Create a hub by using the Azure Machine Learning SDK and CLI

1. Install packages. (If in a notebook cell, use %pip install instead.)

   pip install azure-ai-ml
   pip install azure-identity
   

2. Provide your subscription details:

   # Enter details of your subscription
   subscription_id = "<SUBSCRIPTION_ID>"
   resource_group = "<RESOURCE_GROUP>"

3. Get a handle to the subscription. All the Python code in this article uses ml_client:

   # get a handle to the subscription
   
   from azure.ai.ml import MLClient
   from azure.identity import DefaultAzureCredential
   
   ml_client = MLClient(DefaultAzureCredential(), subscription_id, resource_group)

4. (Optional) If you have multiple accounts, add the tenant ID of the Microsoft Entra ID you wish to use into the DefaultAzureCredential. Find your tenant ID from the Azure portal under Microsoft Entra ID, External Identities.

   DefaultAzureCredential(interactive_browser_tenant_id="<TENANT_ID>")
   

5. (Optional) If you're working on in the Azure Government - US or Azure China 21Vianet regions, specify the region into which you want to authenticate. You can specify the region with DefaultAzureCredential. The following example authenticates to the Azure Government - US region:

   from azure.identity import AzureAuthorityHosts
   DefaultAzureCredential(authority=AzureAuthorityHosts.AZURE_GOVERNMENT)
   

6. Verify the connection.

   for hub in ml_client.workspaces.list():
       print(f"  - {hub.name}")
   

If you receive an authentication error, ensure your Azure credentials are configured (run az login or set up your credentials via the Azure Identity SDK). If you receive a permission error, check that you have the Contributor role on the subscription or resource group.

References: MLClient, DefaultAzureCredential

1. If you don't have the Azure CLI and machine learning extension installed, follow the steps in the Install and set up the machine learning extension article.

2. To authenticate to your Azure subscription from the Azure CLI, use the following command:

   az login
   

   For more information on authenticating, see Authentication methods.

3. Verify your authentication by listing existing hubs:

   az ml workspace list --resource-group <your-resource-group-name>
   

   If the command succeeds and displays any existing hubs, your authentication is configured correctly.

from azure.ai.ml.entities import Hub

my_hub_name = "myexamplehub"
my_location = "East US"
my_display_name = "My Example Hub"

# Construct a basic hub
my_hub = Hub(
    name=my_hub_name,
    location=my_location,
    display_name=my_display_name
)

# Create the hub and wait for completion
created_hub = ml_client.workspaces.begin_create(my_hub).result()
print(f"Created hub: {created_hub.name}")

This code creates a new hub with the specified name, location, and display name. Azure automatically provisions associated Azure Storage and Azure Key Vault resources.

References: Hub, MLClient.workspaces.begin_create

az ml workspace create --kind hub --resource-group <your-resource-group> --name <your-hub-name>

Replace <your-resource-group> with your Azure resource group name and <your-hub-name> with a unique name for your hub. Azure automatically creates associated storage and key vault resources.

References: az ml workspace create

1. Include your hub in your ml_client connection:

   • Enter your subscription details. For <AML_WORKSPACE_NAME>, enter your hub name:

     # Enter details of your AML workspace
     subscription_id = "<SUBSCRIPTION_ID>"
     resource_group = "<RESOURCE_GROUP>"
     workspace = "<AML_WORKSPACE_NAME>"

   • Get a handle to the hub:

     # get a handle to the workspace
     from azure.ai.ml import MLClient
     from azure.identity import DefaultAzureCredential
     
     ml_client = MLClient(
         DefaultAzureCredential(), subscription_id, resource_group, workspace
     )

2. Use ml_client to create the connection to your Foundry Tools. You can find endpoints in Azure portal under Resource management > Keys and endpoints. For a Foundry resource, use the AI Services endpoint. For Azure AI Search, use the URL for the endpoint.

   from azure.ai.ml.entities import AzureAIServicesConnection
   
   # Construct a connection to Azure AI Services
   my_connection_name = "my-ai-services-connection"  # Any name you want
   aiservices_resource_name = "<your-resource-name>"  # From Azure portal
   my_endpoint = "<your-endpoint>"  # From Azure portal
   my_api_keys = None  # Leave blank to use Azure Entra ID (AAD) authentication
   my_ai_services_resource_id = f"/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.CognitiveServices/accounts/{aiservices_resource_name}"
   
   my_connection = AzureAIServicesConnection(
       name=my_connection_name,
       endpoint=my_endpoint,
       api_key=my_api_keys,
       ai_services_resource_id=my_ai_services_resource_id
   )
   
   # Create the connection
   ml_client.connections.create_or_update(my_connection)
   print(f"Created connection: {my_connection.name}")
   

   References: AzureAIServicesConnection, MLClient.connections

az ml connection create --file connection.yml --resource-group <your-resource-group> --workspace-name <your-hub-name>

You can use either an API key or Azure Entra ID (AAD) authentication. Create a YAML configuration file named connection.yml:

API key example:

name: my-ai-services-connection
type: azure_ai_services
endpoint: <your-endpoint>
api_key: <your-api-key>
ai_services_resource_id: /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<resource-name>

AAD (credential-less) example:

name: my-ai-services-connection
type: azure_ai_services
endpoint: <your-endpoint>
ai_services_resource_id: /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<resource-name>

For detailed schema information, see the Azure AI Services connection YAML schema.

References: az ml connection create

from azure.ai.ml.entities import Hub

my_hub_name = "myexamplehub"
my_location = "East US"
my_display_name = "My Example Hub"
my_resource_group = "myresourcegroupname"
my_storage_account_id = "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>"
my_key_vault_id = "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.KeyVault/vaults/<key-vault-name>"

# Construct a hub with existing dependency resources
my_hub = Hub(
    name=my_hub_name,
    location=my_location,
    display_name=my_display_name,
    resource_group=my_resource_group,
    storage_account_id=my_storage_account_id,
    key_vault_id=my_key_vault_id
)

# Create the hub
created_hub = ml_client.workspaces.begin_create(my_hub).result()
print(f"Created hub with existing resources: {created_hub.name}")

To find resource IDs for existing resources, visit the Azure portal, navigate to the resource's Overview page, and select JSON view. The resource ID appears in the id field. Alternatively, use Azure CLI:

# Get Storage account resource ID
az storage account show --name <storage-account-name> --resource-group <resource-group> --query "id"

# Get Key Vault resource ID
az keyvault show --name <key-vault-name> --resource-group <resource-group> --query "id"

References: Hub

az ml workspace create --kind hub --resource-group <your-resource-group> --name <your-hub-name> --location <location> --storage-account <storage-account-resource-id> --key-vault <key-vault-resource-id>

Replace the angle-bracket placeholders with your own values. To find resource IDs, use:

# Get Storage account resource ID
az storage account show --name <storage-account-name> --resource-group <resource-group> --query "id"

# Get Key Vault resource ID
az keyvault show --name <key-vault-name> --resource-group <resource-group> --query "id"

References: az ml workspace create

from azure.ai.ml.entities import Hub

my_app_insights = "{APPLICATION_INSIGHTS_ARM_ID}"
my_container_registry = "{CONTAINER_REGISTRY_ARM_ID}"

# construct a hub with Application Insights and Container Registry
my_hub = Hub(name="myexamplehub", 
             location="East US", 
             application_insights=my_app_insights,
             container_registry=my_container_registry)

# update_dependent_resources is used to give consent to update the workspace dependent resources.
updated_hub = ml_client.workspaces.begin_update(workspace=my_hub, update_dependent_resources=True).result()
print(f"Hub updated: {updated_hub.name}")

This script updates an existing hub with the specified Application Insights and Container Registry resources. The update_dependent_resources=True parameter confirms the update.

Reference: Hub, MLClient.workspaces.begin_update()

az ml workspace update -n "myexamplehub" -g "{MY_RESOURCE_GROUP}" -a "APPLICATION_INSIGHTS_ARM_ID" -u

This command updates the hub named "myexamplehub" with the specified Application Insights resource. The -u flag grants consent to update dependent resources.

Reference: az ml workspace update