Any way to assign a static IP to an Azure ML Compute Cluster?

Question

Any way to assign a static IP to an Azure ML Compute Cluster?

Daniel Hargis 0 Microsoft External Staff

I am trying to get an Azure ML Compute Cluster to have a static IP so that it can query a web resource and we only need to allow a single IP or IP range. Is this possible?
Our Azure ML instance is on a private Vnet and we have tried with public IP on and off for the compute cluster. Thanks!

Sridhar M 3,160 Reputation points Microsoft External Staff Moderator

2025-12-19T00:22:37.9533333+00:00
Hi Daniel Hargis

Welcome to Microsoft Q&A and Thank you for reaching out.

Azure Machine Learning does not support assigning a static public IP address directly to a Compute Cluster. When using a Compute Cluster in a private virtual network (VNet), it is dynamically assigned an IP address upon creation, and you cannot statically assign it on your firewall.

Azure ML compute clusters are implemented using Azure-managed VM Scale Sets. Nodes are created and destroyed as the cluster scales. Because of this design, Azure does not support assigning or preserving a static public IP on the compute nodes themselves.

Placing the Azure ML workspace and compute cluster in a private virtual network controls inbound access, but it does not control outbound IP addresses. Without additional configuration, outbound traffic uses Azure’s default SNAT, which results in dynamic and unpredictable egress IP

supported and recommended solution to obtain a static outbound IP for an Azure ML compute cluster is to use an Azure NAT Gateway. When a NAT Gateway is associated with the subnet containing the compute cluster, all outbound traffic from that subnet uses the NAT Gateway’s public IP(s).

Static IP behavior with NAT Gateway:

A NAT Gateway can be configured with:

A single static public IP, or

A public IP prefix (small fixed range)

This provides a stable and predictable outbound IP that can be allowlisted on external web resources.

Required configuration

To use a NAT Gateway:

The Azure ML compute cluster must be deployed in a custom VNet

The NAT Gateway must be associated with the same subnet

No changes are required in Azure ML settings themselves

If the compute cluster already exists, it may need to be recreated to ensure traffic flows through the NAT Gateway.

please refer to the following documentation:

Egress with VNet injection

How to assign a single public IP for VNet-injected workspaces using Azure Firewall

Static private IP address configuration

Create an Azure Machine Learning compute cluster

I Hope this helps. Do let me know if you have any further queries.

Thank you!
Sridhar M 3,160 Reputation points Microsoft External Staff Moderator

2025-12-19T16:44:56.04+00:00

Hi Daniel Hargis

Did you get any chance to review the above response. Thank you!
Daniel Hargis 0 Reputation points Microsoft External Staff

2025-12-19T19:07:14.8166667+00:00

Hi Sridhar, out Azure ML instance is setup behind a Vnet already and we have the Vnet associated with a NAT Gateway and a jumpbox to access everything. When I go to the Azure ML Workspace from the Jumpbox the option to create a compute cluster in our own Vnet is grayed out. After some more research it looks like we need to have the Azure ML Workspace's Workspace Managed Outbound Access set to disabled in order to create compute clusters in our own Vnet. Is that correct? And if so, do we need to recreate the whole Azure ML Workspace with that setting disabled? Thanks
Sridhar M 3,160 Reputation points Microsoft External Staff Moderator

2025-12-22T16:55:10.6466667+00:00
Hi Daniel Hargis

if your Azure ML Studio “Use own VNet” / “Enable virtual network” option is grayed out, it’s typically because the workspace is using Workspace managed outbound access (managed VNet isolation mode), not the “customer VNet injection” mode. In that configuration, Azure ML provisions managed computes into an Azure ML–managed VNet,

so Studio won’t let you pick your own VNet/subnet for compute. [github.com], [xtls-v4.hkg1.meaqua.org], [Managed Vi...e Learning | Word]

1)Do you need to disable “Workspace Managed Outbound Access” to create compute clusters in your own VNet?

Yes. To create compute clusters/instances inside your own VNet (VNet injection), the workspace’s Workspace managed outbound access must be set to Disabled. When it’s disabled, Studio gives you the option during compute creation to select a VNet and subnet (Advanced settings → enable virtual network).

[xtls-v4.hkg1.meaqua.org], [Azure Mach...al network | SharePoint]

2)Do you need to recreate the whole workspace?

Most likely, yes. Because once you enable workspace managed outbound access (managed VNet modes like “Allow internet outbound” / “Allow only approved outbound”), you generally cannot revert back to Disabled. In other words, you can move up in restriction, but not back down to Disabled. [xtls-v4.hkg1.meaqua.org], [Managed Vi...e Learning | Word]

So if your current workspace is already in a managed outbound mode and you need computes in your own VNet + NAT Gateway egress, the practical path is:

Create a new Azure ML workspace with:

Workspace managed outbound access = Disabled

(Optionally) Private endpoint for the workspace, if you want private inbound access

Then create compute cluster/instance and select your VNet/subnet (the one associated with your NAT Gateway)

Your answer

Sridhar M 3,160 Reputation points Microsoft External Staff Moderator

2025-12-19T16:44:56.04+00:00

Hi Daniel Hargis

Did you get any chance to review the above response. Thank you!
Daniel Hargis 0 Reputation points Microsoft External Staff

2025-12-19T19:07:14.8166667+00:00

Hi Sridhar, out Azure ML instance is setup behind a Vnet already and we have the Vnet associated with a NAT Gateway and a jumpbox to access everything. When I go to the Azure ML Workspace from the Jumpbox the option to create a compute cluster in our own Vnet is grayed out. After some more research it looks like we need to have the Azure ML Workspace's Workspace Managed Outbound Access set to disabled in order to create compute clusters in our own Vnet. Is that correct? And if so, do we need to recreate the whole Azure ML Workspace with that setting disabled? Thanks
Sridhar M 3,160 Reputation points Microsoft External Staff Moderator

2025-12-22T16:55:10.6466667+00:00

Hi Daniel Hargis

if your Azure ML Studio “Use own VNet” / “Enable virtual network” option is grayed out, it’s typically because the workspace is using Workspace managed outbound access (managed VNet isolation mode), not the “customer VNet injection” mode. In that configuration, Azure ML provisions managed computes into an Azure ML–managed VNet,

so Studio won’t let you pick your own VNet/subnet for compute. [github.com], [xtls-v4.hkg1.meaqua.org], [Managed Vi...e Learning | Word]

1)Do you need to disable “Workspace Managed Outbound Access” to create compute clusters in your own VNet?

Yes. To create compute clusters/instances inside your own VNet (VNet injection), the workspace’s Workspace managed outbound access must be set to Disabled. When it’s disabled, Studio gives you the option during compute creation to select a VNet and subnet (Advanced settings → enable virtual network).

[xtls-v4.hkg1.meaqua.org], [Azure Mach...al network | SharePoint]

2)Do you need to recreate the whole workspace?

Most likely, yes. Because once you enable workspace managed outbound access (managed VNet modes like “Allow internet outbound” / “Allow only approved outbound”), you generally cannot revert back to Disabled. In other words, you can move up in restriction, but not back down to Disabled. [xtls-v4.hkg1.meaqua.org], [Managed Vi...e Learning | Word]

So if your current workspace is already in a managed outbound mode and you need computes in your own VNet + NAT Gateway egress, the practical path is:

Create a new Azure ML workspace with:

Workspace managed outbound access = Disabled

(Optionally) Private endpoint for the workspace, if you want private inbound access

Then create compute cluster/instance and select your VNet/subnet (the one associated with your NAT Gateway)

Share via

Any way to assign a static IP to an Azure ML Compute Cluster?

Your answer