docs(architect): weekly KB update — 106 files refreshed (2026-04)

Updates across all 5 skills: ms-ai-advisor, ms-ai-engineering,
ms-ai-governance, ms-ai-security, ms-ai-infrastructure.

Key changes:
- Language Services (Custom Text Classification, Text Analytics, QnA):
  retirement warning 2029-03-31, migration guides to Foundry/GPT-4o
- Agentic Retrieval: 50M free reasoning tokens/month (Public Preview)
- Computer Use: Claude Sonnet 4.5 (preview) + OpenAI CUA models
- Agent Registry: Risks column (M365 E7), user-shared/org-published types
- Declarative agents: schema v1.5 → v1.6, Store validation requirements
- MLflow 3: 13 built-in LLM judges, production monitoring, Genie Code
- AG-UI HITL: ApprovalRequiredAIFunction (C#) + @tool(approval_mode) (Python)
- Entra ID Ignite 2025: Agent ID Admin/Developer RBAC roles, Conditional Access
- Security Copilot: 400 SCU/month per 1000 M365 E5 licenses, auto-provisioned
- Fast Transcription API: phrase lists, 14-language multi-lingual transcription
- Azure Monitor Workbooks: Bicep support, RBAC specifics
- Power Platform Copilot: data residency (Norway/Europe → EU DB, Bing → USA)
- RAG security-rbac: 4-approach table (GA + 3 preview access control methods)
- IaC MLOps: Well-Architected OE:05 principles, Bicep/Terraform patterns
- Translator: image file batch translation Preview (JPEG/PNG/BMP/WebP)

All 106 files: Last updated 2026-04 | Verified: MCP 2026-04

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

skills/ms-ai-engineering/references/mlops-genaiops/mlops-security-access-control.md

@@ -1,7 +1,8 @@
 # Security and Access Control in MLOps
 
 **Kategori:** MLOps & GenAIOps
-**Dato:** 2026-02-04
+**Last updated:** 2026-04 | Verified: MCP 2026-04
+**Dato:** 2026-04-10
 **Confidence:** HIGH — Basert på offisiell Microsoft Learn dokumentasjon (8 MCP-oppslag, 16 kilder)
 
 ---
@@ -747,3 +748,30 @@ AmlComputeClusterNodeEvent
 - ✅ HIGH confidence: Offisiell dokumentasjon + kodeeksempler fra Microsoft Learn
 - ⚠️ MEDIUM confidence: Utledet fra best practices og architecture patterns
 - ❓ LOW confidence: Ikke aktuelt (alle påstander er verifisert mot offisiell dokumentasjon)
+
+
+### Azure Machine Learning VNet Security (2026 Update)
+
+**Managed Virtual Networks** (recommended approach): Azure ML handles network isolation automatically.
+Use `az ml workspace update` with managed network settings instead of manual VNet configuration.
+
+**Private Endpoint for Workspace**:
+- Connects workspace via private IP addresses within your VNet
+- Requires securing all dependent resources: Storage, Key Vault, Container Registry
+- Private endpoint alone does NOT ensure end-to-end security — all components must be secured
+
+**Storage Account Security**:
+- Private endpoint (recommended): Blob, File, Queue, Table subresources
+- Service endpoint: Must be same VNet and subnet as compute
+- Set `Microsoft.MachineLearningServices/Workspace` as trusted resource type
+
+**Required outbound traffic service tags**:
+- `AzureActiveDirectory` (TCP 443) — authentication
+- `AzureMachineLearning` (TCP 443, 18881, UDP 5831)
+- `Storage.region` (TCP 443) — data access
+- `MicrosoftContainerRegistry.region` (TCP 443) — Docker images
+
+**Secure connectivity options**: Azure VPN Gateway (Point-to-site/Site-to-site), ExpressRoute, Azure Bastion (jump box)
+
+**ACR requirements**: Premium SKU required for private endpoints; ACR must be in same VNet or peered VNet.
+