Worskspace diagnostics is showing Error

Set the workspace’s image_build_compute to the existing aml-test AmlCompute cluster, and separately restore outbound TCP 443 connectivity to management.azure.com; these are two distinct failures.

1. Correct the image-build compute setting

ACR-TASKS-FALLBACK is not an AmlCompute target, so it cannot be used for image_build_compute. In network-isolated configurations, Azure Machine Learning supports assigning an AML compute cluster for environment image builds.^1^

Run this only after the connectivity correction in the next section, because both workspaces.get() and begin_update() call Azure Resource Manager:

from azure.ai.ml import MLClient
from azure.identity import DefaultAzureCredential

ml_client = MLClient(
    DefaultAzureCredential(),
    subscription_id="<subscription-id>",
    resource_group_name="<resource-group>",
    workspace_name="<workspace-name>",
)

ws = ml_client.workspaces.get("<workspace-name>")
ws.image_build_compute = "aml-test"
ml_client.workspaces.begin_update(ws).result()
print("Image-build compute:", ws.image_build_compute)

The expected result is that workspace diagnostics no longer reports ImageBuildComputeNotValid. The aml-test cluster must also be able to reach the container registry and any package repositories required by the image build.^2^

Do not switch back to serverless/ACR-based image building unless the registry is not network-restricted. When both Azure Machine Learning and ACR use private endpoints, Container Registry Tasks cannot build the images; an AML compute cluster must be specified.^3^

2. Restore the Azure Resource Manager network path

[Errno 101] Network is unreachable occurs before an HTTP response or AML authorization check. The execution environment has no usable route to management.azure.com:443. That is why workspace lookup, compute lookup, and the connector fail at the same point.

From the same machine, compute instance, or container running the SDK, test DNS and routing:

getent hosts management.azure.com
curl -Iv --connect-timeout 10 https://management.azure.com/
ip route

A response such as HTTP 401, 403, or another HTTP status proves that the HTTPS route exists; Network is unreachable, No route to host, or a timeout remains a network-path problem.

For a BYO VNet/firewall configuration, allow the documented outbound service tags and ports:

• AzureResourceManager — TCP 443
• AzureActiveDirectory — TCP 80 and 443
• AzureMachineLearning — TCP 443 and 18881, plus UDP 5831
• BatchNodeManagement.<region> — TCP 443
• Storage.<region> — TCP 443
• MicrosoftContainerRegistry and AzureFrontDoor.FirstParty — TCP 443
• AzureContainerRegistry.<region> — TCP 443 when environment images come from ACR

Azure Machine Learning documents AzureResourceManager:443 specifically for resource creation and SDK/CLI control-plane operations.^4^

If the compute has no public IP, provide supported outbound routing through either:

• Azure NAT Gateway, or
• A 0.0.0.0/0 user-defined route whose next hop is an Azure Firewall/NVA that permits the required destinations.

Do not rely on Azure default outbound access for this configuration.^4^

If the workspace intentionally has public network access disabled, run the SDK from a network connected to its private endpoint. Also verify that custom DNS/private DNS zone links resolve workspace private endpoint names to private IP addresses. Do not enable public access merely as a workaround without security approval.^2^

3. Retest with the correct exception handling

ServiceRequestError is a transport exception, not an HttpResponseError. Catch them separately:

from azure.core.exceptions import HttpResponseError, ServiceRequestError

try:
    compute = ml_client.compute.get("aml-test")
    print(compute.name, compute.type)
except ServiceRequestError as error:
    print("Network/transport failure:", error)
except HttpResponseError as error:
    print("Azure API response failure:", error)

After the network path is restored, this should either return aml-test or produce an HTTP/API error that can be investigated separately for RBAC or resource configuration.

For the UAIS ad-hoc connector, retest after ARM connectivity succeeds. If it then fails against a different host, its required endpoints are connector-specific and are not established by the Azure Machine Learning documentation here; capture that destination hostname and have the network team allow it according to the UAIS SDK requirements.

References

1. Imports Azure Machine Learning client and Azure Identity credential classes, then creates an MLClient instance authenticated with DefaultAzureCredential to inte...
2. Secure an Azure Machine Learning workspace by using virtual networks
3. Manage Azure Machine Learning workspaces by using Azure CLI
4. Configure inbound and outbound network traffic