ML workspace's VNET's private IP address range:

Name: MLWorkspacePrivateIP

Priority: 1002

Source: VirtualNetwork

Destination port ranges: 443

Protocol: All

Action: Allow

Apply NSG to Storage Account Subnet

Assign the updated NSG to the Storage account's subnet:

1. Search for and open the Storage account in the Azure portal
2. Go to the "Networking" tab
3. Click "Add subnet" and select the subnet associated with the ML workspace
4. Select the previously created NSG
5. Click "Apply" to save the changes

Summary

In this article, we discussed the error you might encounter when trying to access Notebooks or other resources in an Azure Machine Learning workspace due to the Storage account not being reachable from the VNET associated with the workspace. We covered the causes of this issue and the steps to resolve it by adding NSG rules to the Storage account's subnet. By following these steps, you will be able to access your Notebooks, experiments, and other resources stored in the Storage account.