Skip to content

Commit c9b8d10

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #2934 from Blackmist/revert-2430-fixing-roles
Updates for a new role change
2 parents d52bfee + 26bbd21 commit c9b8d10

File tree

2 files changed

+229
-1
lines changed

2 files changed

+229
-1
lines changed

‎articles/ai-studio/concepts/rbac-ai-studio.md

Lines changed: 116 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ Here's a table of the built-in roles and their permissions for the hub:
3939
| Role | Description |
4040
| --- | --- |
4141
| Owner | Full access to the hub, including the ability to manage and create new hubs and assign permissions. This role is automatically assigned to the hub creator|
42-
| Contributor | User has full access to the hub, including the ability to create new hubs, but isn't able to manage hub permissions on the existing resource. |
42+
| Contributor | User has full access to the hub, including the ability to create new hubs, but isn't able to manage hub permissions on the existing resource. |
43+
| Azure AI Administrator (preview) | This role is automatically assigned to the system-assigned managed identity for the hub. The Azure AI Administrator role has the minimum permissions needed for the managed identity to perform its tasks. For more information, see [Azure AI Administrator role preview](#azure-ai-administrator-role-preview). |
4344
| Azure AI Developer | Perform all actions except create new hubs and manage the hub permissions. For example, users can create projects, compute, and connections. Users can assign permissions within their project. Users can interact with existing Azure AI resources such as Azure OpenAI, Azure AI Search, and Azure AI services. |
4445
| Azure AI Inference Deployment Operator | Perform all actions required to create a resource deployment within a resource group. |
4546
| Reader | Read only access to the hub. This role is automatically assigned to all project members within the hub. |
@@ -48,6 +49,94 @@ The key difference between Contributor and Azure AI Developer is the ability to
4849

4950
Only the Owner and Contributor roles allow you to make a hub. At this time, custom roles can't grant you permission to make hubs.
5051

52+
### Azure AI Administrator role preview
53+
54+
Prior to 11/19/2024, the system-assigned managed identity created for the hub was automatically assigned the __Contributor__ role for the resource group that contains the hub and projects. Hubs created after this date have the system-assigned managed identity assigned to the __Azure AI Administrator__ role. This role is more narrowly scoped to the minimum permissions needed for the managed identity to perform its tasks.
55+
56+
The __Azure AI Administrator__ role is currently in public preview.
57+
58+
[!INCLUDE [feature-preview](../includes/feature-preview.md)]
59+
60+
The __Azure AI Administrator__ role has the following permissions:
61+
62+
```json
63+
{
64+
"permissions": [
65+
{
66+
"actions": [
67+
"Microsoft.Authorization/*/read",
68+
"Microsoft.CognitiveServices/*",
69+
"Microsoft.ContainerRegistry/registries/*",
70+
"Microsoft.DocumentDb/databaseAccounts/*",
71+
"Microsoft.Features/features/read",
72+
"Microsoft.Features/providers/features/read",
73+
"Microsoft.Features/providers/features/register/action",
74+
"Microsoft.Insights/alertRules/*",
75+
"Microsoft.Insights/components/*",
76+
"Microsoft.Insights/diagnosticSettings/*",
77+
"Microsoft.Insights/generateLiveToken/read",
78+
"Microsoft.Insights/logDefinitions/read",
79+
"Microsoft.Insights/metricAlerts/*",
80+
"Microsoft.Insights/metricdefinitions/read",
81+
"Microsoft.Insights/metrics/read",
82+
"Microsoft.Insights/scheduledqueryrules/*",
83+
"Microsoft.Insights/topology/read",
84+
"Microsoft.Insights/transactions/read",
85+
"Microsoft.Insights/webtests/*",
86+
"Microsoft.KeyVault/*",
87+
"Microsoft.MachineLearningServices/workspaces/*",
88+
"Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
89+
"Microsoft.ResourceHealth/availabilityStatuses/read",
90+
"Microsoft.Resources/deployments/*",
91+
"Microsoft.Resources/deployments/operations/read",
92+
"Microsoft.Resources/subscriptions/operationresults/read",
93+
"Microsoft.Resources/subscriptions/read",
94+
"Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
95+
"Microsoft.Resources/subscriptions/resourceGroups/read",
96+
"Microsoft.Resources/subscriptions/resourceGroups/write",
97+
"Microsoft.Storage/storageAccounts/*",
98+
"Microsoft.Support/*",
99+
"Microsoft.Search/searchServices/write",
100+
"Microsoft.Search/searchServices/read",
101+
"Microsoft.Search/searchServices/delete",
102+
"Microsoft.Search/searchServices/indexes/*",
103+
"Microsoft.DataFactory/factories/*"
104+
],
105+
"notActions": [],
106+
"dataActions": [],
107+
"notDataActions": []
108+
}
109+
]
110+
}
111+
```
112+
113+
> [!TIP]
114+
> We recommend that you convert hubs created before 11/19/2024 to use the Azure AI Administrator role. The Azure AI Administrator role is more narrowly scoped than the previously used Contributor role and follows the principal of least privilege.
115+
116+
You can convert hubs created before 11/19/2024 to use the new Azure AI Administrator role by using one of the following methods:
117+
118+
- Azure REST API: Use a `PATCH` request to the Azure REST API for the workspace. The body of the request should set `{"properties":{"allowRoleAssignmeentOnRG":true}}`. The following example shows a `PATCH` request using `curl`. Replace `<your-subscription>`, `<resource-group-name>`, `<workspace-name>`, and `<YOUR-ACCESS-TOKEN>` with the values for your scenario. For more information on using REST APIs, visit the [Azure REST API documentation](/rest/api/azure/).
119+
120+
```bash
121+
curl -X PATCH https://management.azure.com/subscriptions/<your-subscription>/resourcegroups/<resource-group-name>/providers/Microsoft.MachineLearningServices/workspaces/<workspace-name>?api-version=2024-04-01-preview -H "Authorization:Bearer <YOUR-ACCESS-TOKEN>"
122+
```
123+
124+
- Azure CLI: Use the `az ml workspace update` command with the `--allow-roleassignment-on-rg true` parameter. The following example updates a workspace named `myworkspace`. This command requires the Azure Machine Learning CLI extension version 2.27.0 or later.
125+
126+
```azurecli
127+
az ml workspace update --name myworkspace --allow-roleassignment-on-rg true
128+
```
129+
130+
- Azure Python SDK: Set the `allow_roleassignment_on_rg` property of the Workspace object to `True` and then perform an update operation. The following example updates a workspace named `myworkspace`. This operation requires the Azure Machine Learning SDK version 1.17.0 or later.
131+
132+
```python
133+
ws = ml_client.workspaces.get(name="myworkspace")
134+
ws.allow_roleassignment_on_rg = True
135+
ws = ml_client.workspaces.begin_update(workspace=ws).result()
136+
```
137+
138+
If you encounter problems with the Azure AI Administrator role, you can revert to the Contributor role as a troubleshooting step. For more information, see [Revert to the Contributor role](#revert-to-the-contributor-role).
139+
51140
### Azure AI Developer role
52141

53142
The full set of permissions for the new "Azure AI Developer" role are as follows:
@@ -100,6 +189,7 @@ Here's a table of the built-in roles and their permissions for the project:
100189
| --- | --- |
101190
| Owner | Full access to the project, including the ability to assign permissions to project users. |
102191
| Contributor | User has full access to the project but can't assign permissions to project users. |
192+
| Azure AI Administrator (preview) | This role is automatically assigned to the system-assigned managed identity for the hub. The Azure AI Administrator role has the minimum permissions needed for the managed identity to perform its tasks. For more information, see [Azure AI Administrator role preview](#azure-ai-administrator-role-preview). |
103193
| Azure AI Developer | User can perform most actions, including create deployments, but can't assign permissions to project users. |
104194
| Azure AI Inference Deployment Operator | Perform all actions required to create a resource deployment within a resource group. |
105195
| Reader | Read only access to the project. |
@@ -416,6 +506,31 @@ Assign the following roles to the user or service principal. The role you assign
416506
| Azure AI Search | Search Index Data Contributor | Required for indexing scenarios. |
417507
| Azure AI Search| Search Index Data Reader | Inference service queries the data from the index. Only used for inference scenarios. |
418508

509+
### Revert to the Contributor role
510+
511+
If you create a new hub and encounter errors with the new default role assignment of Azure AI Administrator for the managed identity, use the following steps to change the hub to the Contributor role:
512+
513+
> [!IMPORTANT]
514+
> We don't recommend reverting a hub to the Contributor role unless you encounter problems. If reverting does solve the problems that you are encountering, please open a support incident with information on the problems that reverting solved so that we can invesitage further.
515+
>
516+
> If you would like to revert to the Contributor role as the _default_ for new hubs, open a [support request](https://ms.portal.azure.com/#view/Microsoft_Azure_Support/NewSupportRequestV3Blade) with your Azure subscription details and request that your subscription be changed to use the Contributor role as the default for the system-assigned managed identity of new hubs.
517+
518+
1. Delete the role assignment for the hub's managed-identity. The scope for this role assignment is the __resource group__ that contains the hub, so the role must be deleted from the resource group.
519+
520+
> [!TIP]
521+
> The system-assigned managed identity for the hub is the same as the hub name.
522+
523+
From the Azure portal, navigate to the __resource group__ that contains the hub. Select __Access control (IAM)__, and then select __Role assignments__. In the list of role assignments, find the role assignment for the managed identity. Select it, and then select __Delete__.
524+
525+
For information on deleting a role assignment, see [Remove role assigngments](/azure/role-based-access-control/role-assignments-remove).
526+
527+
1. Create a new role assignment on the __resource group__ for the __Contributor__ role. When adding this role assignment, select the managed-identity for the hub as the assignee. The name of the system-assigned managed identity is same as the hub name.
528+
529+
1. From the Azure portal, navigate to the __resource group__ that contains the hub. Select __Access control (IAM)__, and then select __Add role assignment__.
530+
1. From the __Role__ tab, select __Contributor__.
531+
1. From the __Members__ tab, select __Managed identity__, __+ Select members__, ans set the __Managed identity__ dropdown to __Azure AI hub__. In the __Select__ field, enter the name of the hub. Select the hub from the list, and then select __Select__.
532+
1. From the __Review + assign__ tab, select __Review + assign__.
533+
419534
## Next steps
420535

421536
- [How to create an Azure AI Foundry hub](../how-to/create-azure-ai-resource.md)

‎articles/machine-learning/how-to-assign-roles.md

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,94 @@ You can combine the roles to grant different levels of access. For example, you
5252
> [!IMPORTANT]
5353
> Role access can be scoped to multiple levels in Azure. For example, someone with owner access to a workspace may not have owner access to the resource group that contains the workspace. For more information, see [How Azure RBAC works](/azure/role-based-access-control/overview#how-azure-rbac-works).
5454
55+
## Azure AI Administrator role
56+
57+
Prior to 11/19/2024, the system-assigned managed identity created for the workspace was automatically assigned the __Contributor__ role for the resource group that contains the workspace. Workspaces created after this date have the system-assigned managed identity assigned to the __Azure AI Administrator__ role. This role is more narrowly scoped to the minimum permissions needed for the managed identity to perform its tasks.
58+
59+
The __Azure AI Administrator__ role is currently in public preview. If you encounter issues when using the Azure AI Administrator role with your workspace's managed identity, you can try [reverting to the Contributor role](#revert-to-the-contributor-role).
60+
61+
[!INCLUDE [machine-learning-preview-generic-disclaimer](includes/machine-learning-preview-generic-disclaimer.md)]
62+
63+
The __Azure AI Administrator__ role has the following permissions:
64+
65+
```json
66+
{
67+
"permissions": [
68+
{
69+
"actions": [
70+
"Microsoft.Authorization/*/read",
71+
"Microsoft.CognitiveServices/*",
72+
"Microsoft.ContainerRegistry/registries/*",
73+
"Microsoft.DocumentDb/databaseAccounts/*",
74+
"Microsoft.Features/features/read",
75+
"Microsoft.Features/providers/features/read",
76+
"Microsoft.Features/providers/features/register/action",
77+
"Microsoft.Insights/alertRules/*",
78+
"Microsoft.Insights/components/*",
79+
"Microsoft.Insights/diagnosticSettings/*",
80+
"Microsoft.Insights/generateLiveToken/read",
81+
"Microsoft.Insights/logDefinitions/read",
82+
"Microsoft.Insights/metricAlerts/*",
83+
"Microsoft.Insights/metricdefinitions/read",
84+
"Microsoft.Insights/metrics/read",
85+
"Microsoft.Insights/scheduledqueryrules/*",
86+
"Microsoft.Insights/topology/read",
87+
"Microsoft.Insights/transactions/read",
88+
"Microsoft.Insights/webtests/*",
89+
"Microsoft.KeyVault/*",
90+
"Microsoft.MachineLearningServices/workspaces/*",
91+
"Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
92+
"Microsoft.ResourceHealth/availabilityStatuses/read",
93+
"Microsoft.Resources/deployments/*",
94+
"Microsoft.Resources/deployments/operations/read",
95+
"Microsoft.Resources/subscriptions/operationresults/read",
96+
"Microsoft.Resources/subscriptions/read",
97+
"Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
98+
"Microsoft.Resources/subscriptions/resourceGroups/read",
99+
"Microsoft.Resources/subscriptions/resourceGroups/write",
100+
"Microsoft.Storage/storageAccounts/*",
101+
"Microsoft.Support/*",
102+
"Microsoft.Search/searchServices/write",
103+
"Microsoft.Search/searchServices/read",
104+
"Microsoft.Search/searchServices/delete",
105+
"Microsoft.Search/searchServices/indexes/*",
106+
"Microsoft.DataFactory/factories/*"
107+
],
108+
"notActions": [],
109+
"dataActions": [],
110+
"notDataActions": []
111+
}
112+
]
113+
}
114+
```
115+
116+
### Convert an existing system-managed identity to the Azure AI Administrator role
117+
118+
> [!TIP]
119+
> We recommend that you convert workspaces created before 11/19/2024 to use the Azure AI Administrator role. The Azure AI Administrator role is more narrowly scoped than the previously used Contributor role and follows the principal of least privilege.
120+
121+
You can convert workspaces created before 11/19/2024 by using one of the following methods:
122+
123+
- Azure REST API: Use a `PATCH` request to the Azure REST API for the workspace. The body of the request should set `{"properties":{"allowRoleAssignmeentOnRG":true}}`. The following example shows a `PATCH` request using `curl`. Replace `<your-subscription>`, `<resource-group-name>`, `<workspace-name>`, and `<YOUR-ACCESS-TOKEN>` with the values for your scenario. For more information on using REST APIs, visit the [Azure REST API documentation](/rest/api/azure/).
124+
125+
```bash
126+
curl -X PATCH https://management.azure.com/subscriptions/<your-subscription>/resourcegroups/<resource-group-name>/providers/Microsoft.MachineLearningServices/workspaces/<workspace-name>?api-version=2024-04-01-preview -H "Authorization:Bearer <YOUR-ACCESS-TOKEN>"
127+
```
128+
129+
- Azure CLI: Use the `az ml workspace update` command with the `--allow-roleassignment-on-rg true` parameter. The following example updates a workspace named `myworkspace`. This command requires the Azure Machine Learning CLI extension version 2.27.0 or later.
130+
131+
```azurecli
132+
az ml workspace update --name myworkspace --allow-roleassignment-on-rg true
133+
```
134+
135+
- Azure Python SDK: Set the `allow_roleassignment_on_rg` property of the Workspace object to `True` and then perform an update operation. The following example updates a workspace named `myworkspace`. This operation requires the Azure Machine Learning SDK version 1.17.0 or later.
136+
137+
```python
138+
ws = ml_client.workspaces.get(name="myworkspace")
139+
ws.allow_roleassignment_on_rg = True
140+
ws = ml_client.workspaces.begin_update(workspace=ws).result()
141+
```
142+
55143
## Manage workspace access
56144

57145
If you're an owner of a workspace, you can add and remove roles for the workspace. You can also assign roles to users. Use the following links to discover how to manage access:
@@ -491,6 +579,31 @@ Here are a few things to be aware of while you use Azure RBAC:
491579
492580
- It can sometimes take up to one hour for your new role assignments to take effect over cached permissions across the stack.
493581
582+
### Revert to the Contributor role
583+
584+
If you create a new workspace and encounter errors with the new default role assignment of Azure AI Administrator for the workspace managed identity, use the following steps to revert to the Contributor role:
585+
586+
> [!IMPORTANT]
587+
> We don't recommend reverting to the Contributor role unless you encounter problems. If reverting a workspace does solve the problems that you are encountering, please log a support incident with information on the problems that reverting solved so that we can invesitage further.
588+
>
589+
> If you would like to revert to the Contributor role as the _default_ for new workspaces, open a [support request](https://ms.portal.azure.com/#view/Microsoft_Azure_Support/NewSupportRequestV3Blade) with your Azure subscription details and request that your subscription be changed to use the Contributor role as the default for the system-assigned managed identity of new workspaces.
590+
591+
1. Delete the role assignment for the workspace's managed-identity. The scope for this role assignment is the __resource group__ that contains the workspace, so the role must be deleted from the resource group.
592+
593+
> [!TIP]
594+
> The system-assigned managed identity for the workspace is the same as the workspace name.
595+
596+
From the Azure portal, navigate to the __resource group__ that contains the workspace. Select __Access control (IAM)__, and then select __Role assignments__. In the list of role assignments, find the role assignment for the managed identity. Select it, and then select __Delete__.
597+
598+
For information on deleting a role assignment, see [Remove role assigngments](/azure/role-based-access-control/role-assignments-remove).
599+
600+
1. Create a new role assignment on the __resource group__ for the __Contributor__ role. When adding this role assignment, select the managed-identity for the workspace as the assignee. The name of the system-assigned managed identity is same as the workspace name.
601+
602+
1. From the Azure portal, navigate to the __resource group__ that contains the workspace. Select __Access control (IAM)__, and then select __Add role assignment__.
603+
1. From the __Role__ tab, select __Contributor__.
604+
1. From the __Members__ tab, select __Managed identity__, __+ Select members__, ans set the __Managed identity__ dropdown to __Azure Machine Learning workspace__. If the workspace is a hub workspace, select __Azure AI hub__ instead. In the __Select__ field, enter the name of the workspace. Select the workspace from the list, and then select __Select__.
605+
1. From the __Review + assign__ tab, select __Review + assign__.
606+
494607
## Related content
495608
496609
- [Enterprise security and governance for Azure Machine Learning](concept-enterprise-security.md)

0 commit comments

Comments
 (0)