AI-300 · Domain 1 of 5

AI-300 Domain 1: Design and implement an MLOps infrastructure

Building the Azure Machine Learning foundation for MLOps: workspaces, datastores, compute targets and access control, versioned data assets, environments and components, registries, and infrastructure as code with Bicep, Azure CLI, GitHub Actions and Git.

Exam weight
15–20%
Official functional groups
3
Estimated questions estimate
~9
Suggested study time estimate
12–16 hrs

About 13 min read Reviewed October 2026

Overview

Domain 1 covers the platform that every later MLOps task depends on. Microsoft lists three functional groups. The first is about the Azure Machine Learning workspace itself: creating it, connecting datastores, choosing compute targets and granting access with Azure RBAC and managed identities. The second covers the reusable assets inside a workspace, namely data assets, environments and components, plus registries that let those assets move between development, test and production workspaces.

The third group is infrastructure as code. You are expected to deploy workspaces with Bicep and the Azure CLI ml extension, run that provisioning from GitHub Actions, connect GitHub to Azure without storing long-lived secrets, lock down network access with managed virtual networks or private endpoints, and keep training code under Git. AI-300 is an operations exam, so questions favour repeatable, automated and least-privilege answers over portal clicks.

How it's tested

Questions in this area usually describe a team, several environments and a constraint such as no stored secrets, no public endpoints or shared assets across regions. You then pick the workspace resource, identity setting, asset type or automation method that meets the constraint with the least manual effort and the narrowest permissions.

  • Pick the compute target

    A workload such as interactive notebooks, scheduled training or bursty jobs is described, and you choose a compute instance, cluster, serverless compute or attached Kubernetes.

  • Secure the pipeline

    A GitHub workflow must deploy Azure resources, and you choose federated OIDC credentials, a service principal secret or a managed identity.

  • Share without copying

    Models, environments or components built in one workspace must be reused elsewhere, and you decide between registries, exports or duplicate registration.

Reasoning it through

A team retrains a model nightly in a dev workspace and must promote the same environment and component versions to a production workspace in another region. Copying files or rebuilding the environment risks drift between stages. Publishing the environment and component to an Azure Machine Learning registry gives both workspaces one versioned source, so the correct answer is the registry rather than export and re-import.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

1.1 Create and manage resources in a Machine Learning workspaceWorkspaces, datastores, compute targets and workspace access control.
What it means
This group covers standing up an Azure Machine Learning workspace and its dependent resources (storage account, key vault, container registry and Application Insights), registering datastores that point at Blob Storage, Data Lake Storage Gen2 or Azure Files, creating compute, and granting people and services the right roles.
What to understand
Know the compute choices: a compute instance is a single managed VM for development; a compute cluster autoscales between a minimum and maximum node count and should use a minimum of zero to avoid idle cost; serverless compute removes cluster management for jobs; attached Kubernetes suits existing AKS or Arc clusters. Datastores can use credential-based access or identity-based access, where the job identity or user identity reads the data. Built-in roles such as AzureML Data Scientist and AzureML Compute Operator give narrower access than Contributor.
How it shows up
Expect choices between compute types driven by cost or workload, and between credential-based and identity-based datastore access when secrets must be avoided.
Common confusion
A compute instance is not a shared training cluster, and a datastore holds connection information only, not a copy of the data.
1.2 Create and manage assets in a Machine Learning workspaceData assets, environments, components and cross-workspace registries.
What it means
Assets are the versioned building blocks of MLOps. Data assets reference data as uri_file, uri_folder or mltable. Environments define the Docker image and Conda or pip dependencies a job runs in. Components package a step with typed inputs and outputs for reuse in pipelines. Registries hold these assets outside any single workspace.
What to understand
Every asset has a name and version, and pinning versions is how you make runs reproducible. Curated environments are Microsoft-maintained; custom environments are built from a base image plus a Conda file and are cached after the first build. Components are usually defined in YAML and loaded with the CLI or SDK v2. Azure Machine Learning registries can replicate to several regions and let workspaces in different subscriptions consume the same model, environment, component or data version, which supports a dev-test-prod promotion flow.
How it shows up
Look for wording such as reuse across workspaces, promote between environments or reproduce exactly. Those phrases point to versioned assets and registries.
Common confusion
Registering a data asset does not move or duplicate the underlying files; it records a reference and a version.
1.3 Implement IaC for Machine LearningBicep, Azure CLI, GitHub Actions, network isolation and Git for ML projects.
What it means
This group is about deploying and changing the ML platform through code. It includes connecting GitHub to Azure securely, writing Bicep or CLI scripts for workspaces and compute, running them from GitHub Actions workflows, restricting network access to the workspace and versioning project code in Git.
What to understand
The preferred GitHub connection uses OpenID Connect with a federated identity credential on a Microsoft Entra app registration or user-assigned managed identity, so the workflow requests short-lived tokens through azure/login and no client secret is stored. Bicep deploys Microsoft.MachineLearningServices resources declaratively and is idempotent; az ml commands create jobs, environments and endpoints from YAML. Network isolation options include a managed virtual network with internet outbound allowed or only approved outbound, private endpoints for the workspace and dependencies, and disabling public network access. Jobs record the Git commit they ran from.
How it shows up
Expect questions asking how to remove stored secrets from a workflow, or how to block public access while keeping compute able to reach required services.
Common confusion
Disabling public network access on the workspace does not by itself isolate the storage account, key vault or container registry behind it.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Azure Machine Learning workspace

    Top-level resource that groups jobs, assets, compute and endpoints.

    Remember
    Creates or links a storage account, key vault, container registry and Application Insights.
    Tested as
    Scenario answers often start from what the workspace already provides.
    Trap
    Assuming the container registry is always created up front; it can be created when the first image builds.

  • Compute cluster

    Autoscaling pool of VMs for training and batch jobs.

    Remember
    Set minimum nodes to 0 so idle clusters cost nothing.
    Tested as
    Cost-control questions hinge on min and max node settings.
    Trap
    Using a compute instance for scheduled production training.

  • Serverless compute

    Job compute that Azure Machine Learning provisions and removes for you.

    Remember
    No cluster to create or scale; you specify instance type and count on the job.
    Tested as
    Appears when a scenario wants training without managing compute.
    Trap
    Thinking serverless compute is limited to inference.

  • Identity-based datastore access

    Data access using the user or compute identity instead of stored keys or SAS.

    Remember
    Requires RBAC data roles such as Storage Blob Data Reader on the storage account.
    Tested as
    The usual answer when a scenario forbids stored credentials.
    Trap
    Granting only workspace roles and forgetting the storage data-plane role.

  • Environment

    Versioned Docker image plus Python dependencies for jobs and deployments.

    Remember
    Curated environments are maintained by Microsoft; custom ones come from a base image and Conda file.
    Tested as
    Reproducibility and dependency-drift questions point here.
    Trap
    Installing packages inside the training script rather than pinning them in the environment.

  • Component

    Self-contained, reusable pipeline step with typed inputs and outputs.

    Remember
    Defined in YAML and versioned like other assets.
    Tested as
    Pipeline reuse and team sharing questions.
    Trap
    Confusing a component with a whole pipeline job.

  • Registry

    Cross-workspace, multi-region store for models, environments, components and data.

    Remember
    Lets dev, test and prod workspaces consume the same asset version.
    Tested as
    The answer to promote or share across workspaces.
    Trap
    Choosing to download and re-register assets in each workspace.

  • OIDC federated credential

    Trust between GitHub and a Microsoft Entra identity for token exchange.

    Remember
    No client secret is stored in GitHub; scope the subject to branch, environment or tag.
    Tested as
    Appears when a workflow must authenticate without secrets.
    Trap
    Picking a service principal secret stored as a repository secret.

  • Managed virtual network

    Workspace-managed network isolation for compute and serverless jobs.

    Remember
    Modes are allow internet outbound and allow only approved outbound.
    Tested as
    Data exfiltration and egress control questions.
    Trap
    Assuming private endpoints alone restrict outbound traffic.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Compute targets in Azure Machine Learning

ConceptMeaningKey differenceCommon trap
Compute instance Single managed VM for notebooks and development. Assigned to one user; not autoscaling. Using it as shared production training compute.
Compute cluster Autoscaling multi-node pool for jobs. Scales between min and max nodes; supports low-priority VMs. Leaving minimum nodes above zero and paying for idle VMs.
Serverless compute On-demand job compute with no cluster object. Nothing to create or scale; billed per job. Believing it cannot run distributed training.
Attached Kubernetes Existing AKS or Arc-enabled cluster attached for training or inference. You manage the cluster; Azure ML runs workloads on it. Choosing it when no Kubernetes estate exists.

GitHub to Azure authentication

ConceptMeaningKey differenceCommon trap
OIDC federated credential Short-lived token exchange based on a trust policy. No stored secret; trust scoped to repo and branch or environment. Forgetting the subject claim must match the workflow trigger.
Service principal with client secret Secret stored as a GitHub secret. Works but must be rotated and can leak. Treating it as the most secure option because it is common.
Managed identity on a self-hosted runner Runner VM uses its own Azure identity. Only applies when the runner runs in Azure. Selecting it for GitHub-hosted runners.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Compute instance for production retraining

    What candidates pick
    A compute instance with a schedule
    Why it looks right
    It is familiar from notebook work and supports schedules.
    Why it's wrong
    A compute instance is a single-user development VM; scheduled multi-run training belongs on a cluster or serverless compute.

    Clue to watch for Words such as nightly retraining, several jobs or scale out.

  2. Workspace role grants data access

    What candidates pick
    AzureML Data Scientist alone for identity-based datastores
    Why it looks right
    The role covers most workspace actions.
    Why it's wrong
    Identity-based access checks storage data-plane permissions, so the identity also needs a Storage Blob Data role on the account.

    Clue to watch for The scenario mentions identity-based access or removing account keys.

  3. Export and import across workspaces

    What candidates pick
    Download the model and register it again in production
    Why it looks right
    It looks simple and needs no new resource.
    Why it's wrong
    Manual copies break lineage and version alignment; registries share the same versioned asset across workspaces and regions.

    Clue to watch for Phrases like promote, multiple workspaces or regions, and reproducibility.

  4. Private endpoint equals full isolation

    What candidates pick
    Add a workspace private endpoint and stop
    Why it looks right
    Private endpoints are the best-known isolation feature.
    Why it's wrong
    Dependent resources and compute egress also need controls such as their own private endpoints or a managed virtual network.

    Clue to watch for Requirements about data exfiltration or outbound traffic.

  5. Secret-based GitHub login

    What candidates pick
    Store client ID and secret as GitHub secrets
    Why it looks right
    Many older tutorials show this pattern.
    Why it's wrong
    Federated OIDC credentials avoid long-lived secrets and are the stated secure option for GitHub integration.

    Clue to watch for The question says no stored credentials or minimise secret rotation.

Answer framework

Use these steps when a scenario asks you to set up or secure the Azure Machine Learning platform.

  1. Identify who or what needs access, such as people, compute or a GitHub workflow, and pick the narrowest built-in role at the right scope.
  2. Match compute to the workload: development on an instance, repeatable jobs on a cluster or serverless compute, existing Kubernetes only when it already exists.
  3. Decide how data is reached, preferring identity-based datastores with storage data roles over account keys or SAS tokens.
  4. Package anything reused as a versioned asset and publish it to a registry when more than one workspace or region consumes it.
  5. Express the setup in Bicep or CLI YAML, run it from GitHub Actions with OIDC, and add private networking for every dependent resource.

Practice question

Your team deploys Azure Machine Learning workspaces from a GitHub Actions workflow. Security policy forbids storing any client secrets in GitHub, and deployments must only run from the main branch. What should you configure?

Want more like this? The AI-300 practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with a hands-on build rather than reading. Create a workspace with the Azure CLI ml extension, add an identity-based datastore, a compute cluster with a minimum of zero nodes and a custom environment, then run one command job from YAML. Repeat the setup in Bicep so you see how each resource type and dependency is declared, and note which parts the portal hides from you.

Next, move the same deployment into a GitHub Actions workflow. Configure a federated identity credential, sign in with azure/login, and deploy to a second workspace. Publish your environment and a component to a registry, then consume them from both workspaces to understand promotion. Finish with network isolation: enable a managed virtual network, test the allow only approved outbound mode, and check what breaks when public access is disabled. Keep a one-page table of compute types, built-in roles and isolation options, because AI-300 questions in this domain mostly ask you to choose between close alternatives. Revisit this domain after Domain 3, since Foundry infrastructure uses similar identity and networking ideas.

FAQ

How much of AI-300 is Domain 1, Design and implement an MLOps infrastructure?

Microsoft weights Design and implement an MLOps infrastructure at 15–20% of the exam. With roughly 50 scored items assumed, that is about 8 to 10 questions, though Microsoft does not publish a total question count.

Is AI-300 the replacement for DP-100?

Yes. DP-100 and the Azure Data Scientist Associate certification retired on 1 June 2026, and AI-300 leads to the Microsoft Certified: Machine Learning Operations Engineer Associate certification.

Do I need to write Bicep from scratch?

You should read and adjust Bicep confidently. The study guide names deploying workspaces and resources with Bicep and Azure CLI, so know resource types, parameters and how a deployment is run.

Which Azure ML SDK or CLI version matters?

Focus on the Azure CLI ml extension and the Python SDK v2, which use YAML definitions for jobs, environments, components and endpoints. The older v1 SDK is not the basis of current documentation.

What is the difference between a datastore and a data asset?

A datastore stores connection details to a storage service. A data asset is a versioned reference to specific files, folders or a table within that storage.

Why are registries emphasised?

They give several workspaces, even across regions and subscriptions, one versioned copy of models, environments, components and data. That supports promotion from development to production without manual copying.

Other Artificial Intelligence & Machine Learning certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

Check whether you can pick the right compute, identity and network setting for an Azure Machine Learning platform before moving on to training and deployment.

Take the AI-300 practice test Check your AI-300 readiness

Keep going