# How to Integrate Retool with Azure Machine Learning

- Tool: Retool
- Difficulty: Advanced
- Time required: 30 minutes
- Last updated: April 2026

## TL;DR

Connect Retool to Azure Machine Learning by creating a REST API Resource with Azure AD service principal authentication. Configure your tenant ID, client ID, and client secret to obtain OAuth 2.0 tokens, then query Azure ML REST endpoints to view experiments, monitor pipeline runs, and submit inference requests to deployed model endpoints — all from a visual Retool dashboard.

## Why Build a Retool Azure ML Dashboard?

Data science teams working within the Azure ecosystem use Azure Machine Learning Studio's web interface for model development, but MLOps engineers and operations teams often need a custom internal tool that combines ML experiment data with business metrics, deployment status, and operational context. A Retool Azure ML dashboard lets you build exactly that: a single panel where ML engineers can monitor active pipeline runs, compare experiment metrics across model versions, check endpoint health, and submit test inference requests — without granting everyone access to the full Azure portal.

Retool's REST API Resource handles the OAuth 2.0 token exchange with Azure Active Directory automatically once configured, so every query to Azure ML's management and inference APIs is authenticated without manual token management. JavaScript transformers reshape Azure ML's deeply nested JSON responses into clean table rows and chart data, and Retool's Table, Chart, and Container components provide a professional dashboard UI. Teams commonly build MLOps dashboards that surface the metrics their engineers care about: training job status, validation accuracy across runs, model registry versions, and endpoint latency.

The security model is well-suited to enterprise Azure deployments. By assigning your service principal only the AzureML Data Scientist or Reader role — rather than Contributor — you ensure Retool can query and monitor without being able to delete experiments or modify workspace settings. All API calls are proxied through Retool's backend, keeping your client secret off the browser and out of network logs.

## Before you start

- A Retool account (Cloud or self-hosted) with permission to add Resources
- An Azure subscription with an Azure Machine Learning workspace created
- An Azure AD service principal with the AzureML Data Scientist or Reader role assigned on the ML workspace — create via Azure Portal → Azure Active Directory → App registrations
- Your service principal's Tenant ID, Client ID, and Client Secret (generated in the service principal's Certificates & Secrets section)
- Your Azure ML workspace's Subscription ID, Resource Group name, and Workspace name (from the workspace Overview page in Azure portal)

## Step-by-step guide

### 1. Create an Azure AD service principal and assign the Azure ML role

Before configuring Retool, you need an Azure AD service principal with appropriate permissions on your Azure ML workspace. Navigate to the Azure Portal (portal.azure.com) and go to Azure Active Directory → App registrations. Click New registration, name it 'Retool AzureML Access', select 'Accounts in this organizational directory only', and click Register. On the app's overview page, copy the Application (client) ID and Directory (tenant) ID — you will need these for Retool.

Next, create a client secret: go to Certificates & secrets → New client secret. Set a description like 'Retool access' and choose an expiration period (12 or 24 months recommended). Click Add and immediately copy the generated secret value — Azure will not show it again after you navigate away.

Now assign the role: navigate to your Azure ML workspace in the Azure Portal. Go to Access control (IAM) → Add → Add role assignment. Select the 'AzureML Data Scientist' role (for read + inference submit access) or 'Reader' role (read-only monitoring). In the Members tab, click 'Select members', search for your service principal by its display name, and add it. Click Review + assign to complete the role assignment.

Note your Azure ML workspace details from the workspace's Overview page: the Subscription ID (in the top section), Resource Group name, and Workspace name. These are required for constructing API endpoint URLs.

**Expected result:** A service principal exists in Azure AD with a client secret, and the service principal appears in your Azure ML workspace's Access control (IAM) list with the assigned role.

### 2. Configure the REST API Resource with Azure AD OAuth authentication

Open Retool and navigate to the Resources tab. Click Add Resource and select REST API from the list. Configure the resource as follows:

- Name: 'Azure Machine Learning'
- Base URL: https://management.azure.com — this is Azure's ARM (Azure Resource Manager) endpoint that handles all Azure ML management API calls

Scroll to the Authentication section and select OAuth 2.0 from the dropdown. Fill in the OAuth fields:
- Grant Type: Client Credentials
- Access Token URL: https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/token (replace YOUR_TENANT_ID with your Directory tenant ID)
- Client ID: your service principal's Application (client) ID
- Client Secret: the client secret value you copied earlier
- Scope: https://management.azure.com/.default
- Audience: https://management.azure.com/

The scope value https://management.azure.com/.default tells Azure AD to grant all ARM permissions that the service principal's role assignment allows. Retool will automatically request and refresh tokens using this client credentials flow — your queries never need to handle token management manually.

Leave the header and URL parameter sections empty for now — per-query headers can be added in individual queries. Click Save Changes and then click Test Connection to verify that Retool can reach Azure's token endpoint and the ARM API base URL.

**Expected result:** The Azure Machine Learning resource appears in the Resources list. Test Connection succeeds and returns a 200 response from the ARM API base endpoint.

### 3. Query Azure ML experiments and pipeline runs

Create your first query to list experiments in your Azure ML workspace. Open a Retool app, go to the Code panel, and create a new query. Select the Azure Machine Learning resource. Configure the query:

- Method: GET
- Path: /subscriptions/YOUR_SUBSCRIPTION_ID/resourceGroups/YOUR_RESOURCE_GROUP/providers/Microsoft.MachineLearningServices/workspaces/YOUR_WORKSPACE/experiments
- URL parameter: api-version → 2023-04-01

Replace the placeholder values with your actual subscription ID, resource group name, and workspace name. The api-version parameter is required for all Azure ML REST API calls — check Azure ML's API documentation for the current stable version if needed.

Create a second query to list runs within a specific experiment. Configure:
- Method: GET
- Path: /subscriptions/YOUR_SUBSCRIPTION_ID/resourceGroups/YOUR_RESOURCE_GROUP/providers/Microsoft.MachineLearningServices/workspaces/YOUR_WORKSPACE/experiments/{{ experimentSelect.value }}/runs
- URL parameter: api-version → 2023-04-01

Wire the second query to an experiment selector (a Select component populated from the first query's response). Add a JavaScript transformer to the runs query that maps the response into clean table rows, extracting run ID, status, start time, duration, and primary metric from Azure ML's nested response structure.

Drag a Table component onto the canvas and bind its data to {{ runsQuery.data }}. Enable automatic refresh on the runs query when the experiment selector value changes.

```
// Transformer for Azure ML runs response
// Azure ML returns runs in a 'value' array with nested properties
const runs = data.value || [];
return runs.map(run => ({
  run_id: run.runId,
  display_name: run.displayName || run.runId,
  status: run.status,
  start_time: run.startTimeUtc
    ? new Date(run.startTimeUtc).toLocaleString()
    : 'Not started',
  end_time: run.endTimeUtc
    ? new Date(run.endTimeUtc).toLocaleString()
    : '—',
  duration_min: run.startTimeUtc && run.endTimeUtc
    ? ((new Date(run.endTimeUtc) - new Date(run.startTimeUtc)) / 60000).toFixed(1) + ' min'
    : '—',
  experiment_name: run.experimentName || '',
  run_type: run.runType || '',
  created_by: run.createdBy?.userObjectId || ''
}));
```

**Expected result:** The experiments query returns a list of workspace experiments. The runs query populates a Table with run IDs, statuses, and timing data that updates when the experiment selector changes.

### 4. Build an inference endpoint testing panel

List deployed online endpoints and add a test inference panel. Create a query to fetch all endpoints:

- Method: GET
- Path: /subscriptions/YOUR_SUBSCRIPTION_ID/resourceGroups/YOUR_RESOURCE_GROUP/providers/Microsoft.MachineLearningServices/workspaces/YOUR_WORKSPACE/onlineEndpoints
- URL parameter: api-version → 2023-04-01

To submit inference requests, you need a separate resource or a different base URL — inference endpoints use their own scoring URI, not the ARM management API. Create a second REST API Resource named 'Azure ML Inference' with:
- Base URL: https://YOUR_ENDPOINT_NAME.YOUR_REGION.inference.ml.azure.com
- Authentication: Bearer Token, with the token value referencing a configuration variable that stores a valid API key for the endpoint (available in Azure ML Studio → Endpoints → Your Endpoint → Consume tab)

For the inference test query, configure:
- Method: POST
- Path: /score
- Body: {{ JSON.parse(inferenceInputTextarea.value) }}
- Header: Content-Type → application/json

Drag a Code Editor or Text Input component labeled 'Inference JSON input' and a Button labeled 'Submit Prediction'. Wire the button to trigger the inference query manually. Display the raw response in a JSON viewer component. Add a Select component populated from the endpoints list so users can switch between deployed endpoints without editing the query.

```
// Transformer for online endpoints list
const endpoints = data.value || [];
return endpoints.map(ep => ({
  name: ep.name,
  provisioning_state: ep.properties?.provisioningState || '',
  auth_mode: ep.properties?.authMode || '',
  scoring_uri: ep.properties?.scoringUri || '',
  traffic: JSON.stringify(ep.properties?.traffic || {}),
  created: ep.systemData?.createdAt
    ? new Date(ep.systemData.createdAt).toLocaleDateString()
    : ''
}));
```

**Expected result:** A table shows all deployed online endpoints with their provisioning state, scoring URI, and authentication mode. The inference test panel accepts JSON input and displays prediction responses when the Submit button is clicked.

### 5. Add metric visualization and connect to a monitoring Workflow

Add a metrics chart panel to your MLOps dashboard by querying run metrics for a selected run. Create a query:

- Method: GET
- Path: /subscriptions/YOUR_SUBSCRIPTION_ID/resourceGroups/YOUR_RESOURCE_GROUP/providers/Microsoft.MachineLearningServices/workspaces/YOUR_WORKSPACE/experiments/{{ experimentSelect.value }}/runs/{{ runsTable.selectedRow?.run_id }}/metrics
- URL parameter: api-version → 2023-04-01

The response returns a list of metric cells, each with a metric name, value, and step number. Use a transformer to pivot this flat array into series grouped by metric name, suitable for Retool's Chart component.

Drag a Chart component onto the canvas. Set its chart type to Line and configure multiple series, one per metric (accuracy, loss, validation_accuracy). Bind the x-axis to step numbers and the y-axis to metric values. Use a MultiSelect component to let engineers choose which metrics to display.

For ongoing monitoring, set up a Retool Workflow (optional): create a workflow with a Schedule trigger that runs every hour. Add a Resource Query block targeting the Azure ML experiments endpoint. Add a JavaScript block that evaluates whether any runs have failed since the last check. Add a second Resource Query block targeting a Slack resource to send a notification channel message if failures are detected. This keeps the team informed without requiring anyone to manually check the Retool dashboard.

```
// Transformer to pivot Azure ML metrics into chart series
// Input: data.value = array of { name, value, step } cells
const cells = data.value || [];
const seriesMap = {};
cells.forEach(cell => {
  const name = cell.name;
  const step = cell.metricId?.step ?? 0;
  const value = cell.value;
  if (!seriesMap[name]) seriesMap[name] = [];
  seriesMap[name].push({ x: step, y: value });
});
// Return an array of series objects for Retool Chart
return Object.entries(seriesMap).map(([metricName, points]) => ({
  name: metricName,
  data: points.sort((a, b) => a.x - b.x)
}));
```

**Expected result:** Selecting a run in the runs table loads its metrics and displays them as line chart series. Engineers can toggle individual metrics on and off using the MultiSelect. An optional Workflow sends Slack alerts when pipeline runs fail.

## Best practices

- Use a dedicated service principal for Retool with only the minimum required Azure ML role — AzureML Data Scientist for inference access, Reader for monitoring-only dashboards
- Store all Azure credentials (client secret, endpoint API keys) as secret configuration variables in Retool Settings → Configuration Variables, never as hardcoded values in queries
- Add the api-version URL parameter to every Azure ML REST API query — omitting it returns 404 errors and the correct version should match your workspace's supported API set
- Set client secret expiration reminders before the Azure AD credential expires — when a secret expires, all Retool queries will fail with 401 errors until a new secret is generated and updated in the resource
- For large workspaces with many experiments and runs, implement pagination using Azure ML's nextLink pattern and add filters (by status, date range) to limit initial query results
- Use Retool's query caching for experiment metadata queries that don't change frequently — cache experiment lists for 60 seconds to reduce API call volume during dashboard browsing
- Separate management API calls (listing experiments, runs) from inference API calls into two distinct Retool resources — they use different base URLs and authentication contexts

## Use cases

### Build an MLOps experiment tracking dashboard

Create a Retool panel where ML engineers can browse all Azure ML experiments, view runs for each experiment, and compare training metrics (accuracy, loss, AUC) across runs side by side. Add status filters for running, completed, and failed runs, and a detail panel that shows run logs and output artifacts when a specific run is selected.

Prompt example:

```
Build an experiment tracker with a dropdown to select an Azure ML experiment. Display all runs in a table showing run ID, status, start time, duration, and primary metric. When a run is selected, show a detail panel with the run's logged metrics as a line chart over steps, plus a list of output artifacts. Add a filter to show only Failed runs so engineers can quickly investigate issues.
```

### Build a deployed endpoint monitoring panel

Create a Retool dashboard that lists all deployed Azure ML inference endpoints in the workspace, shows their deployment status, compute target, and traffic allocation. Add a test inference panel where engineers can paste sample JSON input and submit a real-time prediction request to the selected endpoint, displaying the response alongside expected output.

Prompt example:

```
Build an endpoint monitoring dashboard that queries all deployed Azure ML online endpoints and displays them in a table with columns for endpoint name, provisioning state, traffic allocation percentages per deployment, and last updated time. Add a test panel below with a JSON input textarea and a Submit button that sends the request to the selected endpoint. Display the prediction response JSON in a formatted code viewer.
```

### Build a model registry and version comparison panel

Create a Retool panel that lists all registered models in the Azure ML model registry, with version history for each model. Display model metadata including framework, creation date, training run link, and associated tags. Add a comparison view that shows metrics from the training runs that produced two selected model versions side by side.

Prompt example:

```
Create a model registry browser with a searchable table of all registered models. When a model is selected, show a version history table with version number, creation date, and tags. Add a Compare button that takes two selected versions and displays their training run metrics side by side in a two-column layout with accuracy, F1 score, and validation loss for each version.
```

## Troubleshooting

### Query returns 401 Unauthorized or 'InvalidAuthenticationToken' error

Cause: The OAuth 2.0 token request is failing, often because the scope, tenant ID, or client secret is incorrect, or the token has expired and Retool is not refreshing it.

Solution: Verify the scope is exactly https://management.azure.com/.default (including the trailing slash in the audience). Confirm the tenant ID in the token URL matches the directory where your service principal was created. Re-test the connection in the Retool resource settings — if it fails, double-check the client secret value hasn't been truncated during copy-paste. Generate a new client secret in Azure Portal if needed.

### Query returns 403 Forbidden even though the service principal exists

Cause: The service principal does not have the correct RBAC role assigned on the specific Azure ML workspace, or the role was assigned at the wrong scope (subscription vs. resource group vs. workspace).

Solution: In Azure Portal, navigate to your Azure ML workspace → Access control (IAM) → Role assignments. Confirm the service principal appears with the AzureML Data Scientist or Reader role at the workspace scope (not just at subscription or resource group level). If missing, re-add the role assignment. RBAC propagation can take up to 5 minutes after assignment.

### API path returns 404 Not Found for experiments or runs endpoints

Cause: The subscription ID, resource group name, or workspace name in the API path contains a typo, incorrect casing, or includes extra whitespace copied from Azure Portal.

Solution: Copy the subscription ID, resource group, and workspace name directly from the Azure ML workspace Overview page in Azure Portal. Resource group names and workspace names are case-sensitive. Verify the api-version URL parameter is present — omitting it returns 404 for most Azure ML REST endpoints. Check the current supported API versions in Azure ML's REST API documentation.

### Inference endpoint returns 401 or 403 when submitting predictions

Cause: Inference endpoint authentication is separate from ARM management authentication. The endpoint uses its own API key or Azure AD token, not the management.azure.com OAuth token configured in the main resource.

Solution: Create a separate Retool REST API Resource for inference calls with the endpoint's scoring URI as the base URL. Authenticate with the endpoint's primary API key stored as a Retool configuration variable (Settings → Configuration Variables, mark as secret). Set the Authorization header to Bearer {{ retoolContext.configVars.AZURE_ML_ENDPOINT_KEY }} in the resource's default headers.

## Frequently asked questions

### Does Retool support Azure ML's native SDK or only the REST API?

Retool connects to Azure ML exclusively through its REST API — there is no native Azure ML connector in Retool's Resources catalog. The REST API Resource approach covers all Azure ML management operations (experiments, runs, models, endpoints) and is the officially supported method. The Azure ML Python SDK cannot be used directly inside Retool's query editor.

### Can I submit batch inference jobs from Retool, not just online endpoint calls?

Yes. Azure ML batch endpoints have their own REST API endpoints under the Azure ML management API. You submit a POST request to /batchEndpoints/{endpoint}/jobs with the input data location (typically an Azure Blob Storage URI) and deployment configuration. Batch jobs run asynchronously — you poll the job status endpoint until the job completes, then retrieve output from the configured output Blob Storage path.

### How do I handle Azure ML API rate limits in my Retool dashboard?

Azure ML management APIs enforce rate limits per subscription and region. For read-heavy dashboards, enable Retool's query caching (set a 30-60 second cache duration on experiment and run list queries) to avoid hitting limits during rapid browsing. For write operations like job submissions, add Retool event handlers that show loading states and disable buttons while queries are in progress, preventing users from accidentally submitting duplicate requests.

### Can I connect Retool to multiple Azure ML workspaces in the same app?

Yes. Create separate REST API Resources for each workspace — each resource can share the same Azure AD service principal if the principal has role assignments in all workspaces, or use separate principals per workspace for stricter isolation. In your Retool app, use a workspace selector dropdown and parameterize the workspace name in query paths using {{ workspaceSelect.value }}, routing to different resources based on the selected workspace.

### What API version should I use for Azure ML REST API queries?

As of 2024, 2023-04-01 is a stable API version covering experiments, runs, models, and online endpoints. Microsoft regularly releases newer API versions with additional features — check the Azure ML REST API reference documentation for the latest stable version. Pinning to a specific version (rather than using 'latest') prevents your queries from breaking when Microsoft deprecates older API behaviors.

---

Source: https://www.rapidevelopers.com/retool-integrations/azure-machine-learning
© RapidDev — https://www.rapidevelopers.com/retool-integrations/azure-machine-learning