You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/ai-services/speech-service/speech-synthesis-markup-voice.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -244,6 +244,8 @@ The following table describes the usage of the `<lang xml:lang>` element's attri
244
244
245
245
> [!NOTE]
246
246
> The `<lang xml:lang>` element is incompatible with the `prosody` and `break` elements. You can't adjust pause and prosody like pitch, contour, rate, or volume in this element.
247
+
>
248
+
> Non-multilingual voices don't support the `<lang xml:lang>` element by design.
# Customer Intent: As an admin, I want to understand what permissions I need to assign resources so my users can accomplish their tasks.
15
16
---
16
17
17
18
# Manage access to Azure Machine Learning workspaces
@@ -30,7 +31,7 @@ This article explains how to manage access (authorization) to Azure Machine Lear
30
31
31
32
## Default roles
32
33
33
-
Azure Machine Learning workspaces have built-in roles that are available by default. When adding users to a workspace, they can be assigned one of the following roles.
34
+
Azure Machine Learning workspaces have built-in roles that are available by default. When you add users to a workspace, they can be assigned one of the following roles.
34
35
35
36
| Role | Access level |
36
37
| --- | --- |
@@ -40,13 +41,13 @@ Azure Machine Learning workspaces have built-in roles that are available by defa
40
41
|**Contributor**| View, create, edit, or delete (where applicable) assets in a workspace. For example, contributors can create an experiment, create or attach a compute cluster, submit a run, and deploy a web service. |
41
42
|**Owner**| Full access to the workspace, including the ability to view, create, edit, or delete (where applicable) assets in a workspace. Additionally, you can change role assignments. |
42
43
43
-
In addition, [Azure Machine Learning registries](how-to-manage-registries.md) have an AzureML Registry User role that can be assigned to a registry resource to grant user-level permissions to data scientists. For administrator-level permissions to create or delete registries, use the Contributor or Owner role.
44
+
In addition, [Azure Machine Learning registries](how-to-manage-registries.md) have an Azure Machine Learning Registry User role that can be assigned to a registry resource to grant user-level permissions to data scientists. For administrator-level permissions to create or delete registries, use the Contributor or Owner role.
44
45
45
46
| Role | Access level |
46
47
| --- | --- |
47
48
|**AzureML Registry User**| Can get registries, and read, write, and delete assets within them. Can't create new registry resources or delete them. |
48
49
49
-
You can combine the roles to grant different levels of access. For example, you can grant a workspace user both AzureML Data Scientist and AzureML Compute Operator roles to permit the user to perform experiments while creating computes in a self-service manner.
50
+
You can combine the roles to grant different levels of access. For example, you can grant a workspace user both **AzureML Data Scientist** and **AzureML Compute Operator** roles to permit the user to perform experiments while creating computes in a self-service manner.
50
51
51
52
> [!IMPORTANT]
52
53
> Role access can be scoped to multiple levels in Azure. For example, someone with owner access to a workspace may not have owner access to the resource group that contains the workspace. For more information, see [How Azure RBAC works](/azure/role-based-access-control/overview#how-azure-rbac-works).
@@ -73,13 +74,13 @@ az role assignment create --role "Contributor" --assignee "[email protected]" --re
73
74
74
75
You can use Microsoft Entra security groups to manage access to workspaces. This approach has following benefits:
75
76
* Team or project leaders can manage user access to workspace as security group owners, without needing Owner role on the workspace resource directly.
76
-
* You can organize, manage and revoke users' permissions on workspace and other resources as a group, without having to manage permissions on user-by-user basis.
77
+
* You can organize, manage, and revoke users' permissions on workspace and other resources as a group, without having to manage permissions on user-by-user basis.
77
78
* Using Microsoft Entra groups helps you to avoid reaching the [subscription limit](/azure/role-based-access-control/troubleshoot-limits) on role assignments.
78
79
79
80
To use Microsoft Entra security groups:
80
81
1.[Create a security group](/azure/active-directory/fundamentals/active-directory-groups-view-azure-portal).
81
82
2.[Add a group owner](/azure/active-directory/fundamentals/how-to-manage-groups#add-or-remove-members-and-owners). This user has permissions to add or remove group members. The group owner isn't required to be group member, or have direct RBAC role on the workspace.
82
-
3. Assign the group an RBAC role on the workspace, such as AzureML Data Scientist, Reader, or Contributor.
83
+
3. Assign the group an RBAC role on the workspace, such as **AzureML Data Scientist**, **Reader**, or **Contributor**.
83
84
4.[Add group members](/azure/active-directory/fundamentals/how-to-manage-groups#add-or-remove-members-and-owners). The members gain access to the workspace.
84
85
85
86
## Create custom role
@@ -114,7 +115,7 @@ To create a custom role, first construct a role definition JSON file that specif
114
115
115
116
> [!TIP]
116
117
> You can change the `AssignableScopes` field to set the scope of this custom role at the subscription level, the resource group level, or a specific workspace level.
117
-
> The above custom role is just an example, see some suggested [custom roles for the Azure Machine Learning service](#customroles).
118
+
> The previous custom role is just an example, see some suggested [custom roles for the Azure Machine Learning service](#customroles).
118
119
119
120
This custom role can do everything in the workspace except for the following actions:
120
121
@@ -171,7 +172,7 @@ You need to have permissions on the entire scope of your new role definition. Fo
171
172
172
173
## Use Azure Resource Manager templates for repeatability
173
174
174
-
If you anticipate that you'll need to recreate complex role assignments, an Azure Resource Manager template can be a significant help. The [machine-learning-dependencies-role-assignment template](https://github.com/Azure/azure-quickstart-templates/tree/master//quickstarts/microsoft.machinelearningservices/machine-learning-dependencies-role-assignment) shows how role assignments can be specified in source code for reuse.
175
+
If you anticipate that you need to recreate complex role assignments, an Azure Resource Manager template can be a significant help. The [machine-learning-dependencies-role-assignment template](https://github.com/Azure/azure-quickstart-templates/tree/master//quickstarts/microsoft.machinelearningservices/machine-learning-dependencies-role-assignment) shows how role assignments can be specified in source code for reuse.
175
176
176
177
## Common scenarios
177
178
@@ -190,7 +191,7 @@ The following table is a summary of Azure Machine Learning activities and the pe
190
191
| Submitting any type of run (V2) | Not required | Not required | Owner, contributor, or custom role allowing: `/workspaces/*/read`, `/workspaces/environments/write`, `/workspaces/jobs/*`, `/workspaces/metadata/artifacts/write`, `/workspaces/metadata/codes/*/write`, `/workspaces/environments/build/action`, `/workspaces/environments/readSecrets/action`|
191
192
| Publishing pipelines and endpoints (V1) | Not required | Not required | Owner, contributor, or custom role allowing: `/workspaces/endpoints/pipelines/*`, `/workspaces/pipelinedrafts/*`, `/workspaces/modules/*`|
192
193
| Publishing pipelines and endpoints (V2) | Not required | Not required | Owner, contributor, or custom role allowing: `/workspaces/endpoints/pipelines/*`, `/workspaces/pipelinedrafts/*`, `/workspaces/components/*`|
193
-
| Attach an AKS resource <sub>2</sub> | Not required | Owner or contributor on the resource group that contains AKS |
194
+
| Attach an AKS resource <sub>2</sub> | Not required | Owner or contributor on the resource group that contains AKS ||
194
195
| Deploying a registered model on an AKS/ACI resource | Not required | Not required | Owner, contributor, or custom role allowing: `/workspaces/services/aks/write`, `/workspaces/services/aci/write`|
195
196
| Scoring against a deployed AKS endpoint | Not required | Not required | Owner, contributor, or custom role allowing: `/workspaces/services/aks/score/action`, `/workspaces/services/aks/listkeys/action` (when you don't use Microsoft Entra auth) OR `/workspaces/read` (when you use token auth) |
196
197
| Accessing storage using interactive notebooks | Not required | Not required | Owner, contributor, or custom role allowing: `/workspaces/computes/read`, `/workspaces/notebooks/samples/read`, `/workspaces/notebooks/storage/*`, `/workspaces/listStorageAccountKeys/action`, `/workspaces/listNotebookAccessToken/read`|
@@ -210,7 +211,7 @@ The following table is a summary of Azure Machine Learning activities and the pe
210
211
211
212
There are certain differences between actions for V1 APIs and V2 APIs.
212
213
213
-
| Asset | Action path for V1 API | Action path for V2 API
214
+
| Asset | Action path for V1 API | Action path for V2 API|
| Experiment runs and jobs | Microsoft.MachineLearningServices/workspaces/experiments | Microsoft.MachineLearningServices/workspaces/jobs |
@@ -222,7 +223,7 @@ You can make custom roles compatible with both V1 and V2 APIs by including both
222
223
223
224
### Create a workspace using a customer-managed key
224
225
225
-
When using a customer-managed key (CMK), an Azure Key Vault is used to store the key. The user or service principal used to create the workspace must have owner or contributor access to the key vault.
226
+
When you use a customer-managed key (CMK), an Azure Key Vault is used to store the key. The user or service principal used to create the workspace must have owner or contributor access to the key vault.
226
227
227
228
If your workspace is configured with a **user-assigned managed identity**, the identity must be granted the following roles. These roles allow the managed identity to create the Azure Storage, Azure Cosmos DB, and Azure Search resources used when using a customer-managed key:
228
229
@@ -231,7 +232,7 @@ If your workspace is configured with a **user-assigned managed identity**, the i
231
232
-`Microsoft.DocumentDB/databaseAccounts/write`
232
233
233
234
234
-
Within the key vault, the user or service principal must have create, get, delete, and purge access to the key through a key vault access policy. For more information, see [Azure Key Vault security](/azure/key-vault/general/security-features#controlling-access-to-key-vault-data).
235
+
Within the key vault, the user or service principal must have **create**, **get**, **delete**, and **purge** access to the key through a key vault access policy. For more information, see [Azure Key Vault security](/azure/key-vault/general/security-features#controlling-access-to-key-vault-data).
235
236
236
237
### User-assigned managed identity with Azure Machine Learning compute cluster
237
238
@@ -243,8 +244,8 @@ To perform MLflow operations with your Azure Machine Learning workspace, use the
243
244
244
245
| MLflow operation | Scope |
245
246
| --- | --- |
246
-
| (V1) List, read, create, update or delete experiments |`Microsoft.MachineLearningServices/workspaces/experiments/*`|
247
-
| (V2) List, read, create, update or delete jobs |`Microsoft.MachineLearningServices/workspaces/jobs/*`|
247
+
| (V1) List, read, create, update, or delete experiments |`Microsoft.MachineLearningServices/workspaces/experiments/*`|
248
+
| (V2) List, read, create, update, or delete jobs |`Microsoft.MachineLearningServices/workspaces/jobs/*`|
248
249
| Get registered model by name, fetch a list of all registered models in the registry, search for registered models, latest version models for each requests stage, get a registered model's version, search model versions, get URI where a model version's artifacts are stored, search for runs by experiment IDs |`Microsoft.MachineLearningServices/workspaces/models/*/read`|
249
250
| Create a new registered model, update a registered model's name/description, rename existing registered model, create new version of the model, update a model version's description, transition a registered model to one of the stages |`Microsoft.MachineLearningServices/workspaces/models/*/write`|
250
251
| Delete a registered model along with all its version, delete specific versions of a registered model |`Microsoft.MachineLearningServices/workspaces/models/*/delete`|
@@ -447,7 +448,7 @@ Allows you to perform all operations within the scope of a workspace, **except**
447
448
* Creating a new workspace
448
449
* Assigning subscription or workspace level quotas
449
450
450
-
The workspace admin also cannot create a new role. It can only assign existing built-in or custom roles within the scope of their workspace:
451
+
The workspace admin also can't create a new role. It can only assign existing built-in or custom roles within the scope of their workspace:
451
452
452
453
*workspace_admin_custom_role.json* :
453
454
@@ -474,15 +475,15 @@ The workspace admin also cannot create a new role. It can only assign existing b
474
475
475
476
### Data labeling
476
477
477
-
There is a built-in role for data labeling, scoped only to labeling data. The following custom roles give other levels of access for a data labeling project.
478
+
There's a built-in role for data labeling, scoped only to labeling data. The following custom roles give other levels of access for a data labeling project.
Here are a few things to be aware of while you use Azure RBAC:
484
485
485
-
- When you create a resource in Azure, such as a workspace, you're not directly the owner of the resource. Your role is inherited from the highest scope role that you're authorized against in that subscription. As an example if you're a Network Administrator, and have the permissions to create a Machine Learning workspace, you would be assigned the Network Administrator role against that workspace, and not the Owner role.
486
+
- When you create a resource in Azure, such as a workspace, you're not directly the owner of the resource. Your role is inherited from the highest scope role that you're authorized against in that subscription. As an example, if you're a Network Administrator and have the permissions to create a Machine Learning workspace, you would be assigned the **Network Administrator** role against that workspace. Not the **Owner** role.
486
487
487
488
- To perform quota operations in a workspace, you need subscription level permissions. This means setting either subscription level quota or workspace level quota for your managed compute resources can only happen if you have write permissions at the subscription scope.
488
489
@@ -492,7 +493,7 @@ Here are a few things to be aware of while you use Azure RBAC:
492
493
493
494
- It can sometimes take up to one hour for your new role assignments to take effect over cached permissions across the stack.
494
495
495
-
## Next steps
496
+
## Related content
496
497
497
498
-[Enterprise security and governance for Azure Machine Learning](concept-enterprise-security.md)
498
499
-[Secure Azure Machine Learning workspace resources using virtual networks](how-to-network-security-overview.md)
0 commit comments