Why?
Standard landing zones often fall short for AI. Workloads need GPU-heavy compute, tight data controls, private model access, and rapid experimentation without opening security holes. A purpose-built pattern keeps the guardrails in place while giving data scientists the room they need.
What?
We use a hub-spoke topology with a dedicated AI spoke. The hub handles shared connectivity and identity. The AI spoke contains an Azure Machine Learning workspace, private endpoints, a managed virtual network, and a short list of supporting resources. Everything stays inside private networks and uses managed identities.
How?
Step 1: Build the hub and AI spoke network
Create the hub VNet with Azure Firewall and a separate spoke VNet for AI. Peer them and disable gateway transit on the AI side. Add a subnet for the ML workspace and one for compute clusters.
az network vnet create -g ai-lz-rg -n ai-spoke-vnet --address-prefix 10.1.0.0/16
az network vnet subnet create -g ai-lz-rg --vnet-name ai-spoke-vnet -n ml-subnet --address-prefixes 10.1.1.0/24
[screenshot: hub-and-spoke diagram showing the AI spoke with ml-subnet and private-endpoint-subnet]
Step 2: Deploy the Azure ML workspace with private endpoints
Provision the workspace inside the AI spoke and force private link for the workspace, ACR, and storage accounts. Use a user-assigned managed identity for the workspace.
az ml workspace create -n ai-ws -g ai-lz-rg --location westeurope --vnet ai-spoke-vnet --subnet ml-subnet --private-link
[screenshot: Azure portal view of the ML workspace with private endpoint connections listed]
Step 3: Attach compute and secure data access
Create an AKS or AML compute cluster on the managed VNet. Attach an Azure Files or Blob store via private endpoint and grant the workspace identity reader access only.
az ml compute create -n gpu-cluster --type amlcompute --min-instances 0 --max-instances 4 --size Standard_NC6s_v3
[screenshot: AML compute instance page showing the cluster attached to the managed VNet]
Step 4: Add monitoring and policy guardrails
Enable diagnostic settings to Log Analytics and attach the built-in Azure Policy set for Machine Learning. Turn on Defender for Cloud AI workload protections.
[screenshot: Azure Monitor workbook showing AML job metrics and security alerts]
That’s the core pattern. Tweak the sizes and regions to match your estate, then layer on model registry and feature store when you’re ready.