Design and Prepare a Machine Learning Solution
Workspace anatomy
An Azure Machine Learning workspace is the top-level container. Creating one provisions (or attaches) an Azure Storage account - registered as the default datastore workspaceblobstore - a Key Vault that holds datastore secrets, Application Insights for monitoring, and an Azure Container Registry for environment images. Keep all dependencies in the same region as the workspace; a common trap is assuming data moves with the workspace. Workspace metadata lives in the workspace region, but your data stays in its storage account's region.
Data: datastores vs. data assets
A datastore is a saved connection (Blob, ADLS Gen2, SQL) whose credentials live in Key Vault. A data asset is a versioned pointer to a path, typed as uri_file, uri_folder, or mltable. Reference data assets in jobs rather than hardcoded URLs, because assets version, are lineage-tracked, and resolve inside jobs.
Compute and environments
Pick compute by purpose: a compute instance for interactive authoring only; a compute cluster for training and batch scoring (scales to zero, supports low-priority nodes); managed online endpoints or attached Kubernetes for inference. Capture dependencies in an environment (base image plus conda/Dockerfile) instead of pip install in scripts. Prefer workspace or compute managed identity for storage access over account keys.
Security and governance
Use RBAC (Owner, Contributor, Azure ML Data Scientist, Reader), private endpoints plus a VNet when public egress is forbidden, and diagnostic settings to Log Analytics.
Rule of thumb
Match cost to cadence: a nightly two-hour training job needs a cluster with min_instances=0 and low-priority nodes - never a compute instance left running. Reserve instances for interactive work only.