Create Azure Batch Accounts

The azure-native:batch:BatchAccount resource, part of the Pulumi Azure Native provider, defines an Azure Batch account: its Storage integration, pool allocation mode, identity, and network access controls. This guide focuses on four capabilities: Storage account integration, pool allocation modes, managed identity, and network isolation.

Batch accounts reference existing Storage accounts and optionally Key Vault instances for secrets management. The examples are intentionally small. Combine them with your own Storage, Key Vault, and networking infrastructure.

Create a Batch account with Storage integration

Most deployments start by linking a Batch account to a Storage account for application packages, task outputs, and resource files.

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const batchAccount = new azure_native.batch.BatchAccount("batchAccount", {
    accountName: "sampleacct",
    autoStorage: {
        storageAccountId: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
    },
    location: "japaneast",
    resourceGroupName: "default-azurebatch-japaneast",
});
import pulumi
import pulumi_azure_native as azure_native

batch_account = azure_native.batch.BatchAccount("batchAccount",
    account_name="sampleacct",
    auto_storage={
        "storage_account_id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
    },
    location="japaneast",
    resource_group_name="default-azurebatch-japaneast")
package main

import (
	batch "github.com/pulumi/pulumi-azure-native-sdk/batch/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := batch.NewBatchAccount(ctx, "batchAccount", &batch.BatchAccountArgs{
			AccountName: pulumi.String("sampleacct"),
			AutoStorage: &batch.AutoStorageBasePropertiesArgs{
				StorageAccountId: pulumi.String("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage"),
			},
			Location:          pulumi.String("japaneast"),
			ResourceGroupName: pulumi.String("default-azurebatch-japaneast"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var batchAccount = new AzureNative.Batch.BatchAccount("batchAccount", new()
    {
        AccountName = "sampleacct",
        AutoStorage = new AzureNative.Batch.Inputs.AutoStorageBasePropertiesArgs
        {
            StorageAccountId = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
        },
        Location = "japaneast",
        ResourceGroupName = "default-azurebatch-japaneast",
    });

});
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.batch.BatchAccount;
import com.pulumi.azurenative.batch.BatchAccountArgs;
import com.pulumi.azurenative.batch.inputs.AutoStorageBasePropertiesArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var batchAccount = new BatchAccount("batchAccount", BatchAccountArgs.builder()
            .accountName("sampleacct")
            .autoStorage(AutoStorageBasePropertiesArgs.builder()
                .storageAccountId("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage")
                .build())
            .location("japaneast")
            .resourceGroupName("default-azurebatch-japaneast")
            .build());

    }
}
resources:
  batchAccount:
    type: azure-native:batch:BatchAccount
    properties:
      accountName: sampleacct
      autoStorage:
        storageAccountId: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage
      location: japaneast
      resourceGroupName: default-azurebatch-japaneast

The autoStorage property connects your Batch account to an existing Storage account via its ARM resource ID. The accountName must be globally unique (3-24 lowercase letters and numbers). Without additional configuration, the account uses BatchService pool allocation mode, where Microsoft manages pool infrastructure in its own subscription.

Use customer-managed pools in your subscription

Teams that need direct control over compute resources can configure Batch to create pools in their own subscription.

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const batchAccount = new azure_native.batch.BatchAccount("batchAccount", {
    accountName: "sampleacct",
    autoStorage: {
        storageAccountId: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
    },
    keyVaultReference: {
        id: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample",
        url: "http://sample.vault.azure.net/",
    },
    location: "japaneast",
    poolAllocationMode: azure_native.batch.PoolAllocationMode.UserSubscription,
    resourceGroupName: "default-azurebatch-japaneast",
});
import pulumi
import pulumi_azure_native as azure_native

batch_account = azure_native.batch.BatchAccount("batchAccount",
    account_name="sampleacct",
    auto_storage={
        "storage_account_id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
    },
    key_vault_reference={
        "id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample",
        "url": "http://sample.vault.azure.net/",
    },
    location="japaneast",
    pool_allocation_mode=azure_native.batch.PoolAllocationMode.USER_SUBSCRIPTION,
    resource_group_name="default-azurebatch-japaneast")
package main

import (
	batch "github.com/pulumi/pulumi-azure-native-sdk/batch/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := batch.NewBatchAccount(ctx, "batchAccount", &batch.BatchAccountArgs{
			AccountName: pulumi.String("sampleacct"),
			AutoStorage: &batch.AutoStorageBasePropertiesArgs{
				StorageAccountId: pulumi.String("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage"),
			},
			KeyVaultReference: &batch.KeyVaultReferenceArgs{
				Id:  pulumi.String("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample"),
				Url: pulumi.String("http://sample.vault.azure.net/"),
			},
			Location:           pulumi.String("japaneast"),
			PoolAllocationMode: batch.PoolAllocationModeUserSubscription,
			ResourceGroupName:  pulumi.String("default-azurebatch-japaneast"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var batchAccount = new AzureNative.Batch.BatchAccount("batchAccount", new()
    {
        AccountName = "sampleacct",
        AutoStorage = new AzureNative.Batch.Inputs.AutoStorageBasePropertiesArgs
        {
            StorageAccountId = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
        },
        KeyVaultReference = new AzureNative.Batch.Inputs.KeyVaultReferenceArgs
        {
            Id = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample",
            Url = "http://sample.vault.azure.net/",
        },
        Location = "japaneast",
        PoolAllocationMode = AzureNative.Batch.PoolAllocationMode.UserSubscription,
        ResourceGroupName = "default-azurebatch-japaneast",
    });

});
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.batch.BatchAccount;
import com.pulumi.azurenative.batch.BatchAccountArgs;
import com.pulumi.azurenative.batch.inputs.AutoStorageBasePropertiesArgs;
import com.pulumi.azurenative.batch.inputs.KeyVaultReferenceArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var batchAccount = new BatchAccount("batchAccount", BatchAccountArgs.builder()
            .accountName("sampleacct")
            .autoStorage(AutoStorageBasePropertiesArgs.builder()
                .storageAccountId("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage")
                .build())
            .keyVaultReference(KeyVaultReferenceArgs.builder()
                .id("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample")
                .url("http://sample.vault.azure.net/")
                .build())
            .location("japaneast")
            .poolAllocationMode("UserSubscription")
            .resourceGroupName("default-azurebatch-japaneast")
            .build());

    }
}
resources:
  batchAccount:
    type: azure-native:batch:BatchAccount
    properties:
      accountName: sampleacct
      autoStorage:
        storageAccountId: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage
      keyVaultReference:
        id: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample
        url: http://sample.vault.azure.net/
      location: japaneast
      poolAllocationMode: UserSubscription
      resourceGroupName: default-azurebatch-japaneast

Setting poolAllocationMode to UserSubscription places pool VMs in your subscription rather than Microsoft’s. This mode requires a keyVaultReference for storing pool certificates and secrets. The Key Vault must exist before creating the account and must grant Batch service permissions.

Enable managed identity for Azure resource access

Applications that access Azure resources from Batch tasks can use managed identities to avoid storing credentials.

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const batchAccount = new azure_native.batch.BatchAccount("batchAccount", {
    accountName: "sampleacct",
    autoStorage: {
        storageAccountId: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
    },
    identity: {
        type: azure_native.batch.ResourceIdentityType.SystemAssigned,
    },
    location: "japaneast",
    resourceGroupName: "default-azurebatch-japaneast",
});
import pulumi
import pulumi_azure_native as azure_native

batch_account = azure_native.batch.BatchAccount("batchAccount",
    account_name="sampleacct",
    auto_storage={
        "storage_account_id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
    },
    identity={
        "type": azure_native.batch.ResourceIdentityType.SYSTEM_ASSIGNED,
    },
    location="japaneast",
    resource_group_name="default-azurebatch-japaneast")
package main

import (
	batch "github.com/pulumi/pulumi-azure-native-sdk/batch/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := batch.NewBatchAccount(ctx, "batchAccount", &batch.BatchAccountArgs{
			AccountName: pulumi.String("sampleacct"),
			AutoStorage: &batch.AutoStorageBasePropertiesArgs{
				StorageAccountId: pulumi.String("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage"),
			},
			Identity: &batch.BatchAccountIdentityArgs{
				Type: batch.ResourceIdentityTypeSystemAssigned,
			},
			Location:          pulumi.String("japaneast"),
			ResourceGroupName: pulumi.String("default-azurebatch-japaneast"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var batchAccount = new AzureNative.Batch.BatchAccount("batchAccount", new()
    {
        AccountName = "sampleacct",
        AutoStorage = new AzureNative.Batch.Inputs.AutoStorageBasePropertiesArgs
        {
            StorageAccountId = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
        },
        Identity = new AzureNative.Batch.Inputs.BatchAccountIdentityArgs
        {
            Type = AzureNative.Batch.ResourceIdentityType.SystemAssigned,
        },
        Location = "japaneast",
        ResourceGroupName = "default-azurebatch-japaneast",
    });

});
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.batch.BatchAccount;
import com.pulumi.azurenative.batch.BatchAccountArgs;
import com.pulumi.azurenative.batch.inputs.AutoStorageBasePropertiesArgs;
import com.pulumi.azurenative.batch.inputs.BatchAccountIdentityArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var batchAccount = new BatchAccount("batchAccount", BatchAccountArgs.builder()
            .accountName("sampleacct")
            .autoStorage(AutoStorageBasePropertiesArgs.builder()
                .storageAccountId("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage")
                .build())
            .identity(BatchAccountIdentityArgs.builder()
                .type("SystemAssigned")
                .build())
            .location("japaneast")
            .resourceGroupName("default-azurebatch-japaneast")
            .build());

    }
}
resources:
  batchAccount:
    type: azure-native:batch:BatchAccount
    properties:
      accountName: sampleacct
      autoStorage:
        storageAccountId: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage
      identity:
        type: SystemAssigned
      location: japaneast
      resourceGroupName: default-azurebatch-japaneast

The identity property with type SystemAssigned creates an Azure AD identity for the Batch account. Tasks running in pools can use this identity to authenticate to Storage, Key Vault, or other Azure services without managing credentials in code.

Restrict access to private endpoints only

Regulated workloads often require that Batch accounts reject public internet access and accept connections only through private endpoints.

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const batchAccount = new azure_native.batch.BatchAccount("batchAccount", {
    accountName: "sampleacct",
    autoStorage: {
        storageAccountId: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
    },
    keyVaultReference: {
        id: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample",
        url: "http://sample.vault.azure.net/",
    },
    location: "japaneast",
    publicNetworkAccess: azure_native.batch.PublicNetworkAccessType.Disabled,
    resourceGroupName: "default-azurebatch-japaneast",
});
import pulumi
import pulumi_azure_native as azure_native

batch_account = azure_native.batch.BatchAccount("batchAccount",
    account_name="sampleacct",
    auto_storage={
        "storage_account_id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
    },
    key_vault_reference={
        "id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample",
        "url": "http://sample.vault.azure.net/",
    },
    location="japaneast",
    public_network_access=azure_native.batch.PublicNetworkAccessType.DISABLED,
    resource_group_name="default-azurebatch-japaneast")
package main

import (
	batch "github.com/pulumi/pulumi-azure-native-sdk/batch/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := batch.NewBatchAccount(ctx, "batchAccount", &batch.BatchAccountArgs{
			AccountName: pulumi.String("sampleacct"),
			AutoStorage: &batch.AutoStorageBasePropertiesArgs{
				StorageAccountId: pulumi.String("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage"),
			},
			KeyVaultReference: &batch.KeyVaultReferenceArgs{
				Id:  pulumi.String("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample"),
				Url: pulumi.String("http://sample.vault.azure.net/"),
			},
			Location:            pulumi.String("japaneast"),
			PublicNetworkAccess: batch.PublicNetworkAccessTypeDisabled,
			ResourceGroupName:   pulumi.String("default-azurebatch-japaneast"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var batchAccount = new AzureNative.Batch.BatchAccount("batchAccount", new()
    {
        AccountName = "sampleacct",
        AutoStorage = new AzureNative.Batch.Inputs.AutoStorageBasePropertiesArgs
        {
            StorageAccountId = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage",
        },
        KeyVaultReference = new AzureNative.Batch.Inputs.KeyVaultReferenceArgs
        {
            Id = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample",
            Url = "http://sample.vault.azure.net/",
        },
        Location = "japaneast",
        PublicNetworkAccess = AzureNative.Batch.PublicNetworkAccessType.Disabled,
        ResourceGroupName = "default-azurebatch-japaneast",
    });

});
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.batch.BatchAccount;
import com.pulumi.azurenative.batch.BatchAccountArgs;
import com.pulumi.azurenative.batch.inputs.AutoStorageBasePropertiesArgs;
import com.pulumi.azurenative.batch.inputs.KeyVaultReferenceArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var batchAccount = new BatchAccount("batchAccount", BatchAccountArgs.builder()
            .accountName("sampleacct")
            .autoStorage(AutoStorageBasePropertiesArgs.builder()
                .storageAccountId("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage")
                .build())
            .keyVaultReference(KeyVaultReferenceArgs.builder()
                .id("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample")
                .url("http://sample.vault.azure.net/")
                .build())
            .location("japaneast")
            .publicNetworkAccess("Disabled")
            .resourceGroupName("default-azurebatch-japaneast")
            .build());

    }
}
resources:
  batchAccount:
    type: azure-native:batch:BatchAccount
    properties:
      accountName: sampleacct
      autoStorage:
        storageAccountId: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.Storage/storageAccounts/samplestorage
      keyVaultReference:
        id: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/default-azurebatch-japaneast/providers/Microsoft.KeyVault/vaults/sample
        url: http://sample.vault.azure.net/
      location: japaneast
      publicNetworkAccess: Disabled
      resourceGroupName: default-azurebatch-japaneast

Setting publicNetworkAccess to Disabled blocks all public internet access to the Batch account. Clients must connect through private endpoints in a virtual network. This configuration requires separate private endpoint resources (not shown in the example) and a Key Vault reference for pool management.

Beyond these examples

These snippets focus on specific Batch account features: Storage account integration, pool allocation modes and Key Vault references, and managed identity and network isolation. They’re intentionally minimal rather than full compute environments.

The examples reference pre-existing infrastructure such as Storage accounts, Key Vault instances (for UserSubscription and private access), and virtual network and private endpoints (for private access). They focus on configuring the Batch account rather than provisioning everything around it.

To keep things focused, common Batch account patterns are omitted, including:

  • Authentication mode restrictions (allowedAuthenticationModes)
  • Customer-managed encryption keys (encryption property)
  • Network profile configuration (networkProfile)
  • Resource tagging (tags property)

These omissions are intentional: the goal is to illustrate how each Batch account feature is wired, not provide drop-in compute modules. See the Batch Account resource reference for all available configuration options.

Let's create Azure Batch Accounts

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Account Configuration & Naming
What are the naming requirements for a Batch account?
Batch account names must be 3-24 characters long, using only lowercase letters and numbers. The name is immutable after creation and becomes part of the DNS endpoint (e.g., http://accountname.region.batch.azure.com/).
Can I rename my Batch account after creation?
No, the accountName property is immutable and cannot be changed after the account is created.
Authentication & Pool Allocation
What's the difference between BatchService and UserSubscription pool allocation modes?
BatchService mode (default) allows authentication with access keys or Microsoft Entra ID, while UserSubscription mode requires Microsoft Entra ID authentication only. The mode also affects how quotas are managed.
How do I create a Batch account with UserSubscription pool allocation?
Set poolAllocationMode to UserSubscription and provide a keyVaultReference with the Key Vault ID and URL.
What authentication modes can I configure for my Batch account?
Use the allowedAuthenticationModes property to specify which authentication methods are allowed for data plane operations. This doesn’t affect control plane authentication.
Storage & Encryption
Is auto-storage required for a Batch account?
Yes, autoStorage is a required property that configures the storage account associated with your Batch account.
How do I use customer-managed keys for encryption?
Configure the encryption property and provide a keyVaultReference pointing to your Azure Key Vault. By default, accounts use Microsoft-managed keys.
Networking & Access Control
How do I restrict public network access to my Batch account?
Set publicNetworkAccess to Disabled. The default value is Enabled.
Why isn't my network profile configuration taking effect?
The networkProfile property only takes effect when publicNetworkAccess is enabled. Verify that public network access isn’t disabled.
Identity & Quotas
How do I enable system-assigned managed identity?
Set identity.type to SystemAssigned when creating the Batch account.
Why aren't dedicated core quota properties returned for my account?
When poolAllocationMode is set to UserSubscription, quota is managed at the subscription level, so dedicatedCoreQuota and related properties aren’t returned by the API.

Using a different cloud?

Explore compute guides for other cloud providers: