Docs Home Pulumi IaC Pulumi ESC Pulumi Cloud Packages Tutorials
  1. Packages
  2. Azure Classic
  3. API Docs
  4. machinelearning
  5. Workspace

We recommend using Azure Native.

Azure v6.21.0 published on Friday, Mar 7, 2025 by Pulumi
pulumi/pulumi-azure

azure.machinelearning.Workspace

Explore with Pulumi AI

azure logo

We recommend using Azure Native.

Azure v6.21.0 published on Friday, Mar 7, 2025 by Pulumi
pulumi/pulumi-azure

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const current = azure.core.getClientConfig({});
const example = new azure.core.ResourceGroup("example", {
    name: "example-resources",
    location: "West Europe",
});
const exampleInsights = new azure.appinsights.Insights("example", {
    name: "workspace-example-ai",
    location: example.location,
    resourceGroupName: example.name,
    applicationType: "web",
});
const exampleKeyVault = new azure.keyvault.KeyVault("example", {
    name: "workspaceexamplekeyvault",
    location: example.location,
    resourceGroupName: example.name,
    tenantId: current.then(current => current.tenantId),
    skuName: "premium",
});
const exampleAccount = new azure.storage.Account("example", {
    name: "workspacestorageaccount",
    location: example.location,
    resourceGroupName: example.name,
    accountTier: "Standard",
    accountReplicationType: "GRS",
});
const exampleWorkspace = new azure.machinelearning.Workspace("example", {
    name: "example-workspace",
    location: example.location,
    resourceGroupName: example.name,
    applicationInsightsId: exampleInsights.id,
    keyVaultId: exampleKeyVault.id,
    storageAccountId: exampleAccount.id,
    identity: {
        type: "SystemAssigned",
    },
});

    import pulumi
import pulumi_azure as azure

current = azure.core.get_client_config()
example = azure.core.ResourceGroup("example",
    name="example-resources",
    location="West Europe")
example_insights = azure.appinsights.Insights("example",
    name="workspace-example-ai",
    location=example.location,
    resource_group_name=example.name,
    application_type="web")
example_key_vault = azure.keyvault.KeyVault("example",
    name="workspaceexamplekeyvault",
    location=example.location,
    resource_group_name=example.name,
    tenant_id=current.tenant_id,
    sku_name="premium")
example_account = azure.storage.Account("example",
    name="workspacestorageaccount",
    location=example.location,
    resource_group_name=example.name,
    account_tier="Standard",
    account_replication_type="GRS")
example_workspace = azure.machinelearning.Workspace("example",
    name="example-workspace",
    location=example.location,
    resource_group_name=example.name,
    application_insights_id=example_insights.id,
    key_vault_id=example_key_vault.id,
    storage_account_id=example_account.id,
    identity={
        "type": "SystemAssigned",
    })

    package main

import (
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/appinsights"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/keyvault"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/machinelearning"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/storage"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := core.GetClientConfig(ctx, map[string]interface{}{}, nil)
		if err != nil {
			return err
		}
		example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
			Name:     pulumi.String("example-resources"),
			Location: pulumi.String("West Europe"),
		})
		if err != nil {
			return err
		}
		exampleInsights, err := appinsights.NewInsights(ctx, "example", &appinsights.InsightsArgs{
			Name:              pulumi.String("workspace-example-ai"),
			Location:          example.Location,
			ResourceGroupName: example.Name,
			ApplicationType:   pulumi.String("web"),
		})
		if err != nil {
			return err
		}
		exampleKeyVault, err := keyvault.NewKeyVault(ctx, "example", &keyvault.KeyVaultArgs{
			Name:              pulumi.String("workspaceexamplekeyvault"),
			Location:          example.Location,
			ResourceGroupName: example.Name,
			TenantId:          pulumi.String(current.TenantId),
			SkuName:           pulumi.String("premium"),
		})
		if err != nil {
			return err
		}
		exampleAccount, err := storage.NewAccount(ctx, "example", &storage.AccountArgs{
			Name:                   pulumi.String("workspacestorageaccount"),
			Location:               example.Location,
			ResourceGroupName:      example.Name,
			AccountTier:            pulumi.String("Standard"),
			AccountReplicationType: pulumi.String("GRS"),
		})
		if err != nil {
			return err
		}
		_, err = machinelearning.NewWorkspace(ctx, "example", &machinelearning.WorkspaceArgs{
			Name:                  pulumi.String("example-workspace"),
			Location:              example.Location,
			ResourceGroupName:     example.Name,
			ApplicationInsightsId: exampleInsights.ID(),
			KeyVaultId:            exampleKeyVault.ID(),
			StorageAccountId:      exampleAccount.ID(),
			Identity: &machinelearning.WorkspaceIdentityArgs{
				Type: pulumi.String("SystemAssigned"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;

return await Deployment.RunAsync(() => 
{
    var current = Azure.Core.GetClientConfig.Invoke();

    var example = new Azure.Core.ResourceGroup("example", new()
    {
        Name = "example-resources",
        Location = "West Europe",
    });

    var exampleInsights = new Azure.AppInsights.Insights("example", new()
    {
        Name = "workspace-example-ai",
        Location = example.Location,
        ResourceGroupName = example.Name,
        ApplicationType = "web",
    });

    var exampleKeyVault = new Azure.KeyVault.KeyVault("example", new()
    {
        Name = "workspaceexamplekeyvault",
        Location = example.Location,
        ResourceGroupName = example.Name,
        TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
        SkuName = "premium",
    });

    var exampleAccount = new Azure.Storage.Account("example", new()
    {
        Name = "workspacestorageaccount",
        Location = example.Location,
        ResourceGroupName = example.Name,
        AccountTier = "Standard",
        AccountReplicationType = "GRS",
    });

    var exampleWorkspace = new Azure.MachineLearning.Workspace("example", new()
    {
        Name = "example-workspace",
        Location = example.Location,
        ResourceGroupName = example.Name,
        ApplicationInsightsId = exampleInsights.Id,
        KeyVaultId = exampleKeyVault.Id,
        StorageAccountId = exampleAccount.Id,
        Identity = new Azure.MachineLearning.Inputs.WorkspaceIdentityArgs
        {
            Type = "SystemAssigned",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.appinsights.Insights;
import com.pulumi.azure.appinsights.InsightsArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.storage.Account;
import com.pulumi.azure.storage.AccountArgs;
import com.pulumi.azure.machinelearning.Workspace;
import com.pulumi.azure.machinelearning.WorkspaceArgs;
import com.pulumi.azure.machinelearning.inputs.WorkspaceIdentityArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = CoreFunctions.getClientConfig();

        var example = new ResourceGroup("example", ResourceGroupArgs.builder()
            .name("example-resources")
            .location("West Europe")
            .build());

        var exampleInsights = new Insights("exampleInsights", InsightsArgs.builder()
            .name("workspace-example-ai")
            .location(example.location())
            .resourceGroupName(example.name())
            .applicationType("web")
            .build());

        var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
            .name("workspaceexamplekeyvault")
            .location(example.location())
            .resourceGroupName(example.name())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .skuName("premium")
            .build());

        var exampleAccount = new Account("exampleAccount", AccountArgs.builder()
            .name("workspacestorageaccount")
            .location(example.location())
            .resourceGroupName(example.name())
            .accountTier("Standard")
            .accountReplicationType("GRS")
            .build());

        var exampleWorkspace = new Workspace("exampleWorkspace", WorkspaceArgs.builder()
            .name("example-workspace")
            .location(example.location())
            .resourceGroupName(example.name())
            .applicationInsightsId(exampleInsights.id())
            .keyVaultId(exampleKeyVault.id())
            .storageAccountId(exampleAccount.id())
            .identity(WorkspaceIdentityArgs.builder()
                .type("SystemAssigned")
                .build())
            .build());

    }
}

    resources:
  example:
    type: azure:core:ResourceGroup
    properties:
      name: example-resources
      location: West Europe
  exampleInsights:
    type: azure:appinsights:Insights
    name: example
    properties:
      name: workspace-example-ai
      location: ${example.location}
      resourceGroupName: ${example.name}
      applicationType: web
  exampleKeyVault:
    type: azure:keyvault:KeyVault
    name: example
    properties:
      name: workspaceexamplekeyvault
      location: ${example.location}
      resourceGroupName: ${example.name}
      tenantId: ${current.tenantId}
      skuName: premium
  exampleAccount:
    type: azure:storage:Account
    name: example
    properties:
      name: workspacestorageaccount
      location: ${example.location}
      resourceGroupName: ${example.name}
      accountTier: Standard
      accountReplicationType: GRS
  exampleWorkspace:
    type: azure:machinelearning:Workspace
    name: example
    properties:
      name: example-workspace
      location: ${example.location}
      resourceGroupName: ${example.name}
      applicationInsightsId: ${exampleInsights.id}
      keyVaultId: ${exampleKeyVault.id}
      storageAccountId: ${exampleAccount.id}
      identity:
        type: SystemAssigned
variables:
  current:
    fn::invoke:
      function: azure:core:getClientConfig
      arguments: {}

    With Data Encryption

    NOTE: The Key Vault must enable purge protection.

    import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const current = azure.core.getClientConfig({});
const example = new azure.core.ResourceGroup("example", {
    name: "example-resources",
    location: "West Europe",
});
const exampleInsights = new azure.appinsights.Insights("example", {
    name: "workspace-example-ai",
    location: example.location,
    resourceGroupName: example.name,
    applicationType: "web",
});
const exampleKeyVault = new azure.keyvault.KeyVault("example", {
    name: "workspaceexamplekeyvault",
    location: example.location,
    resourceGroupName: example.name,
    tenantId: current.then(current => current.tenantId),
    skuName: "premium",
    purgeProtectionEnabled: true,
});
const exampleAccessPolicy = new azure.keyvault.AccessPolicy("example", {
    keyVaultId: exampleKeyVault.id,
    tenantId: current.then(current => current.tenantId),
    objectId: current.then(current => current.objectId),
    keyPermissions: [
        "Create",
        "Get",
        "Delete",
        "Purge",
        "GetRotationPolicy",
    ],
});
const exampleAccount = new azure.storage.Account("example", {
    name: "workspacestorageaccount",
    location: example.location,
    resourceGroupName: example.name,
    accountTier: "Standard",
    accountReplicationType: "GRS",
});
const exampleKey = new azure.keyvault.Key("example", {
    name: "workspaceexamplekeyvaultkey",
    keyVaultId: exampleKeyVault.id,
    keyType: "RSA",
    keySize: 2048,
    keyOpts: [
        "decrypt",
        "encrypt",
        "sign",
        "unwrapKey",
        "verify",
        "wrapKey",
    ],
}, {
    dependsOn: [
        exampleKeyVault,
        exampleAccessPolicy,
    ],
});
const exampleWorkspace = new azure.machinelearning.Workspace("example", {
    name: "example-workspace",
    location: example.location,
    resourceGroupName: example.name,
    applicationInsightsId: exampleInsights.id,
    keyVaultId: exampleKeyVault.id,
    storageAccountId: exampleAccount.id,
    identity: {
        type: "SystemAssigned",
    },
    encryption: {
        keyVaultId: exampleKeyVault.id,
        keyId: exampleKey.id,
    },
});

    import pulumi
import pulumi_azure as azure

current = azure.core.get_client_config()
example = azure.core.ResourceGroup("example",
    name="example-resources",
    location="West Europe")
example_insights = azure.appinsights.Insights("example",
    name="workspace-example-ai",
    location=example.location,
    resource_group_name=example.name,
    application_type="web")
example_key_vault = azure.keyvault.KeyVault("example",
    name="workspaceexamplekeyvault",
    location=example.location,
    resource_group_name=example.name,
    tenant_id=current.tenant_id,
    sku_name="premium",
    purge_protection_enabled=True)
example_access_policy = azure.keyvault.AccessPolicy("example",
    key_vault_id=example_key_vault.id,
    tenant_id=current.tenant_id,
    object_id=current.object_id,
    key_permissions=[
        "Create",
        "Get",
        "Delete",
        "Purge",
        "GetRotationPolicy",
    ])
example_account = azure.storage.Account("example",
    name="workspacestorageaccount",
    location=example.location,
    resource_group_name=example.name,
    account_tier="Standard",
    account_replication_type="GRS")
example_key = azure.keyvault.Key("example",
    name="workspaceexamplekeyvaultkey",
    key_vault_id=example_key_vault.id,
    key_type="RSA",
    key_size=2048,
    key_opts=[
        "decrypt",
        "encrypt",
        "sign",
        "unwrapKey",
        "verify",
        "wrapKey",
    ],
    opts = pulumi.ResourceOptions(depends_on=[
            example_key_vault,
            example_access_policy,
        ]))
example_workspace = azure.machinelearning.Workspace("example",
    name="example-workspace",
    location=example.location,
    resource_group_name=example.name,
    application_insights_id=example_insights.id,
    key_vault_id=example_key_vault.id,
    storage_account_id=example_account.id,
    identity={
        "type": "SystemAssigned",
    },
    encryption={
        "key_vault_id": example_key_vault.id,
        "key_id": example_key.id,
    })

    package main

import (
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/appinsights"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/keyvault"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/machinelearning"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/storage"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := core.GetClientConfig(ctx, map[string]interface{}{}, nil)
		if err != nil {
			return err
		}
		example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
			Name:     pulumi.String("example-resources"),
			Location: pulumi.String("West Europe"),
		})
		if err != nil {
			return err
		}
		exampleInsights, err := appinsights.NewInsights(ctx, "example", &appinsights.InsightsArgs{
			Name:              pulumi.String("workspace-example-ai"),
			Location:          example.Location,
			ResourceGroupName: example.Name,
			ApplicationType:   pulumi.String("web"),
		})
		if err != nil {
			return err
		}
		exampleKeyVault, err := keyvault.NewKeyVault(ctx, "example", &keyvault.KeyVaultArgs{
			Name:                   pulumi.String("workspaceexamplekeyvault"),
			Location:               example.Location,
			ResourceGroupName:      example.Name,
			TenantId:               pulumi.String(current.TenantId),
			SkuName:                pulumi.String("premium"),
			PurgeProtectionEnabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		exampleAccessPolicy, err := keyvault.NewAccessPolicy(ctx, "example", &keyvault.AccessPolicyArgs{
			KeyVaultId: exampleKeyVault.ID(),
			TenantId:   pulumi.String(current.TenantId),
			ObjectId:   pulumi.String(current.ObjectId),
			KeyPermissions: pulumi.StringArray{
				pulumi.String("Create"),
				pulumi.String("Get"),
				pulumi.String("Delete"),
				pulumi.String("Purge"),
				pulumi.String("GetRotationPolicy"),
			},
		})
		if err != nil {
			return err
		}
		exampleAccount, err := storage.NewAccount(ctx, "example", &storage.AccountArgs{
			Name:                   pulumi.String("workspacestorageaccount"),
			Location:               example.Location,
			ResourceGroupName:      example.Name,
			AccountTier:            pulumi.String("Standard"),
			AccountReplicationType: pulumi.String("GRS"),
		})
		if err != nil {
			return err
		}
		exampleKey, err := keyvault.NewKey(ctx, "example", &keyvault.KeyArgs{
			Name:       pulumi.String("workspaceexamplekeyvaultkey"),
			KeyVaultId: exampleKeyVault.ID(),
			KeyType:    pulumi.String("RSA"),
			KeySize:    pulumi.Int(2048),
			KeyOpts: pulumi.StringArray{
				pulumi.String("decrypt"),
				pulumi.String("encrypt"),
				pulumi.String("sign"),
				pulumi.String("unwrapKey"),
				pulumi.String("verify"),
				pulumi.String("wrapKey"),
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			exampleKeyVault,
			exampleAccessPolicy,
		}))
		if err != nil {
			return err
		}
		_, err = machinelearning.NewWorkspace(ctx, "example", &machinelearning.WorkspaceArgs{
			Name:                  pulumi.String("example-workspace"),
			Location:              example.Location,
			ResourceGroupName:     example.Name,
			ApplicationInsightsId: exampleInsights.ID(),
			KeyVaultId:            exampleKeyVault.ID(),
			StorageAccountId:      exampleAccount.ID(),
			Identity: &machinelearning.WorkspaceIdentityArgs{
				Type: pulumi.String("SystemAssigned"),
			},
			Encryption: &machinelearning.WorkspaceEncryptionArgs{
				KeyVaultId: exampleKeyVault.ID(),
				KeyId:      exampleKey.ID(),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;

return await Deployment.RunAsync(() => 
{
    var current = Azure.Core.GetClientConfig.Invoke();

    var example = new Azure.Core.ResourceGroup("example", new()
    {
        Name = "example-resources",
        Location = "West Europe",
    });

    var exampleInsights = new Azure.AppInsights.Insights("example", new()
    {
        Name = "workspace-example-ai",
        Location = example.Location,
        ResourceGroupName = example.Name,
        ApplicationType = "web",
    });

    var exampleKeyVault = new Azure.KeyVault.KeyVault("example", new()
    {
        Name = "workspaceexamplekeyvault",
        Location = example.Location,
        ResourceGroupName = example.Name,
        TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
        SkuName = "premium",
        PurgeProtectionEnabled = true,
    });

    var exampleAccessPolicy = new Azure.KeyVault.AccessPolicy("example", new()
    {
        KeyVaultId = exampleKeyVault.Id,
        TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
        ObjectId = current.Apply(getClientConfigResult => getClientConfigResult.ObjectId),
        KeyPermissions = new[]
        {
            "Create",
            "Get",
            "Delete",
            "Purge",
            "GetRotationPolicy",
        },
    });

    var exampleAccount = new Azure.Storage.Account("example", new()
    {
        Name = "workspacestorageaccount",
        Location = example.Location,
        ResourceGroupName = example.Name,
        AccountTier = "Standard",
        AccountReplicationType = "GRS",
    });

    var exampleKey = new Azure.KeyVault.Key("example", new()
    {
        Name = "workspaceexamplekeyvaultkey",
        KeyVaultId = exampleKeyVault.Id,
        KeyType = "RSA",
        KeySize = 2048,
        KeyOpts = new[]
        {
            "decrypt",
            "encrypt",
            "sign",
            "unwrapKey",
            "verify",
            "wrapKey",
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            exampleKeyVault,
            exampleAccessPolicy,
        },
    });

    var exampleWorkspace = new Azure.MachineLearning.Workspace("example", new()
    {
        Name = "example-workspace",
        Location = example.Location,
        ResourceGroupName = example.Name,
        ApplicationInsightsId = exampleInsights.Id,
        KeyVaultId = exampleKeyVault.Id,
        StorageAccountId = exampleAccount.Id,
        Identity = new Azure.MachineLearning.Inputs.WorkspaceIdentityArgs
        {
            Type = "SystemAssigned",
        },
        Encryption = new Azure.MachineLearning.Inputs.WorkspaceEncryptionArgs
        {
            KeyVaultId = exampleKeyVault.Id,
            KeyId = exampleKey.Id,
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.appinsights.Insights;
import com.pulumi.azure.appinsights.InsightsArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.AccessPolicy;
import com.pulumi.azure.keyvault.AccessPolicyArgs;
import com.pulumi.azure.storage.Account;
import com.pulumi.azure.storage.AccountArgs;
import com.pulumi.azure.keyvault.Key;
import com.pulumi.azure.keyvault.KeyArgs;
import com.pulumi.azure.machinelearning.Workspace;
import com.pulumi.azure.machinelearning.WorkspaceArgs;
import com.pulumi.azure.machinelearning.inputs.WorkspaceIdentityArgs;
import com.pulumi.azure.machinelearning.inputs.WorkspaceEncryptionArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = CoreFunctions.getClientConfig();

        var example = new ResourceGroup("example", ResourceGroupArgs.builder()
            .name("example-resources")
            .location("West Europe")
            .build());

        var exampleInsights = new Insights("exampleInsights", InsightsArgs.builder()
            .name("workspace-example-ai")
            .location(example.location())
            .resourceGroupName(example.name())
            .applicationType("web")
            .build());

        var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
            .name("workspaceexamplekeyvault")
            .location(example.location())
            .resourceGroupName(example.name())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .skuName("premium")
            .purgeProtectionEnabled(true)
            .build());

        var exampleAccessPolicy = new AccessPolicy("exampleAccessPolicy", AccessPolicyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .objectId(current.applyValue(getClientConfigResult -> getClientConfigResult.objectId()))
            .keyPermissions(            
                "Create",
                "Get",
                "Delete",
                "Purge",
                "GetRotationPolicy")
            .build());

        var exampleAccount = new Account("exampleAccount", AccountArgs.builder()
            .name("workspacestorageaccount")
            .location(example.location())
            .resourceGroupName(example.name())
            .accountTier("Standard")
            .accountReplicationType("GRS")
            .build());

        var exampleKey = new Key("exampleKey", KeyArgs.builder()
            .name("workspaceexamplekeyvaultkey")
            .keyVaultId(exampleKeyVault.id())
            .keyType("RSA")
            .keySize(2048)
            .keyOpts(            
                "decrypt",
                "encrypt",
                "sign",
                "unwrapKey",
                "verify",
                "wrapKey")
            .build(), CustomResourceOptions.builder()
                .dependsOn(                
                    exampleKeyVault,
                    exampleAccessPolicy)
                .build());

        var exampleWorkspace = new Workspace("exampleWorkspace", WorkspaceArgs.builder()
            .name("example-workspace")
            .location(example.location())
            .resourceGroupName(example.name())
            .applicationInsightsId(exampleInsights.id())
            .keyVaultId(exampleKeyVault.id())
            .storageAccountId(exampleAccount.id())
            .identity(WorkspaceIdentityArgs.builder()
                .type("SystemAssigned")
                .build())
            .encryption(WorkspaceEncryptionArgs.builder()
                .keyVaultId(exampleKeyVault.id())
                .keyId(exampleKey.id())
                .build())
            .build());

    }
}

    resources:
  example:
    type: azure:core:ResourceGroup
    properties:
      name: example-resources
      location: West Europe
  exampleInsights:
    type: azure:appinsights:Insights
    name: example
    properties:
      name: workspace-example-ai
      location: ${example.location}
      resourceGroupName: ${example.name}
      applicationType: web
  exampleKeyVault:
    type: azure:keyvault:KeyVault
    name: example
    properties:
      name: workspaceexamplekeyvault
      location: ${example.location}
      resourceGroupName: ${example.name}
      tenantId: ${current.tenantId}
      skuName: premium
      purgeProtectionEnabled: true
  exampleAccessPolicy:
    type: azure:keyvault:AccessPolicy
    name: example
    properties:
      keyVaultId: ${exampleKeyVault.id}
      tenantId: ${current.tenantId}
      objectId: ${current.objectId}
      keyPermissions:
        - Create
        - Get
        - Delete
        - Purge
        - GetRotationPolicy
  exampleAccount:
    type: azure:storage:Account
    name: example
    properties:
      name: workspacestorageaccount
      location: ${example.location}
      resourceGroupName: ${example.name}
      accountTier: Standard
      accountReplicationType: GRS
  exampleKey:
    type: azure:keyvault:Key
    name: example
    properties:
      name: workspaceexamplekeyvaultkey
      keyVaultId: ${exampleKeyVault.id}
      keyType: RSA
      keySize: 2048
      keyOpts:
        - decrypt
        - encrypt
        - sign
        - unwrapKey
        - verify
        - wrapKey
    options:
      dependsOn:
        - ${exampleKeyVault}
        - ${exampleAccessPolicy}
  exampleWorkspace:
    type: azure:machinelearning:Workspace
    name: example
    properties:
      name: example-workspace
      location: ${example.location}
      resourceGroupName: ${example.name}
      applicationInsightsId: ${exampleInsights.id}
      keyVaultId: ${exampleKeyVault.id}
      storageAccountId: ${exampleAccount.id}
      identity:
        type: SystemAssigned
      encryption:
        keyVaultId: ${exampleKeyVault.id}
        keyId: ${exampleKey.id}
variables:
  current:
    fn::invoke:
      function: azure:core:getClientConfig
      arguments: {}

    With User Assigned Identity And Data Encryption

    NOTE: The Key Vault must enable purge protection.

    import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
import * as azuread from "@pulumi/azuread";

const current = azure.core.getClientConfig({});
const example = new azure.core.ResourceGroup("example", {
    name: "example-resources",
    location: "West Europe",
});
const exampleInsights = new azure.appinsights.Insights("example", {
    name: "example-ai",
    location: example.location,
    resourceGroupName: example.name,
    applicationType: "web",
});
const exampleAccount = new azure.storage.Account("example", {
    name: "examplestorageaccount",
    location: example.location,
    resourceGroupName: example.name,
    accountTier: "Standard",
    accountReplicationType: "GRS",
});
const exampleKeyVault = new azure.keyvault.KeyVault("example", {
    name: "example-keyvalut",
    location: example.location,
    resourceGroupName: example.name,
    tenantId: current.then(current => current.tenantId),
    skuName: "premium",
    purgeProtectionEnabled: true,
});
const exampleUserAssignedIdentity = new azure.authorization.UserAssignedIdentity("example", {
    name: "example-identity",
    location: example.location,
    resourceGroupName: example.name,
});
const example_identity = new azure.keyvault.AccessPolicy("example-identity", {
    keyVaultId: exampleKeyVault.id,
    tenantId: current.then(current => current.tenantId),
    objectId: exampleUserAssignedIdentity.principalId,
    keyPermissions: [
        "WrapKey",
        "UnwrapKey",
        "Get",
        "Recover",
    ],
    secretPermissions: [
        "Get",
        "List",
        "Set",
        "Delete",
        "Recover",
        "Backup",
        "Restore",
    ],
});
const example_sp = new azure.keyvault.AccessPolicy("example-sp", {
    keyVaultId: exampleKeyVault.id,
    tenantId: current.then(current => current.tenantId),
    objectId: current.then(current => current.objectId),
    keyPermissions: [
        "Get",
        "Create",
        "Recover",
        "Delete",
        "Purge",
        "GetRotationPolicy",
    ],
});
const test = azuread.getServicePrincipal({
    displayName: "Azure Cosmos DB",
});
const example_cosmosdb = new azure.keyvault.AccessPolicy("example-cosmosdb", {
    keyVaultId: exampleKeyVault.id,
    tenantId: current.then(current => current.tenantId),
    objectId: test.then(test => test.objectId),
    keyPermissions: [
        "Get",
        "Recover",
        "UnwrapKey",
        "WrapKey",
    ],
}, {
    dependsOn: [
        test,
        current,
    ],
});
const exampleKey = new azure.keyvault.Key("example", {
    name: "example-keyvaultkey",
    keyVaultId: exampleKeyVault.id,
    keyType: "RSA",
    keySize: 2048,
    keyOpts: [
        "decrypt",
        "encrypt",
        "sign",
        "unwrapKey",
        "verify",
        "wrapKey",
    ],
}, {
    dependsOn: [
        exampleKeyVault,
        example_sp,
    ],
});
const example_role1 = new azure.authorization.Assignment("example-role1", {
    scope: exampleKeyVault.id,
    roleDefinitionName: "Contributor",
    principalId: exampleUserAssignedIdentity.principalId,
});
const example_role2 = new azure.authorization.Assignment("example-role2", {
    scope: exampleAccount.id,
    roleDefinitionName: "Storage Blob Data Contributor",
    principalId: exampleUserAssignedIdentity.principalId,
});
const example_role3 = new azure.authorization.Assignment("example-role3", {
    scope: exampleAccount.id,
    roleDefinitionName: "Contributor",
    principalId: exampleUserAssignedIdentity.principalId,
});
const example_role4 = new azure.authorization.Assignment("example-role4", {
    scope: exampleInsights.id,
    roleDefinitionName: "Contributor",
    principalId: exampleUserAssignedIdentity.principalId,
});
const exampleWorkspace = new azure.machinelearning.Workspace("example", {
    name: "example-workspace",
    location: example.location,
    resourceGroupName: example.name,
    applicationInsightsId: exampleInsights.id,
    keyVaultId: exampleKeyVault.id,
    storageAccountId: exampleAccount.id,
    highBusinessImpact: true,
    primaryUserAssignedIdentity: exampleUserAssignedIdentity.id,
    identity: {
        type: "UserAssigned",
        identityIds: [exampleUserAssignedIdentity.id],
    },
    encryption: {
        userAssignedIdentityId: exampleUserAssignedIdentity.id,
        keyVaultId: exampleKeyVault.id,
        keyId: exampleKey.id,
    },
}, {
    dependsOn: [
        example_role1,
        example_role2,
        example_role3,
        example_role4,
        example_cosmosdb,
    ],
});

    import pulumi
import pulumi_azure as azure
import pulumi_azuread as azuread

current = azure.core.get_client_config()
example = azure.core.ResourceGroup("example",
    name="example-resources",
    location="West Europe")
example_insights = azure.appinsights.Insights("example",
    name="example-ai",
    location=example.location,
    resource_group_name=example.name,
    application_type="web")
example_account = azure.storage.Account("example",
    name="examplestorageaccount",
    location=example.location,
    resource_group_name=example.name,
    account_tier="Standard",
    account_replication_type="GRS")
example_key_vault = azure.keyvault.KeyVault("example",
    name="example-keyvalut",
    location=example.location,
    resource_group_name=example.name,
    tenant_id=current.tenant_id,
    sku_name="premium",
    purge_protection_enabled=True)
example_user_assigned_identity = azure.authorization.UserAssignedIdentity("example",
    name="example-identity",
    location=example.location,
    resource_group_name=example.name)
example_identity = azure.keyvault.AccessPolicy("example-identity",
    key_vault_id=example_key_vault.id,
    tenant_id=current.tenant_id,
    object_id=example_user_assigned_identity.principal_id,
    key_permissions=[
        "WrapKey",
        "UnwrapKey",
        "Get",
        "Recover",
    ],
    secret_permissions=[
        "Get",
        "List",
        "Set",
        "Delete",
        "Recover",
        "Backup",
        "Restore",
    ])
example_sp = azure.keyvault.AccessPolicy("example-sp",
    key_vault_id=example_key_vault.id,
    tenant_id=current.tenant_id,
    object_id=current.object_id,
    key_permissions=[
        "Get",
        "Create",
        "Recover",
        "Delete",
        "Purge",
        "GetRotationPolicy",
    ])
test = azuread.get_service_principal(display_name="Azure Cosmos DB")
example_cosmosdb = azure.keyvault.AccessPolicy("example-cosmosdb",
    key_vault_id=example_key_vault.id,
    tenant_id=current.tenant_id,
    object_id=test.object_id,
    key_permissions=[
        "Get",
        "Recover",
        "UnwrapKey",
        "WrapKey",
    ],
    opts = pulumi.ResourceOptions(depends_on=[
            test,
            current,
        ]))
example_key = azure.keyvault.Key("example",
    name="example-keyvaultkey",
    key_vault_id=example_key_vault.id,
    key_type="RSA",
    key_size=2048,
    key_opts=[
        "decrypt",
        "encrypt",
        "sign",
        "unwrapKey",
        "verify",
        "wrapKey",
    ],
    opts = pulumi.ResourceOptions(depends_on=[
            example_key_vault,
            example_sp,
        ]))
example_role1 = azure.authorization.Assignment("example-role1",
    scope=example_key_vault.id,
    role_definition_name="Contributor",
    principal_id=example_user_assigned_identity.principal_id)
example_role2 = azure.authorization.Assignment("example-role2",
    scope=example_account.id,
    role_definition_name="Storage Blob Data Contributor",
    principal_id=example_user_assigned_identity.principal_id)
example_role3 = azure.authorization.Assignment("example-role3",
    scope=example_account.id,
    role_definition_name="Contributor",
    principal_id=example_user_assigned_identity.principal_id)
example_role4 = azure.authorization.Assignment("example-role4",
    scope=example_insights.id,
    role_definition_name="Contributor",
    principal_id=example_user_assigned_identity.principal_id)
example_workspace = azure.machinelearning.Workspace("example",
    name="example-workspace",
    location=example.location,
    resource_group_name=example.name,
    application_insights_id=example_insights.id,
    key_vault_id=example_key_vault.id,
    storage_account_id=example_account.id,
    high_business_impact=True,
    primary_user_assigned_identity=example_user_assigned_identity.id,
    identity={
        "type": "UserAssigned",
        "identity_ids": [example_user_assigned_identity.id],
    },
    encryption={
        "user_assigned_identity_id": example_user_assigned_identity.id,
        "key_vault_id": example_key_vault.id,
        "key_id": example_key.id,
    },
    opts = pulumi.ResourceOptions(depends_on=[
            example_role1,
            example_role2,
            example_role3,
            example_role4,
            example_cosmosdb,
        ]))

    package main

import (
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/appinsights"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/authorization"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/keyvault"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/machinelearning"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/storage"
	"github.com/pulumi/pulumi-azuread/sdk/v5/go/azuread"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := core.GetClientConfig(ctx, map[string]interface{}{}, nil)
		if err != nil {
			return err
		}
		example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
			Name:     pulumi.String("example-resources"),
			Location: pulumi.String("West Europe"),
		})
		if err != nil {
			return err
		}
		exampleInsights, err := appinsights.NewInsights(ctx, "example", &appinsights.InsightsArgs{
			Name:              pulumi.String("example-ai"),
			Location:          example.Location,
			ResourceGroupName: example.Name,
			ApplicationType:   pulumi.String("web"),
		})
		if err != nil {
			return err
		}
		exampleAccount, err := storage.NewAccount(ctx, "example", &storage.AccountArgs{
			Name:                   pulumi.String("examplestorageaccount"),
			Location:               example.Location,
			ResourceGroupName:      example.Name,
			AccountTier:            pulumi.String("Standard"),
			AccountReplicationType: pulumi.String("GRS"),
		})
		if err != nil {
			return err
		}
		exampleKeyVault, err := keyvault.NewKeyVault(ctx, "example", &keyvault.KeyVaultArgs{
			Name:                   pulumi.String("example-keyvalut"),
			Location:               example.Location,
			ResourceGroupName:      example.Name,
			TenantId:               pulumi.String(current.TenantId),
			SkuName:                pulumi.String("premium"),
			PurgeProtectionEnabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		exampleUserAssignedIdentity, err := authorization.NewUserAssignedIdentity(ctx, "example", &authorization.UserAssignedIdentityArgs{
			Name:              pulumi.String("example-identity"),
			Location:          example.Location,
			ResourceGroupName: example.Name,
		})
		if err != nil {
			return err
		}
		_, err = keyvault.NewAccessPolicy(ctx, "example-identity", &keyvault.AccessPolicyArgs{
			KeyVaultId: exampleKeyVault.ID(),
			TenantId:   pulumi.String(current.TenantId),
			ObjectId:   exampleUserAssignedIdentity.PrincipalId,
			KeyPermissions: pulumi.StringArray{
				pulumi.String("WrapKey"),
				pulumi.String("UnwrapKey"),
				pulumi.String("Get"),
				pulumi.String("Recover"),
			},
			SecretPermissions: pulumi.StringArray{
				pulumi.String("Get"),
				pulumi.String("List"),
				pulumi.String("Set"),
				pulumi.String("Delete"),
				pulumi.String("Recover"),
				pulumi.String("Backup"),
				pulumi.String("Restore"),
			},
		})
		if err != nil {
			return err
		}
		example_sp, err := keyvault.NewAccessPolicy(ctx, "example-sp", &keyvault.AccessPolicyArgs{
			KeyVaultId: exampleKeyVault.ID(),
			TenantId:   pulumi.String(current.TenantId),
			ObjectId:   pulumi.String(current.ObjectId),
			KeyPermissions: pulumi.StringArray{
				pulumi.String("Get"),
				pulumi.String("Create"),
				pulumi.String("Recover"),
				pulumi.String("Delete"),
				pulumi.String("Purge"),
				pulumi.String("GetRotationPolicy"),
			},
		})
		if err != nil {
			return err
		}
		test, err := azuread.LookupServicePrincipal(ctx, &azuread.LookupServicePrincipalArgs{
			DisplayName: pulumi.StringRef("Azure Cosmos DB"),
		}, nil)
		if err != nil {
			return err
		}
		example_cosmosdb, err := keyvault.NewAccessPolicy(ctx, "example-cosmosdb", &keyvault.AccessPolicyArgs{
			KeyVaultId: exampleKeyVault.ID(),
			TenantId:   pulumi.String(current.TenantId),
			ObjectId:   pulumi.String(test.ObjectId),
			KeyPermissions: pulumi.StringArray{
				pulumi.String("Get"),
				pulumi.String("Recover"),
				pulumi.String("UnwrapKey"),
				pulumi.String("WrapKey"),
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			test,
			current,
		}))
		if err != nil {
			return err
		}
		exampleKey, err := keyvault.NewKey(ctx, "example", &keyvault.KeyArgs{
			Name:       pulumi.String("example-keyvaultkey"),
			KeyVaultId: exampleKeyVault.ID(),
			KeyType:    pulumi.String("RSA"),
			KeySize:    pulumi.Int(2048),
			KeyOpts: pulumi.StringArray{
				pulumi.String("decrypt"),
				pulumi.String("encrypt"),
				pulumi.String("sign"),
				pulumi.String("unwrapKey"),
				pulumi.String("verify"),
				pulumi.String("wrapKey"),
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			exampleKeyVault,
			example_sp,
		}))
		if err != nil {
			return err
		}
		example_role1, err := authorization.NewAssignment(ctx, "example-role1", &authorization.AssignmentArgs{
			Scope:              exampleKeyVault.ID(),
			RoleDefinitionName: pulumi.String("Contributor"),
			PrincipalId:        exampleUserAssignedIdentity.PrincipalId,
		})
		if err != nil {
			return err
		}
		example_role2, err := authorization.NewAssignment(ctx, "example-role2", &authorization.AssignmentArgs{
			Scope:              exampleAccount.ID(),
			RoleDefinitionName: pulumi.String("Storage Blob Data Contributor"),
			PrincipalId:        exampleUserAssignedIdentity.PrincipalId,
		})
		if err != nil {
			return err
		}
		example_role3, err := authorization.NewAssignment(ctx, "example-role3", &authorization.AssignmentArgs{
			Scope:              exampleAccount.ID(),
			RoleDefinitionName: pulumi.String("Contributor"),
			PrincipalId:        exampleUserAssignedIdentity.PrincipalId,
		})
		if err != nil {
			return err
		}
		example_role4, err := authorization.NewAssignment(ctx, "example-role4", &authorization.AssignmentArgs{
			Scope:              exampleInsights.ID(),
			RoleDefinitionName: pulumi.String("Contributor"),
			PrincipalId:        exampleUserAssignedIdentity.PrincipalId,
		})
		if err != nil {
			return err
		}
		_, err = machinelearning.NewWorkspace(ctx, "example", &machinelearning.WorkspaceArgs{
			Name:                        pulumi.String("example-workspace"),
			Location:                    example.Location,
			ResourceGroupName:           example.Name,
			ApplicationInsightsId:       exampleInsights.ID(),
			KeyVaultId:                  exampleKeyVault.ID(),
			StorageAccountId:            exampleAccount.ID(),
			HighBusinessImpact:          pulumi.Bool(true),
			PrimaryUserAssignedIdentity: exampleUserAssignedIdentity.ID(),
			Identity: &machinelearning.WorkspaceIdentityArgs{
				Type: pulumi.String("UserAssigned"),
				IdentityIds: pulumi.StringArray{
					exampleUserAssignedIdentity.ID(),
				},
			},
			Encryption: &machinelearning.WorkspaceEncryptionArgs{
				UserAssignedIdentityId: exampleUserAssignedIdentity.ID(),
				KeyVaultId:             exampleKeyVault.ID(),
				KeyId:                  exampleKey.ID(),
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			example_role1,
			example_role2,
			example_role3,
			example_role4,
			example_cosmosdb,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
using AzureAD = Pulumi.AzureAD;

return await Deployment.RunAsync(() => 
{
    var current = Azure.Core.GetClientConfig.Invoke();

    var example = new Azure.Core.ResourceGroup("example", new()
    {
        Name = "example-resources",
        Location = "West Europe",
    });

    var exampleInsights = new Azure.AppInsights.Insights("example", new()
    {
        Name = "example-ai",
        Location = example.Location,
        ResourceGroupName = example.Name,
        ApplicationType = "web",
    });

    var exampleAccount = new Azure.Storage.Account("example", new()
    {
        Name = "examplestorageaccount",
        Location = example.Location,
        ResourceGroupName = example.Name,
        AccountTier = "Standard",
        AccountReplicationType = "GRS",
    });

    var exampleKeyVault = new Azure.KeyVault.KeyVault("example", new()
    {
        Name = "example-keyvalut",
        Location = example.Location,
        ResourceGroupName = example.Name,
        TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
        SkuName = "premium",
        PurgeProtectionEnabled = true,
    });

    var exampleUserAssignedIdentity = new Azure.Authorization.UserAssignedIdentity("example", new()
    {
        Name = "example-identity",
        Location = example.Location,
        ResourceGroupName = example.Name,
    });

    var example_identity = new Azure.KeyVault.AccessPolicy("example-identity", new()
    {
        KeyVaultId = exampleKeyVault.Id,
        TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
        ObjectId = exampleUserAssignedIdentity.PrincipalId,
        KeyPermissions = new[]
        {
            "WrapKey",
            "UnwrapKey",
            "Get",
            "Recover",
        },
        SecretPermissions = new[]
        {
            "Get",
            "List",
            "Set",
            "Delete",
            "Recover",
            "Backup",
            "Restore",
        },
    });

    var example_sp = new Azure.KeyVault.AccessPolicy("example-sp", new()
    {
        KeyVaultId = exampleKeyVault.Id,
        TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
        ObjectId = current.Apply(getClientConfigResult => getClientConfigResult.ObjectId),
        KeyPermissions = new[]
        {
            "Get",
            "Create",
            "Recover",
            "Delete",
            "Purge",
            "GetRotationPolicy",
        },
    });

    var test = AzureAD.GetServicePrincipal.Invoke(new()
    {
        DisplayName = "Azure Cosmos DB",
    });

    var example_cosmosdb = new Azure.KeyVault.AccessPolicy("example-cosmosdb", new()
    {
        KeyVaultId = exampleKeyVault.Id,
        TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
        ObjectId = test.Apply(getServicePrincipalResult => getServicePrincipalResult.ObjectId),
        KeyPermissions = new[]
        {
            "Get",
            "Recover",
            "UnwrapKey",
            "WrapKey",
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            test,
            current,
        },
    });

    var exampleKey = new Azure.KeyVault.Key("example", new()
    {
        Name = "example-keyvaultkey",
        KeyVaultId = exampleKeyVault.Id,
        KeyType = "RSA",
        KeySize = 2048,
        KeyOpts = new[]
        {
            "decrypt",
            "encrypt",
            "sign",
            "unwrapKey",
            "verify",
            "wrapKey",
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            exampleKeyVault,
            example_sp,
        },
    });

    var example_role1 = new Azure.Authorization.Assignment("example-role1", new()
    {
        Scope = exampleKeyVault.Id,
        RoleDefinitionName = "Contributor",
        PrincipalId = exampleUserAssignedIdentity.PrincipalId,
    });

    var example_role2 = new Azure.Authorization.Assignment("example-role2", new()
    {
        Scope = exampleAccount.Id,
        RoleDefinitionName = "Storage Blob Data Contributor",
        PrincipalId = exampleUserAssignedIdentity.PrincipalId,
    });

    var example_role3 = new Azure.Authorization.Assignment("example-role3", new()
    {
        Scope = exampleAccount.Id,
        RoleDefinitionName = "Contributor",
        PrincipalId = exampleUserAssignedIdentity.PrincipalId,
    });

    var example_role4 = new Azure.Authorization.Assignment("example-role4", new()
    {
        Scope = exampleInsights.Id,
        RoleDefinitionName = "Contributor",
        PrincipalId = exampleUserAssignedIdentity.PrincipalId,
    });

    var exampleWorkspace = new Azure.MachineLearning.Workspace("example", new()
    {
        Name = "example-workspace",
        Location = example.Location,
        ResourceGroupName = example.Name,
        ApplicationInsightsId = exampleInsights.Id,
        KeyVaultId = exampleKeyVault.Id,
        StorageAccountId = exampleAccount.Id,
        HighBusinessImpact = true,
        PrimaryUserAssignedIdentity = exampleUserAssignedIdentity.Id,
        Identity = new Azure.MachineLearning.Inputs.WorkspaceIdentityArgs
        {
            Type = "UserAssigned",
            IdentityIds = new[]
            {
                exampleUserAssignedIdentity.Id,
            },
        },
        Encryption = new Azure.MachineLearning.Inputs.WorkspaceEncryptionArgs
        {
            UserAssignedIdentityId = exampleUserAssignedIdentity.Id,
            KeyVaultId = exampleKeyVault.Id,
            KeyId = exampleKey.Id,
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            example_role1,
            example_role2,
            example_role3,
            example_role4,
            example_cosmosdb,
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.appinsights.Insights;
import com.pulumi.azure.appinsights.InsightsArgs;
import com.pulumi.azure.storage.Account;
import com.pulumi.azure.storage.AccountArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.authorization.UserAssignedIdentity;
import com.pulumi.azure.authorization.UserAssignedIdentityArgs;
import com.pulumi.azure.keyvault.AccessPolicy;
import com.pulumi.azure.keyvault.AccessPolicyArgs;
import com.pulumi.azuread.AzureadFunctions;
import com.pulumi.azuread.inputs.GetServicePrincipalArgs;
import com.pulumi.azure.keyvault.Key;
import com.pulumi.azure.keyvault.KeyArgs;
import com.pulumi.azure.authorization.Assignment;
import com.pulumi.azure.authorization.AssignmentArgs;
import com.pulumi.azure.machinelearning.Workspace;
import com.pulumi.azure.machinelearning.WorkspaceArgs;
import com.pulumi.azure.machinelearning.inputs.WorkspaceIdentityArgs;
import com.pulumi.azure.machinelearning.inputs.WorkspaceEncryptionArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = CoreFunctions.getClientConfig();

        var example = new ResourceGroup("example", ResourceGroupArgs.builder()
            .name("example-resources")
            .location("West Europe")
            .build());

        var exampleInsights = new Insights("exampleInsights", InsightsArgs.builder()
            .name("example-ai")
            .location(example.location())
            .resourceGroupName(example.name())
            .applicationType("web")
            .build());

        var exampleAccount = new Account("exampleAccount", AccountArgs.builder()
            .name("examplestorageaccount")
            .location(example.location())
            .resourceGroupName(example.name())
            .accountTier("Standard")
            .accountReplicationType("GRS")
            .build());

        var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
            .name("example-keyvalut")
            .location(example.location())
            .resourceGroupName(example.name())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .skuName("premium")
            .purgeProtectionEnabled(true)
            .build());

        var exampleUserAssignedIdentity = new UserAssignedIdentity("exampleUserAssignedIdentity", UserAssignedIdentityArgs.builder()
            .name("example-identity")
            .location(example.location())
            .resourceGroupName(example.name())
            .build());

        var example_identity = new AccessPolicy("example-identity", AccessPolicyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .objectId(exampleUserAssignedIdentity.principalId())
            .keyPermissions(            
                "WrapKey",
                "UnwrapKey",
                "Get",
                "Recover")
            .secretPermissions(            
                "Get",
                "List",
                "Set",
                "Delete",
                "Recover",
                "Backup",
                "Restore")
            .build());

        var example_sp = new AccessPolicy("example-sp", AccessPolicyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .objectId(current.applyValue(getClientConfigResult -> getClientConfigResult.objectId()))
            .keyPermissions(            
                "Get",
                "Create",
                "Recover",
                "Delete",
                "Purge",
                "GetRotationPolicy")
            .build());

        final var test = AzureadFunctions.getServicePrincipal(GetServicePrincipalArgs.builder()
            .displayName("Azure Cosmos DB")
            .build());

        var example_cosmosdb = new AccessPolicy("example-cosmosdb", AccessPolicyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .objectId(test.applyValue(getServicePrincipalResult -> getServicePrincipalResult.objectId()))
            .keyPermissions(            
                "Get",
                "Recover",
                "UnwrapKey",
                "WrapKey")
            .build(), CustomResourceOptions.builder()
                .dependsOn(                
                    test.applyValue(getServicePrincipalResult -> getServicePrincipalResult),
                    current.applyValue(getClientConfigResult -> getClientConfigResult))
                .build());

        var exampleKey = new Key("exampleKey", KeyArgs.builder()
            .name("example-keyvaultkey")
            .keyVaultId(exampleKeyVault.id())
            .keyType("RSA")
            .keySize(2048)
            .keyOpts(            
                "decrypt",
                "encrypt",
                "sign",
                "unwrapKey",
                "verify",
                "wrapKey")
            .build(), CustomResourceOptions.builder()
                .dependsOn(                
                    exampleKeyVault,
                    example_sp)
                .build());

        var example_role1 = new Assignment("example-role1", AssignmentArgs.builder()
            .scope(exampleKeyVault.id())
            .roleDefinitionName("Contributor")
            .principalId(exampleUserAssignedIdentity.principalId())
            .build());

        var example_role2 = new Assignment("example-role2", AssignmentArgs.builder()
            .scope(exampleAccount.id())
            .roleDefinitionName("Storage Blob Data Contributor")
            .principalId(exampleUserAssignedIdentity.principalId())
            .build());

        var example_role3 = new Assignment("example-role3", AssignmentArgs.builder()
            .scope(exampleAccount.id())
            .roleDefinitionName("Contributor")
            .principalId(exampleUserAssignedIdentity.principalId())
            .build());

        var example_role4 = new Assignment("example-role4", AssignmentArgs.builder()
            .scope(exampleInsights.id())
            .roleDefinitionName("Contributor")
            .principalId(exampleUserAssignedIdentity.principalId())
            .build());

        var exampleWorkspace = new Workspace("exampleWorkspace", WorkspaceArgs.builder()
            .name("example-workspace")
            .location(example.location())
            .resourceGroupName(example.name())
            .applicationInsightsId(exampleInsights.id())
            .keyVaultId(exampleKeyVault.id())
            .storageAccountId(exampleAccount.id())
            .highBusinessImpact(true)
            .primaryUserAssignedIdentity(exampleUserAssignedIdentity.id())
            .identity(WorkspaceIdentityArgs.builder()
                .type("UserAssigned")
                .identityIds(exampleUserAssignedIdentity.id())
                .build())
            .encryption(WorkspaceEncryptionArgs.builder()
                .userAssignedIdentityId(exampleUserAssignedIdentity.id())
                .keyVaultId(exampleKeyVault.id())
                .keyId(exampleKey.id())
                .build())
            .build(), CustomResourceOptions.builder()
                .dependsOn(                
                    example_role1,
                    example_role2,
                    example_role3,
                    example_role4,
                    example_cosmosdb)
                .build());

    }
}

    resources:
  example:
    type: azure:core:ResourceGroup
    properties:
      name: example-resources
      location: West Europe
  exampleInsights:
    type: azure:appinsights:Insights
    name: example
    properties:
      name: example-ai
      location: ${example.location}
      resourceGroupName: ${example.name}
      applicationType: web
  exampleAccount:
    type: azure:storage:Account
    name: example
    properties:
      name: examplestorageaccount
      location: ${example.location}
      resourceGroupName: ${example.name}
      accountTier: Standard
      accountReplicationType: GRS
  exampleKeyVault:
    type: azure:keyvault:KeyVault
    name: example
    properties:
      name: example-keyvalut
      location: ${example.location}
      resourceGroupName: ${example.name}
      tenantId: ${current.tenantId}
      skuName: premium
      purgeProtectionEnabled: true
  exampleUserAssignedIdentity:
    type: azure:authorization:UserAssignedIdentity
    name: example
    properties:
      name: example-identity
      location: ${example.location}
      resourceGroupName: ${example.name}
  example-identity:
    type: azure:keyvault:AccessPolicy
    properties:
      keyVaultId: ${exampleKeyVault.id}
      tenantId: ${current.tenantId}
      objectId: ${exampleUserAssignedIdentity.principalId}
      keyPermissions:
        - WrapKey
        - UnwrapKey
        - Get
        - Recover
      secretPermissions:
        - Get
        - List
        - Set
        - Delete
        - Recover
        - Backup
        - Restore
  example-sp:
    type: azure:keyvault:AccessPolicy
    properties:
      keyVaultId: ${exampleKeyVault.id}
      tenantId: ${current.tenantId}
      objectId: ${current.objectId}
      keyPermissions:
        - Get
        - Create
        - Recover
        - Delete
        - Purge
        - GetRotationPolicy
  example-cosmosdb:
    type: azure:keyvault:AccessPolicy
    properties:
      keyVaultId: ${exampleKeyVault.id}
      tenantId: ${current.tenantId}
      objectId: ${test.objectId}
      keyPermissions:
        - Get
        - Recover
        - UnwrapKey
        - WrapKey
    options:
      dependsOn:
        - ${test}
        - ${current}
  exampleKey:
    type: azure:keyvault:Key
    name: example
    properties:
      name: example-keyvaultkey
      keyVaultId: ${exampleKeyVault.id}
      keyType: RSA
      keySize: 2048
      keyOpts:
        - decrypt
        - encrypt
        - sign
        - unwrapKey
        - verify
        - wrapKey
    options:
      dependsOn:
        - ${exampleKeyVault}
        - ${["example-sp"]}
  example-role1:
    type: azure:authorization:Assignment
    properties:
      scope: ${exampleKeyVault.id}
      roleDefinitionName: Contributor
      principalId: ${exampleUserAssignedIdentity.principalId}
  example-role2:
    type: azure:authorization:Assignment
    properties:
      scope: ${exampleAccount.id}
      roleDefinitionName: Storage Blob Data Contributor
      principalId: ${exampleUserAssignedIdentity.principalId}
  example-role3:
    type: azure:authorization:Assignment
    properties:
      scope: ${exampleAccount.id}
      roleDefinitionName: Contributor
      principalId: ${exampleUserAssignedIdentity.principalId}
  example-role4:
    type: azure:authorization:Assignment
    properties:
      scope: ${exampleInsights.id}
      roleDefinitionName: Contributor
      principalId: ${exampleUserAssignedIdentity.principalId}
  exampleWorkspace:
    type: azure:machinelearning:Workspace
    name: example
    properties:
      name: example-workspace
      location: ${example.location}
      resourceGroupName: ${example.name}
      applicationInsightsId: ${exampleInsights.id}
      keyVaultId: ${exampleKeyVault.id}
      storageAccountId: ${exampleAccount.id}
      highBusinessImpact: true
      primaryUserAssignedIdentity: ${exampleUserAssignedIdentity.id}
      identity:
        type: UserAssigned
        identityIds:
          - ${exampleUserAssignedIdentity.id}
      encryption:
        userAssignedIdentityId: ${exampleUserAssignedIdentity.id}
        keyVaultId: ${exampleKeyVault.id}
        keyId: ${exampleKey.id}
    options:
      dependsOn:
        - ${["example-role1"]}
        - ${["example-role2"]}
        - ${["example-role3"]}
        - ${["example-role4"]}
        - ${["example-cosmosdb"]}
variables:
  current:
    fn::invoke:
      function: azure:core:getClientConfig
      arguments: {}
  test:
    fn::invoke:
      function: azuread:getServicePrincipal
      arguments:
        displayName: Azure Cosmos DB

    Create Workspace Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Workspace(name: string, args: WorkspaceArgs, opts?: CustomResourceOptions);
    @overload
def Workspace(resource_name: str,
              args: WorkspaceArgs,
              opts: Optional[ResourceOptions] = None)

@overload
def Workspace(resource_name: str,
              opts: Optional[ResourceOptions] = None,
              identity: Optional[WorkspaceIdentityArgs] = None,
              storage_account_id: Optional[str] = None,
              resource_group_name: Optional[str] = None,
              application_insights_id: Optional[str] = None,
              key_vault_id: Optional[str] = None,
              kind: Optional[str] = None,
              primary_user_assigned_identity: Optional[str] = None,
              friendly_name: Optional[str] = None,
              image_build_compute_name: Optional[str] = None,
              feature_store: Optional[WorkspaceFeatureStoreArgs] = None,
              encryption: Optional[WorkspaceEncryptionArgs] = None,
              location: Optional[str] = None,
              managed_network: Optional[WorkspaceManagedNetworkArgs] = None,
              name: Optional[str] = None,
              high_business_impact: Optional[bool] = None,
              public_network_access_enabled: Optional[bool] = None,
              description: Optional[str] = None,
              serverless_compute: Optional[WorkspaceServerlessComputeArgs] = None,
              sku_name: Optional[str] = None,
              container_registry_id: Optional[str] = None,
              tags: Optional[Mapping[str, str]] = None,
              v1_legacy_mode_enabled: Optional[bool] = None)
    func NewWorkspace(ctx *Context, name string, args WorkspaceArgs, opts ...ResourceOption) (*Workspace, error)
    public Workspace(string name, WorkspaceArgs args, CustomResourceOptions? opts = null)
    public Workspace(String name, WorkspaceArgs args)
public Workspace(String name, WorkspaceArgs args, CustomResourceOptions options)

    type: azure:machinelearning:Workspace
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args WorkspaceArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args WorkspaceArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args WorkspaceArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args WorkspaceArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args WorkspaceArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var exampleworkspaceResourceResourceFromMachinelearningworkspace = new Azure.MachineLearning.Workspace("exampleworkspaceResourceResourceFromMachinelearningworkspace", new()
{
    Identity = new Azure.MachineLearning.Inputs.WorkspaceIdentityArgs
    {
        Type = "string",
        IdentityIds = new[]
        {
            "string",
        },
        PrincipalId = "string",
        TenantId = "string",
    },
    StorageAccountId = "string",
    ResourceGroupName = "string",
    ApplicationInsightsId = "string",
    KeyVaultId = "string",
    Kind = "string",
    PrimaryUserAssignedIdentity = "string",
    FriendlyName = "string",
    ImageBuildComputeName = "string",
    FeatureStore = new Azure.MachineLearning.Inputs.WorkspaceFeatureStoreArgs
    {
        ComputerSparkRuntimeVersion = "string",
        OfflineConnectionName = "string",
        OnlineConnectionName = "string",
    },
    Encryption = new Azure.MachineLearning.Inputs.WorkspaceEncryptionArgs
    {
        KeyId = "string",
        KeyVaultId = "string",
        UserAssignedIdentityId = "string",
    },
    Location = "string",
    ManagedNetwork = new Azure.MachineLearning.Inputs.WorkspaceManagedNetworkArgs
    {
        IsolationMode = "string",
    },
    Name = "string",
    HighBusinessImpact = false,
    PublicNetworkAccessEnabled = false,
    Description = "string",
    ServerlessCompute = new Azure.MachineLearning.Inputs.WorkspaceServerlessComputeArgs
    {
        PublicIpEnabled = false,
        SubnetId = "string",
    },
    SkuName = "string",
    ContainerRegistryId = "string",
    Tags = 
    {
        { "string", "string" },
    },
    V1LegacyModeEnabled = false,
});

    example, err := machinelearning.NewWorkspace(ctx, "exampleworkspaceResourceResourceFromMachinelearningworkspace", &machinelearning.WorkspaceArgs{
	Identity: &machinelearning.WorkspaceIdentityArgs{
		Type: pulumi.String("string"),
		IdentityIds: pulumi.StringArray{
			pulumi.String("string"),
		},
		PrincipalId: pulumi.String("string"),
		TenantId:    pulumi.String("string"),
	},
	StorageAccountId:            pulumi.String("string"),
	ResourceGroupName:           pulumi.String("string"),
	ApplicationInsightsId:       pulumi.String("string"),
	KeyVaultId:                  pulumi.String("string"),
	Kind:                        pulumi.String("string"),
	PrimaryUserAssignedIdentity: pulumi.String("string"),
	FriendlyName:                pulumi.String("string"),
	ImageBuildComputeName:       pulumi.String("string"),
	FeatureStore: &machinelearning.WorkspaceFeatureStoreArgs{
		ComputerSparkRuntimeVersion: pulumi.String("string"),
		OfflineConnectionName:       pulumi.String("string"),
		OnlineConnectionName:        pulumi.String("string"),
	},
	Encryption: &machinelearning.WorkspaceEncryptionArgs{
		KeyId:                  pulumi.String("string"),
		KeyVaultId:             pulumi.String("string"),
		UserAssignedIdentityId: pulumi.String("string"),
	},
	Location: pulumi.String("string"),
	ManagedNetwork: &machinelearning.WorkspaceManagedNetworkArgs{
		IsolationMode: pulumi.String("string"),
	},
	Name:                       pulumi.String("string"),
	HighBusinessImpact:         pulumi.Bool(false),
	PublicNetworkAccessEnabled: pulumi.Bool(false),
	Description:                pulumi.String("string"),
	ServerlessCompute: &machinelearning.WorkspaceServerlessComputeArgs{
		PublicIpEnabled: pulumi.Bool(false),
		SubnetId:        pulumi.String("string"),
	},
	SkuName:             pulumi.String("string"),
	ContainerRegistryId: pulumi.String("string"),
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	V1LegacyModeEnabled: pulumi.Bool(false),
})

    var exampleworkspaceResourceResourceFromMachinelearningworkspace = new Workspace("exampleworkspaceResourceResourceFromMachinelearningworkspace", WorkspaceArgs.builder()
    .identity(WorkspaceIdentityArgs.builder()
        .type("string")
        .identityIds("string")
        .principalId("string")
        .tenantId("string")
        .build())
    .storageAccountId("string")
    .resourceGroupName("string")
    .applicationInsightsId("string")
    .keyVaultId("string")
    .kind("string")
    .primaryUserAssignedIdentity("string")
    .friendlyName("string")
    .imageBuildComputeName("string")
    .featureStore(WorkspaceFeatureStoreArgs.builder()
        .computerSparkRuntimeVersion("string")
        .offlineConnectionName("string")
        .onlineConnectionName("string")
        .build())
    .encryption(WorkspaceEncryptionArgs.builder()
        .keyId("string")
        .keyVaultId("string")
        .userAssignedIdentityId("string")
        .build())
    .location("string")
    .managedNetwork(WorkspaceManagedNetworkArgs.builder()
        .isolationMode("string")
        .build())
    .name("string")
    .highBusinessImpact(false)
    .publicNetworkAccessEnabled(false)
    .description("string")
    .serverlessCompute(WorkspaceServerlessComputeArgs.builder()
        .publicIpEnabled(false)
        .subnetId("string")
        .build())
    .skuName("string")
    .containerRegistryId("string")
    .tags(Map.of("string", "string"))
    .v1LegacyModeEnabled(false)
    .build());

    exampleworkspace_resource_resource_from_machinelearningworkspace = azure.machinelearning.Workspace("exampleworkspaceResourceResourceFromMachinelearningworkspace",
    identity={
        "type": "string",
        "identity_ids": ["string"],
        "principal_id": "string",
        "tenant_id": "string",
    },
    storage_account_id="string",
    resource_group_name="string",
    application_insights_id="string",
    key_vault_id="string",
    kind="string",
    primary_user_assigned_identity="string",
    friendly_name="string",
    image_build_compute_name="string",
    feature_store={
        "computer_spark_runtime_version": "string",
        "offline_connection_name": "string",
        "online_connection_name": "string",
    },
    encryption={
        "key_id": "string",
        "key_vault_id": "string",
        "user_assigned_identity_id": "string",
    },
    location="string",
    managed_network={
        "isolation_mode": "string",
    },
    name="string",
    high_business_impact=False,
    public_network_access_enabled=False,
    description="string",
    serverless_compute={
        "public_ip_enabled": False,
        "subnet_id": "string",
    },
    sku_name="string",
    container_registry_id="string",
    tags={
        "string": "string",
    },
    v1_legacy_mode_enabled=False)

    const exampleworkspaceResourceResourceFromMachinelearningworkspace = new azure.machinelearning.Workspace("exampleworkspaceResourceResourceFromMachinelearningworkspace", {
    identity: {
        type: "string",
        identityIds: ["string"],
        principalId: "string",
        tenantId: "string",
    },
    storageAccountId: "string",
    resourceGroupName: "string",
    applicationInsightsId: "string",
    keyVaultId: "string",
    kind: "string",
    primaryUserAssignedIdentity: "string",
    friendlyName: "string",
    imageBuildComputeName: "string",
    featureStore: {
        computerSparkRuntimeVersion: "string",
        offlineConnectionName: "string",
        onlineConnectionName: "string",
    },
    encryption: {
        keyId: "string",
        keyVaultId: "string",
        userAssignedIdentityId: "string",
    },
    location: "string",
    managedNetwork: {
        isolationMode: "string",
    },
    name: "string",
    highBusinessImpact: false,
    publicNetworkAccessEnabled: false,
    description: "string",
    serverlessCompute: {
        publicIpEnabled: false,
        subnetId: "string",
    },
    skuName: "string",
    containerRegistryId: "string",
    tags: {
        string: "string",
    },
    v1LegacyModeEnabled: false,
});

    type: azure:machinelearning:Workspace
properties:
    applicationInsightsId: string
    containerRegistryId: string
    description: string
    encryption:
        keyId: string
        keyVaultId: string
        userAssignedIdentityId: string
    featureStore:
        computerSparkRuntimeVersion: string
        offlineConnectionName: string
        onlineConnectionName: string
    friendlyName: string
    highBusinessImpact: false
    identity:
        identityIds:
            - string
        principalId: string
        tenantId: string
        type: string
    imageBuildComputeName: string
    keyVaultId: string
    kind: string
    location: string
    managedNetwork:
        isolationMode: string
    name: string
    primaryUserAssignedIdentity: string
    publicNetworkAccessEnabled: false
    resourceGroupName: string
    serverlessCompute:
        publicIpEnabled: false
        subnetId: string
    skuName: string
    storageAccountId: string
    tags:
        string: string
    v1LegacyModeEnabled: false

    Workspace Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Workspace resource accepts the following input properties:

    ApplicationInsightsId string
    The ID of the Application Insights associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    Identity WorkspaceIdentity
    An identity block as defined below.
    KeyVaultId string
    The ID of key vault associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    ResourceGroupName string
    Specifies the name of the Resource Group in which the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    StorageAccountId string

    The ID of the Storage Account associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The account_tier cannot be Premium in order to associate the Storage Account to this Machine Learning Workspace.

    ContainerRegistryId string

    The ID of the container registry associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The admin_enabled should be true in order to associate the Container Registry to this Machine Learning Workspace.

    Description string
    The description of this Machine Learning Workspace.
    Encryption WorkspaceEncryption
    An encryption block as defined below. Changing this forces a new resource to be created.
    FeatureStore WorkspaceFeatureStore
    A feature_store block as defined below.
    FriendlyName string
    Display name for this Machine Learning Workspace.
    HighBusinessImpact bool
    Flag to signal High Business Impact (HBI) data in the workspace and reduce diagnostic data collected by the service. Changing this forces a new resource to be created.
    ImageBuildComputeName string
    The compute name for image build of the Machine Learning Workspace.
    Kind string
    The type of the Workspace. Possible values are Default, FeatureStore. Defaults to Default
    Location string
    Specifies the supported Azure location where the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    ManagedNetwork WorkspaceManagedNetwork
    A managed_network block as defined below.
    Name string
    Specifies the name of the Machine Learning Workspace. Changing this forces a new resource to be created.
    PrimaryUserAssignedIdentity string
    The user assigned identity id that represents the workspace identity.
    PublicNetworkAccessEnabled bool

    Enable public access when this Machine Learning Workspace is behind VNet. Defaults to true.

    NOTE: public_access_behind_virtual_network_enabled is deprecated and will be removed in favour of the property public_network_access_enabled.

    ServerlessCompute WorkspaceServerlessCompute
    A serverless_compute block as defined below.
    SkuName string
    SKU/edition of the Machine Learning Workspace, possible values are Free, Basic, Standard and Premium. Defaults to Basic.
    Tags Dictionary<string, string>
    A mapping of tags to assign to the resource.
    V1LegacyModeEnabled bool
    Enable V1 API features, enabling v1_legacy_mode may prevent you from using features provided by the v2 API. Defaults to false.
    ApplicationInsightsId string
    The ID of the Application Insights associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    Identity WorkspaceIdentityArgs
    An identity block as defined below.
    KeyVaultId string
    The ID of key vault associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    ResourceGroupName string
    Specifies the name of the Resource Group in which the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    StorageAccountId string

    The ID of the Storage Account associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The account_tier cannot be Premium in order to associate the Storage Account to this Machine Learning Workspace.

    ContainerRegistryId string

    The ID of the container registry associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The admin_enabled should be true in order to associate the Container Registry to this Machine Learning Workspace.

    Description string
    The description of this Machine Learning Workspace.
    Encryption WorkspaceEncryptionArgs
    An encryption block as defined below. Changing this forces a new resource to be created.
    FeatureStore WorkspaceFeatureStoreArgs
    A feature_store block as defined below.
    FriendlyName string
    Display name for this Machine Learning Workspace.
    HighBusinessImpact bool
    Flag to signal High Business Impact (HBI) data in the workspace and reduce diagnostic data collected by the service. Changing this forces a new resource to be created.
    ImageBuildComputeName string
    The compute name for image build of the Machine Learning Workspace.
    Kind string
    The type of the Workspace. Possible values are Default, FeatureStore. Defaults to Default
    Location string
    Specifies the supported Azure location where the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    ManagedNetwork WorkspaceManagedNetworkArgs
    A managed_network block as defined below.
    Name string
    Specifies the name of the Machine Learning Workspace. Changing this forces a new resource to be created.
    PrimaryUserAssignedIdentity string
    The user assigned identity id that represents the workspace identity.
    PublicNetworkAccessEnabled bool

    Enable public access when this Machine Learning Workspace is behind VNet. Defaults to true.

    NOTE: public_access_behind_virtual_network_enabled is deprecated and will be removed in favour of the property public_network_access_enabled.

    ServerlessCompute WorkspaceServerlessComputeArgs
    A serverless_compute block as defined below.
    SkuName string
    SKU/edition of the Machine Learning Workspace, possible values are Free, Basic, Standard and Premium. Defaults to Basic.
    Tags map[string]string
    A mapping of tags to assign to the resource.
    V1LegacyModeEnabled bool
    Enable V1 API features, enabling v1_legacy_mode may prevent you from using features provided by the v2 API. Defaults to false.
    applicationInsightsId String
    The ID of the Application Insights associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    identity WorkspaceIdentity
    An identity block as defined below.
    keyVaultId String
    The ID of key vault associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    resourceGroupName String
    Specifies the name of the Resource Group in which the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    storageAccountId String

    The ID of the Storage Account associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The account_tier cannot be Premium in order to associate the Storage Account to this Machine Learning Workspace.

    containerRegistryId String

    The ID of the container registry associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The admin_enabled should be true in order to associate the Container Registry to this Machine Learning Workspace.

    description String
    The description of this Machine Learning Workspace.
    encryption WorkspaceEncryption
    An encryption block as defined below. Changing this forces a new resource to be created.
    featureStore WorkspaceFeatureStore
    A feature_store block as defined below.
    friendlyName String
    Display name for this Machine Learning Workspace.
    highBusinessImpact Boolean
    Flag to signal High Business Impact (HBI) data in the workspace and reduce diagnostic data collected by the service. Changing this forces a new resource to be created.
    imageBuildComputeName String
    The compute name for image build of the Machine Learning Workspace.
    kind String
    The type of the Workspace. Possible values are Default, FeatureStore. Defaults to Default
    location String
    Specifies the supported Azure location where the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    managedNetwork WorkspaceManagedNetwork
    A managed_network block as defined below.
    name String
    Specifies the name of the Machine Learning Workspace. Changing this forces a new resource to be created.
    primaryUserAssignedIdentity String
    The user assigned identity id that represents the workspace identity.
    publicNetworkAccessEnabled Boolean

    Enable public access when this Machine Learning Workspace is behind VNet. Defaults to true.

    NOTE: public_access_behind_virtual_network_enabled is deprecated and will be removed in favour of the property public_network_access_enabled.

    serverlessCompute WorkspaceServerlessCompute
    A serverless_compute block as defined below.
    skuName String
    SKU/edition of the Machine Learning Workspace, possible values are Free, Basic, Standard and Premium. Defaults to Basic.
    tags Map<String,String>
    A mapping of tags to assign to the resource.
    v1LegacyModeEnabled Boolean
    Enable V1 API features, enabling v1_legacy_mode may prevent you from using features provided by the v2 API. Defaults to false.
    applicationInsightsId string
    The ID of the Application Insights associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    identity WorkspaceIdentity
    An identity block as defined below.
    keyVaultId string
    The ID of key vault associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    resourceGroupName string
    Specifies the name of the Resource Group in which the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    storageAccountId string

    The ID of the Storage Account associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The account_tier cannot be Premium in order to associate the Storage Account to this Machine Learning Workspace.

    containerRegistryId string

    The ID of the container registry associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The admin_enabled should be true in order to associate the Container Registry to this Machine Learning Workspace.

    description string
    The description of this Machine Learning Workspace.
    encryption WorkspaceEncryption
    An encryption block as defined below. Changing this forces a new resource to be created.
    featureStore WorkspaceFeatureStore
    A feature_store block as defined below.
    friendlyName string
    Display name for this Machine Learning Workspace.
    highBusinessImpact boolean
    Flag to signal High Business Impact (HBI) data in the workspace and reduce diagnostic data collected by the service. Changing this forces a new resource to be created.
    imageBuildComputeName string
    The compute name for image build of the Machine Learning Workspace.
    kind string
    The type of the Workspace. Possible values are Default, FeatureStore. Defaults to Default
    location string
    Specifies the supported Azure location where the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    managedNetwork WorkspaceManagedNetwork
    A managed_network block as defined below.
    name string
    Specifies the name of the Machine Learning Workspace. Changing this forces a new resource to be created.
    primaryUserAssignedIdentity string
    The user assigned identity id that represents the workspace identity.
    publicNetworkAccessEnabled boolean

    Enable public access when this Machine Learning Workspace is behind VNet. Defaults to true.

    NOTE: public_access_behind_virtual_network_enabled is deprecated and will be removed in favour of the property public_network_access_enabled.

    serverlessCompute WorkspaceServerlessCompute
    A serverless_compute block as defined below.
    skuName string
    SKU/edition of the Machine Learning Workspace, possible values are Free, Basic, Standard and Premium. Defaults to Basic.
    tags {[key: string]: string}
    A mapping of tags to assign to the resource.
    v1LegacyModeEnabled boolean
    Enable V1 API features, enabling v1_legacy_mode may prevent you from using features provided by the v2 API. Defaults to false.
    application_insights_id str
    The ID of the Application Insights associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    identity WorkspaceIdentityArgs
    An identity block as defined below.
    key_vault_id str
    The ID of key vault associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    resource_group_name str
    Specifies the name of the Resource Group in which the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    storage_account_id str

    The ID of the Storage Account associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The account_tier cannot be Premium in order to associate the Storage Account to this Machine Learning Workspace.

    container_registry_id str

    The ID of the container registry associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The admin_enabled should be true in order to associate the Container Registry to this Machine Learning Workspace.

    description str
    The description of this Machine Learning Workspace.
    encryption WorkspaceEncryptionArgs
    An encryption block as defined below. Changing this forces a new resource to be created.
    feature_store WorkspaceFeatureStoreArgs
    A feature_store block as defined below.
    friendly_name str
    Display name for this Machine Learning Workspace.
    high_business_impact bool
    Flag to signal High Business Impact (HBI) data in the workspace and reduce diagnostic data collected by the service. Changing this forces a new resource to be created.
    image_build_compute_name str
    The compute name for image build of the Machine Learning Workspace.
    kind str
    The type of the Workspace. Possible values are Default, FeatureStore. Defaults to Default
    location str
    Specifies the supported Azure location where the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    managed_network WorkspaceManagedNetworkArgs
    A managed_network block as defined below.
    name str
    Specifies the name of the Machine Learning Workspace. Changing this forces a new resource to be created.
    primary_user_assigned_identity str
    The user assigned identity id that represents the workspace identity.
    public_network_access_enabled bool

    Enable public access when this Machine Learning Workspace is behind VNet. Defaults to true.

    NOTE: public_access_behind_virtual_network_enabled is deprecated and will be removed in favour of the property public_network_access_enabled.

    serverless_compute WorkspaceServerlessComputeArgs
    A serverless_compute block as defined below.
    sku_name str
    SKU/edition of the Machine Learning Workspace, possible values are Free, Basic, Standard and Premium. Defaults to Basic.
    tags Mapping[str, str]
    A mapping of tags to assign to the resource.
    v1_legacy_mode_enabled bool
    Enable V1 API features, enabling v1_legacy_mode may prevent you from using features provided by the v2 API. Defaults to false.
    applicationInsightsId String
    The ID of the Application Insights associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    identity Property Map
    An identity block as defined below.
    keyVaultId String
    The ID of key vault associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    resourceGroupName String
    Specifies the name of the Resource Group in which the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    storageAccountId String

    The ID of the Storage Account associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The account_tier cannot be Premium in order to associate the Storage Account to this Machine Learning Workspace.

    containerRegistryId String

    The ID of the container registry associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The admin_enabled should be true in order to associate the Container Registry to this Machine Learning Workspace.

    description String
    The description of this Machine Learning Workspace.
    encryption Property Map
    An encryption block as defined below. Changing this forces a new resource to be created.
    featureStore Property Map
    A feature_store block as defined below.
    friendlyName String
    Display name for this Machine Learning Workspace.
    highBusinessImpact Boolean
    Flag to signal High Business Impact (HBI) data in the workspace and reduce diagnostic data collected by the service. Changing this forces a new resource to be created.
    imageBuildComputeName String
    The compute name for image build of the Machine Learning Workspace.
    kind String
    The type of the Workspace. Possible values are Default, FeatureStore. Defaults to Default
    location String
    Specifies the supported Azure location where the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    managedNetwork Property Map
    A managed_network block as defined below.
    name String
    Specifies the name of the Machine Learning Workspace. Changing this forces a new resource to be created.
    primaryUserAssignedIdentity String
    The user assigned identity id that represents the workspace identity.
    publicNetworkAccessEnabled Boolean

    Enable public access when this Machine Learning Workspace is behind VNet. Defaults to true.

    NOTE: public_access_behind_virtual_network_enabled is deprecated and will be removed in favour of the property public_network_access_enabled.

    serverlessCompute Property Map
    A serverless_compute block as defined below.
    skuName String
    SKU/edition of the Machine Learning Workspace, possible values are Free, Basic, Standard and Premium. Defaults to Basic.
    tags Map<String>
    A mapping of tags to assign to the resource.
    v1LegacyModeEnabled Boolean
    Enable V1 API features, enabling v1_legacy_mode may prevent you from using features provided by the v2 API. Defaults to false.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Workspace resource produces the following output properties:

    DiscoveryUrl string
    The url for the discovery service to identify regional endpoints for machine learning experimentation services.
    Id string
    The provider-assigned unique ID for this managed resource.
    WorkspaceId string
    The immutable id associated with this workspace.
    DiscoveryUrl string
    The url for the discovery service to identify regional endpoints for machine learning experimentation services.
    Id string
    The provider-assigned unique ID for this managed resource.
    WorkspaceId string
    The immutable id associated with this workspace.
    discoveryUrl String
    The url for the discovery service to identify regional endpoints for machine learning experimentation services.
    id String
    The provider-assigned unique ID for this managed resource.
    workspaceId String
    The immutable id associated with this workspace.
    discoveryUrl string
    The url for the discovery service to identify regional endpoints for machine learning experimentation services.
    id string
    The provider-assigned unique ID for this managed resource.
    workspaceId string
    The immutable id associated with this workspace.
    discovery_url str
    The url for the discovery service to identify regional endpoints for machine learning experimentation services.
    id str
    The provider-assigned unique ID for this managed resource.
    workspace_id str
    The immutable id associated with this workspace.
    discoveryUrl String
    The url for the discovery service to identify regional endpoints for machine learning experimentation services.
    id String
    The provider-assigned unique ID for this managed resource.
    workspaceId String
    The immutable id associated with this workspace.

    Look up Existing Workspace Resource

    Get an existing Workspace resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: WorkspaceState, opts?: CustomResourceOptions): Workspace
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        application_insights_id: Optional[str] = None,
        container_registry_id: Optional[str] = None,
        description: Optional[str] = None,
        discovery_url: Optional[str] = None,
        encryption: Optional[WorkspaceEncryptionArgs] = None,
        feature_store: Optional[WorkspaceFeatureStoreArgs] = None,
        friendly_name: Optional[str] = None,
        high_business_impact: Optional[bool] = None,
        identity: Optional[WorkspaceIdentityArgs] = None,
        image_build_compute_name: Optional[str] = None,
        key_vault_id: Optional[str] = None,
        kind: Optional[str] = None,
        location: Optional[str] = None,
        managed_network: Optional[WorkspaceManagedNetworkArgs] = None,
        name: Optional[str] = None,
        primary_user_assigned_identity: Optional[str] = None,
        public_network_access_enabled: Optional[bool] = None,
        resource_group_name: Optional[str] = None,
        serverless_compute: Optional[WorkspaceServerlessComputeArgs] = None,
        sku_name: Optional[str] = None,
        storage_account_id: Optional[str] = None,
        tags: Optional[Mapping[str, str]] = None,
        v1_legacy_mode_enabled: Optional[bool] = None,
        workspace_id: Optional[str] = None) -> Workspace
    func GetWorkspace(ctx *Context, name string, id IDInput, state *WorkspaceState, opts ...ResourceOption) (*Workspace, error)
    public static Workspace Get(string name, Input<string> id, WorkspaceState? state, CustomResourceOptions? opts = null)
    public static Workspace get(String name, Output<String> id, WorkspaceState state, CustomResourceOptions options)
    resources:  _:    type: azure:machinelearning:Workspace    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ApplicationInsightsId string
    The ID of the Application Insights associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    ContainerRegistryId string

    The ID of the container registry associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The admin_enabled should be true in order to associate the Container Registry to this Machine Learning Workspace.

    Description string
    The description of this Machine Learning Workspace.
    DiscoveryUrl string
    The url for the discovery service to identify regional endpoints for machine learning experimentation services.
    Encryption WorkspaceEncryption
    An encryption block as defined below. Changing this forces a new resource to be created.
    FeatureStore WorkspaceFeatureStore
    A feature_store block as defined below.
    FriendlyName string
    Display name for this Machine Learning Workspace.
    HighBusinessImpact bool
    Flag to signal High Business Impact (HBI) data in the workspace and reduce diagnostic data collected by the service. Changing this forces a new resource to be created.
    Identity WorkspaceIdentity
    An identity block as defined below.
    ImageBuildComputeName string
    The compute name for image build of the Machine Learning Workspace.
    KeyVaultId string
    The ID of key vault associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    Kind string
    The type of the Workspace. Possible values are Default, FeatureStore. Defaults to Default
    Location string
    Specifies the supported Azure location where the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    ManagedNetwork WorkspaceManagedNetwork
    A managed_network block as defined below.
    Name string
    Specifies the name of the Machine Learning Workspace. Changing this forces a new resource to be created.
    PrimaryUserAssignedIdentity string
    The user assigned identity id that represents the workspace identity.
    PublicNetworkAccessEnabled bool

    Enable public access when this Machine Learning Workspace is behind VNet. Defaults to true.

    NOTE: public_access_behind_virtual_network_enabled is deprecated and will be removed in favour of the property public_network_access_enabled.

    ResourceGroupName string
    Specifies the name of the Resource Group in which the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    ServerlessCompute WorkspaceServerlessCompute
    A serverless_compute block as defined below.
    SkuName string
    SKU/edition of the Machine Learning Workspace, possible values are Free, Basic, Standard and Premium. Defaults to Basic.
    StorageAccountId string

    The ID of the Storage Account associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The account_tier cannot be Premium in order to associate the Storage Account to this Machine Learning Workspace.

    Tags Dictionary<string, string>
    A mapping of tags to assign to the resource.
    V1LegacyModeEnabled bool
    Enable V1 API features, enabling v1_legacy_mode may prevent you from using features provided by the v2 API. Defaults to false.
    WorkspaceId string
    The immutable id associated with this workspace.
    ApplicationInsightsId string
    The ID of the Application Insights associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    ContainerRegistryId string

    The ID of the container registry associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The admin_enabled should be true in order to associate the Container Registry to this Machine Learning Workspace.

    Description string
    The description of this Machine Learning Workspace.
    DiscoveryUrl string
    The url for the discovery service to identify regional endpoints for machine learning experimentation services.
    Encryption WorkspaceEncryptionArgs
    An encryption block as defined below. Changing this forces a new resource to be created.
    FeatureStore WorkspaceFeatureStoreArgs
    A feature_store block as defined below.
    FriendlyName string
    Display name for this Machine Learning Workspace.
    HighBusinessImpact bool
    Flag to signal High Business Impact (HBI) data in the workspace and reduce diagnostic data collected by the service. Changing this forces a new resource to be created.
    Identity WorkspaceIdentityArgs
    An identity block as defined below.
    ImageBuildComputeName string
    The compute name for image build of the Machine Learning Workspace.
    KeyVaultId string
    The ID of key vault associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    Kind string
    The type of the Workspace. Possible values are Default, FeatureStore. Defaults to Default
    Location string
    Specifies the supported Azure location where the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    ManagedNetwork WorkspaceManagedNetworkArgs
    A managed_network block as defined below.
    Name string
    Specifies the name of the Machine Learning Workspace. Changing this forces a new resource to be created.
    PrimaryUserAssignedIdentity string
    The user assigned identity id that represents the workspace identity.
    PublicNetworkAccessEnabled bool

    Enable public access when this Machine Learning Workspace is behind VNet. Defaults to true.

    NOTE: public_access_behind_virtual_network_enabled is deprecated and will be removed in favour of the property public_network_access_enabled.

    ResourceGroupName string
    Specifies the name of the Resource Group in which the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    ServerlessCompute WorkspaceServerlessComputeArgs
    A serverless_compute block as defined below.
    SkuName string
    SKU/edition of the Machine Learning Workspace, possible values are Free, Basic, Standard and Premium. Defaults to Basic.
    StorageAccountId string

    The ID of the Storage Account associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The account_tier cannot be Premium in order to associate the Storage Account to this Machine Learning Workspace.

    Tags map[string]string
    A mapping of tags to assign to the resource.
    V1LegacyModeEnabled bool
    Enable V1 API features, enabling v1_legacy_mode may prevent you from using features provided by the v2 API. Defaults to false.
    WorkspaceId string
    The immutable id associated with this workspace.
    applicationInsightsId String
    The ID of the Application Insights associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    containerRegistryId String

    The ID of the container registry associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The admin_enabled should be true in order to associate the Container Registry to this Machine Learning Workspace.

    description String
    The description of this Machine Learning Workspace.
    discoveryUrl String
    The url for the discovery service to identify regional endpoints for machine learning experimentation services.
    encryption WorkspaceEncryption
    An encryption block as defined below. Changing this forces a new resource to be created.
    featureStore WorkspaceFeatureStore
    A feature_store block as defined below.
    friendlyName String
    Display name for this Machine Learning Workspace.
    highBusinessImpact Boolean
    Flag to signal High Business Impact (HBI) data in the workspace and reduce diagnostic data collected by the service. Changing this forces a new resource to be created.
    identity WorkspaceIdentity
    An identity block as defined below.
    imageBuildComputeName String
    The compute name for image build of the Machine Learning Workspace.
    keyVaultId String
    The ID of key vault associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    kind String
    The type of the Workspace. Possible values are Default, FeatureStore. Defaults to Default
    location String
    Specifies the supported Azure location where the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    managedNetwork WorkspaceManagedNetwork
    A managed_network block as defined below.
    name String
    Specifies the name of the Machine Learning Workspace. Changing this forces a new resource to be created.
    primaryUserAssignedIdentity String
    The user assigned identity id that represents the workspace identity.
    publicNetworkAccessEnabled Boolean

    Enable public access when this Machine Learning Workspace is behind VNet. Defaults to true.

    NOTE: public_access_behind_virtual_network_enabled is deprecated and will be removed in favour of the property public_network_access_enabled.

    resourceGroupName String
    Specifies the name of the Resource Group in which the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    serverlessCompute WorkspaceServerlessCompute
    A serverless_compute block as defined below.
    skuName String
    SKU/edition of the Machine Learning Workspace, possible values are Free, Basic, Standard and Premium. Defaults to Basic.
    storageAccountId String

    The ID of the Storage Account associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The account_tier cannot be Premium in order to associate the Storage Account to this Machine Learning Workspace.

    tags Map<String,String>
    A mapping of tags to assign to the resource.
    v1LegacyModeEnabled Boolean
    Enable V1 API features, enabling v1_legacy_mode may prevent you from using features provided by the v2 API. Defaults to false.
    workspaceId String
    The immutable id associated with this workspace.
    applicationInsightsId string
    The ID of the Application Insights associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    containerRegistryId string

    The ID of the container registry associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The admin_enabled should be true in order to associate the Container Registry to this Machine Learning Workspace.

    description string
    The description of this Machine Learning Workspace.
    discoveryUrl string
    The url for the discovery service to identify regional endpoints for machine learning experimentation services.
    encryption WorkspaceEncryption
    An encryption block as defined below. Changing this forces a new resource to be created.
    featureStore WorkspaceFeatureStore
    A feature_store block as defined below.
    friendlyName string
    Display name for this Machine Learning Workspace.
    highBusinessImpact boolean
    Flag to signal High Business Impact (HBI) data in the workspace and reduce diagnostic data collected by the service. Changing this forces a new resource to be created.
    identity WorkspaceIdentity
    An identity block as defined below.
    imageBuildComputeName string
    The compute name for image build of the Machine Learning Workspace.
    keyVaultId string
    The ID of key vault associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    kind string
    The type of the Workspace. Possible values are Default, FeatureStore. Defaults to Default
    location string
    Specifies the supported Azure location where the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    managedNetwork WorkspaceManagedNetwork
    A managed_network block as defined below.
    name string
    Specifies the name of the Machine Learning Workspace. Changing this forces a new resource to be created.
    primaryUserAssignedIdentity string
    The user assigned identity id that represents the workspace identity.
    publicNetworkAccessEnabled boolean

    Enable public access when this Machine Learning Workspace is behind VNet. Defaults to true.

    NOTE: public_access_behind_virtual_network_enabled is deprecated and will be removed in favour of the property public_network_access_enabled.

    resourceGroupName string
    Specifies the name of the Resource Group in which the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    serverlessCompute WorkspaceServerlessCompute
    A serverless_compute block as defined below.
    skuName string
    SKU/edition of the Machine Learning Workspace, possible values are Free, Basic, Standard and Premium. Defaults to Basic.
    storageAccountId string

    The ID of the Storage Account associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The account_tier cannot be Premium in order to associate the Storage Account to this Machine Learning Workspace.

    tags {[key: string]: string}
    A mapping of tags to assign to the resource.
    v1LegacyModeEnabled boolean
    Enable V1 API features, enabling v1_legacy_mode may prevent you from using features provided by the v2 API. Defaults to false.
    workspaceId string
    The immutable id associated with this workspace.
    application_insights_id str
    The ID of the Application Insights associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    container_registry_id str

    The ID of the container registry associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The admin_enabled should be true in order to associate the Container Registry to this Machine Learning Workspace.

    description str
    The description of this Machine Learning Workspace.
    discovery_url str
    The url for the discovery service to identify regional endpoints for machine learning experimentation services.
    encryption WorkspaceEncryptionArgs
    An encryption block as defined below. Changing this forces a new resource to be created.
    feature_store WorkspaceFeatureStoreArgs
    A feature_store block as defined below.
    friendly_name str
    Display name for this Machine Learning Workspace.
    high_business_impact bool
    Flag to signal High Business Impact (HBI) data in the workspace and reduce diagnostic data collected by the service. Changing this forces a new resource to be created.
    identity WorkspaceIdentityArgs
    An identity block as defined below.
    image_build_compute_name str
    The compute name for image build of the Machine Learning Workspace.
    key_vault_id str
    The ID of key vault associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    kind str
    The type of the Workspace. Possible values are Default, FeatureStore. Defaults to Default
    location str
    Specifies the supported Azure location where the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    managed_network WorkspaceManagedNetworkArgs
    A managed_network block as defined below.
    name str
    Specifies the name of the Machine Learning Workspace. Changing this forces a new resource to be created.
    primary_user_assigned_identity str
    The user assigned identity id that represents the workspace identity.
    public_network_access_enabled bool

    Enable public access when this Machine Learning Workspace is behind VNet. Defaults to true.

    NOTE: public_access_behind_virtual_network_enabled is deprecated and will be removed in favour of the property public_network_access_enabled.

    resource_group_name str
    Specifies the name of the Resource Group in which the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    serverless_compute WorkspaceServerlessComputeArgs
    A serverless_compute block as defined below.
    sku_name str
    SKU/edition of the Machine Learning Workspace, possible values are Free, Basic, Standard and Premium. Defaults to Basic.
    storage_account_id str

    The ID of the Storage Account associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The account_tier cannot be Premium in order to associate the Storage Account to this Machine Learning Workspace.

    tags Mapping[str, str]
    A mapping of tags to assign to the resource.
    v1_legacy_mode_enabled bool
    Enable V1 API features, enabling v1_legacy_mode may prevent you from using features provided by the v2 API. Defaults to false.
    workspace_id str
    The immutable id associated with this workspace.
    applicationInsightsId String
    The ID of the Application Insights associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    containerRegistryId String

    The ID of the container registry associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The admin_enabled should be true in order to associate the Container Registry to this Machine Learning Workspace.

    description String
    The description of this Machine Learning Workspace.
    discoveryUrl String
    The url for the discovery service to identify regional endpoints for machine learning experimentation services.
    encryption Property Map
    An encryption block as defined below. Changing this forces a new resource to be created.
    featureStore Property Map
    A feature_store block as defined below.
    friendlyName String
    Display name for this Machine Learning Workspace.
    highBusinessImpact Boolean
    Flag to signal High Business Impact (HBI) data in the workspace and reduce diagnostic data collected by the service. Changing this forces a new resource to be created.
    identity Property Map
    An identity block as defined below.
    imageBuildComputeName String
    The compute name for image build of the Machine Learning Workspace.
    keyVaultId String
    The ID of key vault associated with this Machine Learning Workspace. Changing this forces a new resource to be created.
    kind String
    The type of the Workspace. Possible values are Default, FeatureStore. Defaults to Default
    location String
    Specifies the supported Azure location where the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    managedNetwork Property Map
    A managed_network block as defined below.
    name String
    Specifies the name of the Machine Learning Workspace. Changing this forces a new resource to be created.
    primaryUserAssignedIdentity String
    The user assigned identity id that represents the workspace identity.
    publicNetworkAccessEnabled Boolean

    Enable public access when this Machine Learning Workspace is behind VNet. Defaults to true.

    NOTE: public_access_behind_virtual_network_enabled is deprecated and will be removed in favour of the property public_network_access_enabled.

    resourceGroupName String
    Specifies the name of the Resource Group in which the Machine Learning Workspace should exist. Changing this forces a new resource to be created.
    serverlessCompute Property Map
    A serverless_compute block as defined below.
    skuName String
    SKU/edition of the Machine Learning Workspace, possible values are Free, Basic, Standard and Premium. Defaults to Basic.
    storageAccountId String

    The ID of the Storage Account associated with this Machine Learning Workspace. Changing this forces a new resource to be created.

    NOTE: The account_tier cannot be Premium in order to associate the Storage Account to this Machine Learning Workspace.

    tags Map<String>
    A mapping of tags to assign to the resource.
    v1LegacyModeEnabled Boolean
    Enable V1 API features, enabling v1_legacy_mode may prevent you from using features provided by the v2 API. Defaults to false.
    workspaceId String
    The immutable id associated with this workspace.

    Supporting Types

    WorkspaceEncryption, WorkspaceEncryptionArgs

    KeyId string
    The Key Vault URI to access the encryption key.
    KeyVaultId string
    The ID of the keyVault where the customer owned encryption key is present.
    UserAssignedIdentityId string

    The Key Vault URI to access the encryption key.

    Note: user_assigned_identity_id must set whenidentity.type is UserAssigned or service won't be able to find the assigned permissions.

    KeyId string
    The Key Vault URI to access the encryption key.
    KeyVaultId string
    The ID of the keyVault where the customer owned encryption key is present.
    UserAssignedIdentityId string

    The Key Vault URI to access the encryption key.

    Note: user_assigned_identity_id must set whenidentity.type is UserAssigned or service won't be able to find the assigned permissions.

    keyId String
    The Key Vault URI to access the encryption key.
    keyVaultId String
    The ID of the keyVault where the customer owned encryption key is present.
    userAssignedIdentityId String

    The Key Vault URI to access the encryption key.

    Note: user_assigned_identity_id must set whenidentity.type is UserAssigned or service won't be able to find the assigned permissions.

    keyId string
    The Key Vault URI to access the encryption key.
    keyVaultId string
    The ID of the keyVault where the customer owned encryption key is present.
    userAssignedIdentityId string

    The Key Vault URI to access the encryption key.

    Note: user_assigned_identity_id must set whenidentity.type is UserAssigned or service won't be able to find the assigned permissions.

    key_id str
    The Key Vault URI to access the encryption key.
    key_vault_id str
    The ID of the keyVault where the customer owned encryption key is present.
    user_assigned_identity_id str

    The Key Vault URI to access the encryption key.

    Note: user_assigned_identity_id must set whenidentity.type is UserAssigned or service won't be able to find the assigned permissions.

    keyId String
    The Key Vault URI to access the encryption key.
    keyVaultId String
    The ID of the keyVault where the customer owned encryption key is present.
    userAssignedIdentityId String

    The Key Vault URI to access the encryption key.

    Note: user_assigned_identity_id must set whenidentity.type is UserAssigned or service won't be able to find the assigned permissions.

    WorkspaceFeatureStore, WorkspaceFeatureStoreArgs

    ComputerSparkRuntimeVersion string
    The version of Spark runtime.
    OfflineConnectionName string
    The name of offline store connection.
    OnlineConnectionName string

    The name of online store connection.

    Note: feature_store must be set whenkind is FeatureStore

    ComputerSparkRuntimeVersion string
    The version of Spark runtime.
    OfflineConnectionName string
    The name of offline store connection.
    OnlineConnectionName string

    The name of online store connection.

    Note: feature_store must be set whenkind is FeatureStore

    computerSparkRuntimeVersion String
    The version of Spark runtime.
    offlineConnectionName String
    The name of offline store connection.
    onlineConnectionName String

    The name of online store connection.

    Note: feature_store must be set whenkind is FeatureStore

    computerSparkRuntimeVersion string
    The version of Spark runtime.
    offlineConnectionName string
    The name of offline store connection.
    onlineConnectionName string

    The name of online store connection.

    Note: feature_store must be set whenkind is FeatureStore

    computer_spark_runtime_version str
    The version of Spark runtime.
    offline_connection_name str
    The name of offline store connection.
    online_connection_name str

    The name of online store connection.

    Note: feature_store must be set whenkind is FeatureStore

    computerSparkRuntimeVersion String
    The version of Spark runtime.
    offlineConnectionName String
    The name of offline store connection.
    onlineConnectionName String

    The name of online store connection.

    Note: feature_store must be set whenkind is FeatureStore

    WorkspaceIdentity, WorkspaceIdentityArgs

    Type string
    Specifies the type of Managed Service Identity that should be configured on this Machine Learning Workspace. Possible values are SystemAssigned, UserAssigned, SystemAssigned, UserAssigned (to enable both).
    IdentityIds List<string>

    Specifies a list of User Assigned Managed Identity IDs to be assigned to this Machine Learning Workspace.

    NOTE: This is required when type is set to UserAssigned or SystemAssigned, UserAssigned.

    PrincipalId string
    The Principal ID associated with this Managed Service Identity.
    TenantId string
    The Tenant ID associated with this Managed Service Identity.
    Type string
    Specifies the type of Managed Service Identity that should be configured on this Machine Learning Workspace. Possible values are SystemAssigned, UserAssigned, SystemAssigned, UserAssigned (to enable both).
    IdentityIds []string

    Specifies a list of User Assigned Managed Identity IDs to be assigned to this Machine Learning Workspace.

    NOTE: This is required when type is set to UserAssigned or SystemAssigned, UserAssigned.

    PrincipalId string
    The Principal ID associated with this Managed Service Identity.
    TenantId string
    The Tenant ID associated with this Managed Service Identity.
    type String
    Specifies the type of Managed Service Identity that should be configured on this Machine Learning Workspace. Possible values are SystemAssigned, UserAssigned, SystemAssigned, UserAssigned (to enable both).
    identityIds List<String>

    Specifies a list of User Assigned Managed Identity IDs to be assigned to this Machine Learning Workspace.

    NOTE: This is required when type is set to UserAssigned or SystemAssigned, UserAssigned.

    principalId String
    The Principal ID associated with this Managed Service Identity.
    tenantId String
    The Tenant ID associated with this Managed Service Identity.
    type string
    Specifies the type of Managed Service Identity that should be configured on this Machine Learning Workspace. Possible values are SystemAssigned, UserAssigned, SystemAssigned, UserAssigned (to enable both).
    identityIds string[]

    Specifies a list of User Assigned Managed Identity IDs to be assigned to this Machine Learning Workspace.

    NOTE: This is required when type is set to UserAssigned or SystemAssigned, UserAssigned.

    principalId string
    The Principal ID associated with this Managed Service Identity.
    tenantId string
    The Tenant ID associated with this Managed Service Identity.
    type str
    Specifies the type of Managed Service Identity that should be configured on this Machine Learning Workspace. Possible values are SystemAssigned, UserAssigned, SystemAssigned, UserAssigned (to enable both).
    identity_ids Sequence[str]

    Specifies a list of User Assigned Managed Identity IDs to be assigned to this Machine Learning Workspace.

    NOTE: This is required when type is set to UserAssigned or SystemAssigned, UserAssigned.

    principal_id str
    The Principal ID associated with this Managed Service Identity.
    tenant_id str
    The Tenant ID associated with this Managed Service Identity.
    type String
    Specifies the type of Managed Service Identity that should be configured on this Machine Learning Workspace. Possible values are SystemAssigned, UserAssigned, SystemAssigned, UserAssigned (to enable both).
    identityIds List<String>

    Specifies a list of User Assigned Managed Identity IDs to be assigned to this Machine Learning Workspace.

    NOTE: This is required when type is set to UserAssigned or SystemAssigned, UserAssigned.

    principalId String
    The Principal ID associated with this Managed Service Identity.
    tenantId String
    The Tenant ID associated with this Managed Service Identity.

    WorkspaceManagedNetwork, WorkspaceManagedNetworkArgs

    IsolationMode string
    The isolation mode of the Machine Learning Workspace. Possible values are Disabled, AllowOnlyApprovedOutbound, and AllowInternetOutbound
    IsolationMode string
    The isolation mode of the Machine Learning Workspace. Possible values are Disabled, AllowOnlyApprovedOutbound, and AllowInternetOutbound
    isolationMode String
    The isolation mode of the Machine Learning Workspace. Possible values are Disabled, AllowOnlyApprovedOutbound, and AllowInternetOutbound
    isolationMode string
    The isolation mode of the Machine Learning Workspace. Possible values are Disabled, AllowOnlyApprovedOutbound, and AllowInternetOutbound
    isolation_mode str
    The isolation mode of the Machine Learning Workspace. Possible values are Disabled, AllowOnlyApprovedOutbound, and AllowInternetOutbound
    isolationMode String
    The isolation mode of the Machine Learning Workspace. Possible values are Disabled, AllowOnlyApprovedOutbound, and AllowInternetOutbound

    WorkspaceServerlessCompute, WorkspaceServerlessComputeArgs

    PublicIpEnabled bool

    Should serverless compute nodes deployed in a custom Virtual Network have public IP addresses enabled for a workspace with private endpoint? Defaults to false.

    Note: public_ip_enabled cannot be updated from true to false when subnet_id is not set. public_ip_enabled must be set to true if subnet_id is not set and when public_network_access_enabled is false.

    SubnetId string
    The ID of an existing Virtual Network Subnet in which the serverless compute nodes should be deployed to.
    PublicIpEnabled bool

    Should serverless compute nodes deployed in a custom Virtual Network have public IP addresses enabled for a workspace with private endpoint? Defaults to false.

    Note: public_ip_enabled cannot be updated from true to false when subnet_id is not set. public_ip_enabled must be set to true if subnet_id is not set and when public_network_access_enabled is false.

    SubnetId string
    The ID of an existing Virtual Network Subnet in which the serverless compute nodes should be deployed to.
    publicIpEnabled Boolean

    Should serverless compute nodes deployed in a custom Virtual Network have public IP addresses enabled for a workspace with private endpoint? Defaults to false.

    Note: public_ip_enabled cannot be updated from true to false when subnet_id is not set. public_ip_enabled must be set to true if subnet_id is not set and when public_network_access_enabled is false.

    subnetId String
    The ID of an existing Virtual Network Subnet in which the serverless compute nodes should be deployed to.
    publicIpEnabled boolean

    Should serverless compute nodes deployed in a custom Virtual Network have public IP addresses enabled for a workspace with private endpoint? Defaults to false.

    Note: public_ip_enabled cannot be updated from true to false when subnet_id is not set. public_ip_enabled must be set to true if subnet_id is not set and when public_network_access_enabled is false.

    subnetId string
    The ID of an existing Virtual Network Subnet in which the serverless compute nodes should be deployed to.
    public_ip_enabled bool

    Should serverless compute nodes deployed in a custom Virtual Network have public IP addresses enabled for a workspace with private endpoint? Defaults to false.

    Note: public_ip_enabled cannot be updated from true to false when subnet_id is not set. public_ip_enabled must be set to true if subnet_id is not set and when public_network_access_enabled is false.

    subnet_id str
    The ID of an existing Virtual Network Subnet in which the serverless compute nodes should be deployed to.
    publicIpEnabled Boolean

    Should serverless compute nodes deployed in a custom Virtual Network have public IP addresses enabled for a workspace with private endpoint? Defaults to false.

    Note: public_ip_enabled cannot be updated from true to false when subnet_id is not set. public_ip_enabled must be set to true if subnet_id is not set and when public_network_access_enabled is false.

    subnetId String
    The ID of an existing Virtual Network Subnet in which the serverless compute nodes should be deployed to.

    Import

    Machine Learning Workspace can be imported using the resource id, e.g.

    $ pulumi import azure:machinelearning/workspace:Workspace example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.MachineLearningServices/workspaces/workspace1

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Azure Classic pulumi/pulumi-azure
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the azurerm Terraform Provider.
    azure logo

    We recommend using Azure Native.

    Azure v6.21.0 published on Friday, Mar 7, 2025 by Pulumi
    pulumi/pulumi-azure