Intelligent Compute on Azure

Preview

Seqera Intelligent Compute is in preview. Seqera must enable it on a per-workspace basis before you can use it. Contact your account manager to request access for one or more workspaces.

On Azure, Intelligent Compute runs on an Azure Cloud compute environment. The scheduler launches your pipeline tasks on Azure VMs in your subscription, as Spot or regular (On-Demand) VMs according to the provisioning model. For how scheduling, retries, and the Spot to On-Demand fallback work, see Intelligent Compute. For the features that aren't available on Azure, see Feature availability by cloud.

Azure doesn't support Fusion snapshots: a task interrupted on a Spot VM restarts from the beginning on its new VM.

Created resources

In addition to the resources the Azure Cloud compute environment creates, Intelligent Compute creates:

• VMs sched-vm-<id>, with their network interfaces and OS disks. Deleted when the cluster scales down.
• A user-assigned managed identity seqera-sched-vm-<cluster-id> per cluster, granted Storage Blob Data Contributor on the credentials' storage account, and Key Vault Secrets User on the Key Vault when you set a Key Vault URL. Deleted with the cluster.
• An empty network security group seqera-sched-vm-<vnet-name> per virtual network.
• Blob containers sched-logs-* for task logs, in the credentials' storage account. Deleted with the cluster.

Required permissions

Assign the service principal in your Azure Cloud credentials the following roles at subscription scope:

1. Azure Cloud role: the seqera-azure-cloud custom role in Azure Cloud required permissions. If you already use an Azure Cloud compute environment, it's already in place.
2. Storage Blob Data Contributor: the built-in role. Seqera uses it to read and write the work directory, and to issue the short-lived shared access signature (SAS) tokens Fusion uses on the task VMs.
3. Intelligent Compute role: a custom role with the following additional permissions.

{
    "properties": {
        "roleName": "seqera-intelligent-compute",
        "description": "Additional permissions for Seqera Intelligent Compute on Azure Cloud compute environments",
        "assignableScopes": [
            "/subscriptions/<SUBSCRIPTION-ID>"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Network/networkSecurityGroups/read",
                    "Microsoft.Network/networkSecurityGroups/write",
                    "Microsoft.Network/networkSecurityGroups/delete",
                    "Microsoft.Storage/storageAccounts/read",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
                    "Microsoft.Compute/skus/read",
                    "Microsoft.Resources/subscriptions/resources/read",
                    "Microsoft.CostManagement/query/action",
                    "Microsoft.CostManagement/query/read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

You can omit Microsoft.Resources/subscriptions/resources/read if you don't use pipeline secrets, and the two Microsoft.CostManagement/query actions if you don't need run cost (see Cost reporting). Instead of the two Microsoft.CostManagement/query actions, you can assign the built-in Cost Management Reader role. To use pipeline secrets, also grant the service principal Key Vault Secrets Officer on the vault.

To create and assign the role, follow Create a custom role in Microsoft Entra and Assign the custom role to the service principal with the JSON above.

Spot quota

Azure counts all Spot VMs in a region against one Total Regional Spot vCPUs quota. Request a quota high enough for the tasks you run in parallel. When it's exhausted, Spot first falls back to On-Demand, which uses the per-family quotas.

Create the compute environment

Prerequisites

You need the following:

• Seqera has enabled Intelligent Compute for your workspace.
• Azure Cloud credentials in Seqera that include the Subscription ID, which Intelligent Compute requires.
• The Azure Cloud and Intelligent Compute roles assigned to the service principal.
• A Blob Storage container for the work directory, in the credentials' storage account.

1. In your Seqera workspace, select Compute Environments, then select Add compute environment.
2. Enter a name and select Azure Cloud as the platform.
3. Select your Azure Cloud credentials.
4. Select the Location where Seqera launches VMs.
5. Enter a Work directory (for example, az://my-container/work).
6. Under Compute mode, select Seqera Intelligent Compute.
7. Under Intelligent Compute options, review the defaults. See Configuration options.
8. Optional: Under Advanced options, select a Virtual network and Subnets, and enter a Key Vault URL to use pipeline secrets.
9. Select Add.

Seqera creates task VMs and managed identities when you launch the first pipeline.

Networking

Task VMs have no public IP address and no inbound rules. The scheduler agent on each VM connects out to Seqera over HTTPS.

If you don't select a virtual network, Seqera creates one, as described in Azure Cloud networking. If you select your own, it must be in the same region as the compute environment, and its subnets need outbound access to Seqera, Azure Storage, Microsoft Entra ID, Wave, and your container registries. Seqera doesn't modify your virtual network.

Storage access

Fusion on the task VMs gets a SAS token for the work directory's container only. Tasks can't read data from other containers or storage accounts directly. Copy input data into the work directory's container, for example under an inputs/ prefix, and point your pipeline at it there.

Cost reporting

Seqera shows each run's cost on the run details page, from Azure Cost Management, in your billing account's currency, once Azure publishes the billing data, usually 24–48 hours after the run. Seqera finds a run's cost by the seqera.io:platform:workflowId tag, which Intelligent Compute applies to every VM it launches for the run.

Tags on task VMs

Intelligent Compute tags each task VM with the following keys. Azure tag names can't contain /, so Seqera writes each / as :.

Tag name	Value
seqera.io:platform:workflowId	Seqera run ID
seqera.io:platform:workspaceId	Seqera workspace ID. Nextflow 26.10 or later.
seqera.io:platform:computeEnvId	Seqera compute environment ID. Nextflow 26.10 or later.
nextflow.io:projectName	Pipeline project name, for example nf-core/rnaseq
nextflow.io:runName	Nextflow run name
nextflow.io:sessionId	Nextflow session ID
nextflow.io:userName	Seqera user who launched the run. Before Nextflow 26.10, the operating system user that runs Nextflow.
nextflow.io:revision	Pipeline revision
nextflow.io:commitId	Pipeline commit ID
nextflow.io:repository	Pipeline repository URL
nextflow.io:manifestName	Pipeline manifest name
nextflow.io:runtimeVersion	Nextflow version
nextflow.io:resume	true if the run was resumed, otherwise false

Task VMs also carry:

• The run's resource labels, including dynamic resource labels such as platformRun=${workflowId}.
• Labels set with a fixed value at the top level of your Nextflow configuration, for example process.resourceLabels = [team: 'genomics'].

One VM runs tasks from many processes, so it can't carry a label whose value differs between tasks. Labels set with a closure, such as process.resourceLabels = { [step: task.process] }, apply to tasks only, not to VMs.

Set up cost reporting

1. Make sure the service principal has Microsoft.CostManagement/query/action and Microsoft.CostManagement/query/read, which the Intelligent Compute role includes, or the built-in Cost Management Reader role. Without them, Seqera can't read run cost.
2. Optional: grant Microsoft.Resources/tags/write for OS disk cost attribution. Azure doesn't copy a VM's tags onto its managed OS disk, so Seqera tags the disk after launch. Without this permission, run cost doesn't include the OS disk's cost.

Azure Cost Management needs no tag activation. Tags apply only to usage recorded after they're set.

What run cost includes

Run cost includes the task VMs and, with OS disk cost attribution, their OS disks. It doesn't include:

• The head job VM, which runs Nextflow. Seqera doesn't currently capture the head job's cost for Intelligent Compute runs.
• Other services, such as Blob Storage, including the sched-logs-* task log containers.