The azure-native:batch:BatchAccount resource, part of the Pulumi Azure Native provider, defines an Azure Batch account: its Storage integration, pool allocation mode, identity, and network access controls. This guide focuses on four capabilities: Storage account integration, pool allocation modes, managed identity, and network isolation.
Batch accounts reference existing Storage accounts and optionally Key Vault instances for secrets management. The examples are intentionally small. Combine them with your own Storage, Key Vault, and networking infrastructure.
Create a Batch account with Storage integration
Most deployments start by linking a Batch account to a Storage account for application packages, task outputs, and resource files.
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";
const batchAccount = new azure_native.batch.BatchAccount("batchAccount", {
accountName: "sampleacct",
autoStorage: {
storageAccountId: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
},
location: "japaneast",
resourceGroupName: "default-azurebatch-japaneast",
});
import pulumi
import pulumi_azure_native as azure_native
batch_account = azure_native.batch.BatchAccount("batchAccount",
account_name="sampleacct",
auto_storage={
"storage_account_id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
},
location="japaneast",
resource_group_name="default-azurebatch-japaneast")
package main
import (
batch "github.com/pulumi/pulumi-azure-native-sdk/batch/v3"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := batch.NewBatchAccount(ctx, "batchAccount", &batch.BatchAccountArgs{
AccountName: pulumi.String("sampleacct"),
AutoStorage: &batch.AutoStorageBasePropertiesArgs{
StorageAccountId: pulumi.String("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage"),
},
Location: pulumi.String("japaneast"),
ResourceGroupName: pulumi.String("default-azurebatch-japaneast"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
var batchAccount = new AzureNative.Batch.BatchAccount("batchAccount", new()
{
AccountName = "sampleacct",
AutoStorage = new AzureNative.Batch.Inputs.AutoStorageBasePropertiesArgs
{
StorageAccountId = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
},
Location = "japaneast",
ResourceGroupName = "default-azurebatch-japaneast",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.batch.BatchAccount;
import com.pulumi.azurenative.batch.BatchAccountArgs;
import com.pulumi.azurenative.batch.inputs.AutoStorageBasePropertiesArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var batchAccount = new BatchAccount("batchAccount", BatchAccountArgs.builder()
.accountName("sampleacct")
.autoStorage(AutoStorageBasePropertiesArgs.builder()
.storageAccountId("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage")
.build())
.location("japaneast")
.resourceGroupName("default-azurebatch-japaneast")
.build());
}
}
resources:
batchAccount:
type: azure-native:batch:BatchAccount
properties:
accountName: sampleacct
autoStorage:
storageAccountId: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage
location: japaneast
resourceGroupName: default-azurebatch-japaneast
The autoStorage property connects your Batch account to an existing Storage account via its ARM resource ID. The accountName must be globally unique (3-24 lowercase letters and numbers). Without additional configuration, the account uses BatchService pool allocation mode, where Microsoft manages pool infrastructure in its own subscription.
Use customer-managed pools in your subscription
Teams that need direct control over compute resources can configure Batch to create pools in their own subscription.
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";
const batchAccount = new azure_native.batch.BatchAccount("batchAccount", {
accountName: "sampleacct",
autoStorage: {
storageAccountId: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
},
keyVaultReference: {
id: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample",
url: "http://sample.vault.azure.net/",
},
location: "japaneast",
poolAllocationMode: azure_native.batch.PoolAllocationMode.UserSubscription,
resourceGroupName: "default-azurebatch-japaneast",
});
import pulumi
import pulumi_azure_native as azure_native
batch_account = azure_native.batch.BatchAccount("batchAccount",
account_name="sampleacct",
auto_storage={
"storage_account_id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
},
key_vault_reference={
"id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample",
"url": "http://sample.vault.azure.net/",
},
location="japaneast",
pool_allocation_mode=azure_native.batch.PoolAllocationMode.USER_SUBSCRIPTION,
resource_group_name="default-azurebatch-japaneast")
package main
import (
batch "github.com/pulumi/pulumi-azure-native-sdk/batch/v3"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := batch.NewBatchAccount(ctx, "batchAccount", &batch.BatchAccountArgs{
AccountName: pulumi.String("sampleacct"),
AutoStorage: &batch.AutoStorageBasePropertiesArgs{
StorageAccountId: pulumi.String("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage"),
},
KeyVaultReference: &batch.KeyVaultReferenceArgs{
Id: pulumi.String("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample"),
Url: pulumi.String("http://sample.vault.azure.net/"),
},
Location: pulumi.String("japaneast"),
PoolAllocationMode: batch.PoolAllocationModeUserSubscription,
ResourceGroupName: pulumi.String("default-azurebatch-japaneast"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
var batchAccount = new AzureNative.Batch.BatchAccount("batchAccount", new()
{
AccountName = "sampleacct",
AutoStorage = new AzureNative.Batch.Inputs.AutoStorageBasePropertiesArgs
{
StorageAccountId = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
},
KeyVaultReference = new AzureNative.Batch.Inputs.KeyVaultReferenceArgs
{
Id = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample",
Url = "http://sample.vault.azure.net/",
},
Location = "japaneast",
PoolAllocationMode = AzureNative.Batch.PoolAllocationMode.UserSubscription,
ResourceGroupName = "default-azurebatch-japaneast",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.batch.BatchAccount;
import com.pulumi.azurenative.batch.BatchAccountArgs;
import com.pulumi.azurenative.batch.inputs.AutoStorageBasePropertiesArgs;
import com.pulumi.azurenative.batch.inputs.KeyVaultReferenceArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var batchAccount = new BatchAccount("batchAccount", BatchAccountArgs.builder()
.accountName("sampleacct")
.autoStorage(AutoStorageBasePropertiesArgs.builder()
.storageAccountId("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage")
.build())
.keyVaultReference(KeyVaultReferenceArgs.builder()
.id("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample")
.url("http://sample.vault.azure.net/")
.build())
.location("japaneast")
.poolAllocationMode("UserSubscription")
.resourceGroupName("default-azurebatch-japaneast")
.build());
}
}
resources:
batchAccount:
type: azure-native:batch:BatchAccount
properties:
accountName: sampleacct
autoStorage:
storageAccountId: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage
keyVaultReference:
id: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample
url: http://sample.vault.azure.net/
location: japaneast
poolAllocationMode: UserSubscription
resourceGroupName: default-azurebatch-japaneast
Setting poolAllocationMode to UserSubscription places pool VMs in your subscription rather than Microsoft’s. This mode requires a keyVaultReference for storing pool certificates and secrets. The Key Vault must exist before creating the account and must grant Batch service permissions.
Enable managed identity for Azure resource access
Applications that access Azure resources from Batch tasks can use managed identities to avoid storing credentials.
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";
const batchAccount = new azure_native.batch.BatchAccount("batchAccount", {
accountName: "sampleacct",
autoStorage: {
storageAccountId: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
},
identity: {
type: azure_native.batch.ResourceIdentityType.SystemAssigned,
},
location: "japaneast",
resourceGroupName: "default-azurebatch-japaneast",
});
import pulumi
import pulumi_azure_native as azure_native
batch_account = azure_native.batch.BatchAccount("batchAccount",
account_name="sampleacct",
auto_storage={
"storage_account_id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
},
identity={
"type": azure_native.batch.ResourceIdentityType.SYSTEM_ASSIGNED,
},
location="japaneast",
resource_group_name="default-azurebatch-japaneast")
package main
import (
batch "github.com/pulumi/pulumi-azure-native-sdk/batch/v3"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := batch.NewBatchAccount(ctx, "batchAccount", &batch.BatchAccountArgs{
AccountName: pulumi.String("sampleacct"),
AutoStorage: &batch.AutoStorageBasePropertiesArgs{
StorageAccountId: pulumi.String("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage"),
},
Identity: &batch.BatchAccountIdentityArgs{
Type: batch.ResourceIdentityTypeSystemAssigned,
},
Location: pulumi.String("japaneast"),
ResourceGroupName: pulumi.String("default-azurebatch-japaneast"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
var batchAccount = new AzureNative.Batch.BatchAccount("batchAccount", new()
{
AccountName = "sampleacct",
AutoStorage = new AzureNative.Batch.Inputs.AutoStorageBasePropertiesArgs
{
StorageAccountId = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
},
Identity = new AzureNative.Batch.Inputs.BatchAccountIdentityArgs
{
Type = AzureNative.Batch.ResourceIdentityType.SystemAssigned,
},
Location = "japaneast",
ResourceGroupName = "default-azurebatch-japaneast",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.batch.BatchAccount;
import com.pulumi.azurenative.batch.BatchAccountArgs;
import com.pulumi.azurenative.batch.inputs.AutoStorageBasePropertiesArgs;
import com.pulumi.azurenative.batch.inputs.BatchAccountIdentityArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var batchAccount = new BatchAccount("batchAccount", BatchAccountArgs.builder()
.accountName("sampleacct")
.autoStorage(AutoStorageBasePropertiesArgs.builder()
.storageAccountId("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage")
.build())
.identity(BatchAccountIdentityArgs.builder()
.type("SystemAssigned")
.build())
.location("japaneast")
.resourceGroupName("default-azurebatch-japaneast")
.build());
}
}
resources:
batchAccount:
type: azure-native:batch:BatchAccount
properties:
accountName: sampleacct
autoStorage:
storageAccountId: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage
identity:
type: SystemAssigned
location: japaneast
resourceGroupName: default-azurebatch-japaneast
The identity property with type SystemAssigned creates an Azure AD identity for the Batch account. Tasks running in pools can use this identity to authenticate to Storage, Key Vault, or other Azure services without managing credentials in code.
Restrict access to private endpoints only
Regulated workloads often require that Batch accounts reject public internet access and accept connections only through private endpoints.
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";
const batchAccount = new azure_native.batch.BatchAccount("batchAccount", {
accountName: "sampleacct",
autoStorage: {
storageAccountId: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
},
keyVaultReference: {
id: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample",
url: "http://sample.vault.azure.net/",
},
location: "japaneast",
publicNetworkAccess: azure_native.batch.PublicNetworkAccessType.Disabled,
resourceGroupName: "default-azurebatch-japaneast",
});
import pulumi
import pulumi_azure_native as azure_native
batch_account = azure_native.batch.BatchAccount("batchAccount",
account_name="sampleacct",
auto_storage={
"storage_account_id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
},
key_vault_reference={
"id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample",
"url": "http://sample.vault.azure.net/",
},
location="japaneast",
public_network_access=azure_native.batch.PublicNetworkAccessType.DISABLED,
resource_group_name="default-azurebatch-japaneast")
package main
import (
batch "github.com/pulumi/pulumi-azure-native-sdk/batch/v3"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := batch.NewBatchAccount(ctx, "batchAccount", &batch.BatchAccountArgs{
AccountName: pulumi.String("sampleacct"),
AutoStorage: &batch.AutoStorageBasePropertiesArgs{
StorageAccountId: pulumi.String("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage"),
},
KeyVaultReference: &batch.KeyVaultReferenceArgs{
Id: pulumi.String("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample"),
Url: pulumi.String("http://sample.vault.azure.net/"),
},
Location: pulumi.String("japaneast"),
PublicNetworkAccess: batch.PublicNetworkAccessTypeDisabled,
ResourceGroupName: pulumi.String("default-azurebatch-japaneast"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
var batchAccount = new AzureNative.Batch.BatchAccount("batchAccount", new()
{
AccountName = "sampleacct",
AutoStorage = new AzureNative.Batch.Inputs.AutoStorageBasePropertiesArgs
{
StorageAccountId = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
},
KeyVaultReference = new AzureNative.Batch.Inputs.KeyVaultReferenceArgs
{
Id = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample",
Url = "http://sample.vault.azure.net/",
},
Location = "japaneast",
PublicNetworkAccess = AzureNative.Batch.PublicNetworkAccessType.Disabled,
ResourceGroupName = "default-azurebatch-japaneast",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.batch.BatchAccount;
import com.pulumi.azurenative.batch.BatchAccountArgs;
import com.pulumi.azurenative.batch.inputs.AutoStorageBasePropertiesArgs;
import com.pulumi.azurenative.batch.inputs.KeyVaultReferenceArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var batchAccount = new BatchAccount("batchAccount", BatchAccountArgs.builder()
.accountName("sampleacct")
.autoStorage(AutoStorageBasePropertiesArgs.builder()
.storageAccountId("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage")
.build())
.keyVaultReference(KeyVaultReferenceArgs.builder()
.id("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample")
.url("http://sample.vault.azure.net/")
.build())
.location("japaneast")
.publicNetworkAccess("Disabled")
.resourceGroupName("default-azurebatch-japaneast")
.build());
}
}
resources:
batchAccount:
type: azure-native:batch:BatchAccount
properties:
accountName: sampleacct
autoStorage:
storageAccountId: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage
keyVaultReference:
id: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample
url: http://sample.vault.azure.net/
location: japaneast
publicNetworkAccess: Disabled
resourceGroupName: default-azurebatch-japaneast
Setting publicNetworkAccess to Disabled blocks all public internet access to the Batch account. Clients must connect through private endpoints in a virtual network. This configuration requires separate private endpoint resources (not shown in the example) and a Key Vault reference for pool management.
Beyond these examples
These snippets focus on specific Batch account features: Storage account integration, pool allocation modes and Key Vault references, and managed identity and network isolation. They’re intentionally minimal rather than full compute environments.
The examples reference pre-existing infrastructure such as Storage accounts, Key Vault instances (for UserSubscription and private access), and virtual network and private endpoints (for private access). They focus on configuring the Batch account rather than provisioning everything around it.
To keep things focused, common Batch account patterns are omitted, including:
- Authentication mode restrictions (allowedAuthenticationModes)
- Customer-managed encryption keys (encryption property)
- Network profile configuration (networkProfile)
- Resource tagging (tags property)
These omissions are intentional: the goal is to illustrate how each Batch account feature is wired, not provide drop-in compute modules. See the Batch Account resource reference for all available configuration options.
Let's create Azure Batch Accounts
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Account Configuration & Naming
http://accountname.region.batch.azure.com/).accountName property is immutable and cannot be changed after the account is created.Authentication & Pool Allocation
BatchService mode (default) allows authentication with access keys or Microsoft Entra ID, while UserSubscription mode requires Microsoft Entra ID authentication only. The mode also affects how quotas are managed.poolAllocationMode to UserSubscription and provide a keyVaultReference with the Key Vault ID and URL.allowedAuthenticationModes property to specify which authentication methods are allowed for data plane operations. This doesn’t affect control plane authentication.Storage & Encryption
autoStorage is a required property that configures the storage account associated with your Batch account.encryption property and provide a keyVaultReference pointing to your Azure Key Vault. By default, accounts use Microsoft-managed keys.Networking & Access Control
publicNetworkAccess to Disabled. The default value is Enabled.networkProfile property only takes effect when publicNetworkAccess is enabled. Verify that public network access isn’t disabled.Identity & Quotas
identity.type to SystemAssigned when creating the Batch account.poolAllocationMode is set to UserSubscription, quota is managed at the subscription level, so dedicatedCoreQuota and related properties aren’t returned by the API.