Error training model in ML Studio

Question

Hello,

I get the following error while running an "Automated ML" job in ML Studio.

Failed to download snapshot from storage using SAS url. Error message: This request is not authorized to perform this operation.

Authentication error when downloading from storage. Tip: Please check the storage account attached to the workspace. Make sure the request is not blocked by by a firewall, virtual network, or other security settings.

The job is trying to interact with a storage account that, for security reasons, is configured NOT to let access from all networks. The storage is in the same resource group and accepts connections from:

public IP address range for our Company network
the resource group's virtual network
the Machine Learning workspace instance (as Microsoft.MachineLearningServices/workspaces) based on their system-assigned managed identity as stated by the Azure portal

Looking at logs for the storage, the failed requests are coming from address 10.0.0.4.

Given that the storage firewall should remain, is there a way to configure it so that it can let requests from ML pass through ? Should we add subnet 10.0.0.x to it ? Is that a fixed subnet or might it change ?

Thank you

Answer

Hi Repetti Pierangelo

Welcome to Microsoft Q&A Forum, thank you for posting your query here!

1.This 10.0.0.4 looks like a private IP and might be one of your Azure resources. You can identify the resource using the command

dig -x

to get the designated FQDN and the underlying Azure resource. Once the resource type is identified from the FQDN, you can allow it as a trusted resource, similar to how you did for your Azure Machine Learning instance.

2.You can also modify the inbound rules of your virtual network to allow connections from the specified subnet range with the target being the resource subnet. However, it might be simpler to include the subnet range in the storage firewall if the existing declared virtual network range does not already encompass it.

kindly refer the below documentation: https://zcusa.951200.xyz/en-us/azure/machine-learning/how-to-access-azureml-behind-firewall?view=azureml-api-2&tabs=ipaddress%2Cpublic

https://zcusa.951200.xyz/en-us/azure/machine-learning/how-to-secure-workspace-vnet?view=azureml-api-2&tabs=required%2Cpe%2Ccli#secure-azure-storage-accounts

Hope this helps. Do let us know if you any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Thank you.

Source	Source ports	Destination	Destinationports	Purpose
AzureMachineLearning	Any	VirtualNetwork	44224	Inbound to compute instance/cluster. Only needed if the
instance/cluster is configured to use a public IP address.
AzureMachineLearning	Any	VirtualNetwork	44224	Inbound to compute instance/cluster. Only needed if the instance/cluster is configured to use a public IP address.

Service tag(s)	Ports	Purpose
AzureActiveDirectory	80, 443	Authentication using Microsoft Entra ID.
AzureActiveDirectory	80, 443	Authentication using Microsoft Entra ID.
AzureMachineLearning	443, 8787, 18881 UDP: 5831	Using Azure Machine Learning services.
BatchNodeManagement.<region>	443	Communication Azure Batch.
AzureResourceManager	443	Creation of Azure resources with Azure Machine Learning.
Storage.<region>	443	Access data stored in the Azure Storage Account for compute cluster and compute instance. This outbound can be used to exfiltrate data. For more information, see Data exfiltration protection.
AzureFrontDoor.FrontEnd * Not needed in Microsoft Azure operated by 21Vianet.	443	Global entry point for Azure Machine Learning studio. Store images and environments for AutoML.
MicrosoftContainerRegistry	443	Access docker images provided by Microsoft.
Frontdoor.FirstParty	443	Access docker images provided by Microsoft.
AzureMonitor	443	Used to log monitoring and metrics to Azure Monitor. Only needed if you haven't secured Azure Monitor for the workspace. * This outbound is also used to log information for support incidents.
VirtualNetwork	443	Required when private endpoints are present in the virtual network or peered virtual networks.

Share via

Error training model in ML Studio

1 answer

Your answer