Azure Devops Service Principal with Azure Machine Learning Workspace

Question

I have an Azure Devops Pipeline which runs a script that creates and runs an experiment in an Azure Machine Learning Studio workspace.

Msft Documentation suggests using Service Principal Authentication for this type of workflow:

1. https://learn.microsoft.com/en-us/azure/machine-learning/how-to-devops-machine-learning

2. https://github.com/Azure/MachineLearningNotebooks/blob/master/how-to-use-azureml/manage-azureml-service/authentication-in-azureml/authentication-in-azureml.ipynb

However, I cannot get it to work by using the Service Principal setup automatically from Devops. Ie, the one setup as such:

When I run my script, the Authentication fails (as it defaults to Interactive Authentication)

ws = Workspace.from_config(path='./config.json')

Documentation for Workspace suggests creating a ServicePrincipalAuthentication

svc_pr = ServicePrincipalAuthentication(
    tenant_id="xxx",  
    service_principal_id="xxx",
    service_principal_password="xxx")

ws = Workspace.from_config(path='./config.json', auth=svc_pr)

While the second approach works, it defeats the purpose as I have to manually create a service-connection and a secret, then pass that into the ServicePrincipalObject via a build variable in the pipeline. Is there a way for my script to do the ServicePrincipalAuthentication without me having to create an ServicePrincipalAuthentication object?

If not, what is the point of even having the Machine Learning Workspace as an option for creating an Azure Service Connection?

Answer 1

By default it uses the interactive authentication, In your script you can use the Service principal authentication as given below in the sample using Azure CLI.

https://github.com/Azure/mlops-v2/blob/main/documentation/deployguides/deployguide_ado.md