Create a Hub in AI Studio

To create a new hub, you need either the Owner or Contributor role on the resource group or an existing hub. If you lack the necessary permissions, contact your administrator. If your organization uses Azure Policy, create the hub in the Azure portal instead.

Steps to Create a Hub in AI Studio:

1. Go to the Home page in Azure AI Studio and sign in with your Azure account.
2. Select “All hubs” from the left pane and then click “+ New hub.”
3. In the “Create a new hub” dialog, enter a name for your hub (e.g., contoso-hub) and click “Next.” Ensure the default option “Connect Azure AI Services” is selected to establish a new AI services connection for the hub.
4. Review the information and click “Create.”
5. You can monitor the progress of hub creation in the wizard.

Create a Secure Hub in the Azure Portal

If your organization is using Azure Policy, set up a hub that aligns with your organization’s requirements through the Azure portal.

Steps to Create a Hub in the Azure Portal:

1. From the Azure portal, search for Azure AI Studio and create a new hub by selecting “+ New Azure AI hub.”
2. Enter details such as hub name, subscription, resource group, and location.
3. For Azure AI services base models, select an existing AI services resource or create a new one. Azure AI services include multiple API endpoints for Speech, Content Safety, and Azure OpenAI.
4. Go to the Storage tab to configure storage account settings.
5. Go to the Networking tab to set up network isolation. For more details on network isolation, refer to Managed virtual network isolation. For a walkthrough of creating a secure hub, see Create a secure hub.
6. Go to the Encryption tab to configure data encryption. You can choose between Microsoft-managed keys or Customer-managed keys.
7. Go to the Identity tab. By default, System-assigned identity is enabled, but you can switch to User-assigned identity if needed for existing storage, key vault, and container registry.

   Note: If using User-assigned identity, ensure it has the Cognitive Services Contributor role to create the hub successfully.

8. Go to the Tags tab to add any necessary tags.
9. Click “Review + create” and then “Create.”

Manage Your Hub from the Azure Portal

Manage Access Control

Manage role assignments from Access control (IAM) within the Azure portal. Learn more about hub role-based access control.

To grant users permissions:

1. Select “+ Add” to add users to your hub.
2. Select the role you want to assign.
3. Choose the members for the role.
4. Click “Review + assign.” Permissions may take up to an hour to apply.

Networking

Hub networking settings can be configured during resource creation or modified in the Networking tab in the Azure portal. Creating a new hub initializes a Managed Virtual Network, which simplifies network isolation. Choose from Public, Private with Internet Outbound, or Private with Approved Outbound isolation modes based on your security requirements. For private modes, create a private endpoint for inbound access. For more information, see Managed virtual network isolation.

At hub creation in the Azure portal, associated Azure AI services, Storage account, Key Vault, Application Insights, and Container Registry are created. These resources are found on the Resources tab during creation.

To connect to Azure AI services (e.g., Azure OpenAI, Azure AI Search, and Azure AI Content Safety) or storage accounts in Azure AI Studio, create a private endpoint in your virtual network. Ensure public network access (PNA) is disabled for the private endpoint connection. For more details, follow the Azure AI services documentation.

Encryption

Projects using the same hub share encryption settings, which can only be configured during hub creation. From the Azure portal, navigate to the encryption tab to view or update encryption settings. For hubs using Customer-managed keys (CMK), you can update the encryption key to a new version within the same Key Vault.

Update Azure Application Insights and Azure Container Registry

To use custom environments for Prompt Flow, configure an Azure Container Registry for your hub. To use Azure Application Insights for Prompt Flow deployments, configure an Azure Application Insights resource for your hub. Updating these resources might affect job lineage, deployed inference endpoints, or the ability to rerun previous jobs.

Updates can be performed using the Azure Portal, Azure SDK/CLI, or infrastructure-as-code templates.

• Azure portal
• Python SDK
• Azure CLI

Configure or update these resources during creation or after creation. To update Azure Application Insights, go to the Properties for your hub in the Azure portal and select “Change Application Insights