Skip to content

Commit c9e87b7

Browse files
BlackmistBlackmist
authored
Revert "removing role that hasn't been rolled out yet."
1 parent 7721644 commit c9e87b7

File tree

2 files changed

+176
-0
lines changed

2 files changed

+176
-0
lines changed

‎articles/ai-studio/concepts/rbac-ai-studio.md

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,94 @@ In order to complete end-to-end AI development and deployment, users only need t
110110

111111
The minimum permissions needed to create a project is a role that has the allowed action of `Microsoft.MachineLearningServices/workspaces/hubs/join` on the hub. The Azure AI Developer built-in role has this permission.
112112

113+
## Azure AI Administrator role
114+
115+
Prior to 11/19/2024, the system-assigned managed identity created for the hub was automatically assigned the __Contributor__ role for the resource group that contains the hub and projects. Hubs created after this date have the system-assigned managed identity assigned to the __Azure AI Administrator__ role. This role is more narrowly scoped to the minimum permissions needed for the managed identity to perform its tasks.
116+
117+
The __Azure AI Administrator__ role is currently in public preview.
118+
119+
[!INCLUDE [feature-preview](../includes/feature-preview.md)]
120+
121+
The __Azure AI Administrator__ role has the following permissions:
122+
123+
```json
124+
{
125+
"permissions": [
126+
{
127+
"actions": [
128+
"Microsoft.Authorization/*/read",
129+
"Microsoft.CognitiveServices/*",
130+
"Microsoft.ContainerRegistry/registries/*",
131+
"Microsoft.DocumentDb/databaseAccounts/*",
132+
"Microsoft.Features/features/read",
133+
"Microsoft.Features/providers/features/read",
134+
"Microsoft.Features/providers/features/register/action",
135+
"Microsoft.Insights/alertRules/*",
136+
"Microsoft.Insights/components/*",
137+
"Microsoft.Insights/diagnosticSettings/*",
138+
"Microsoft.Insights/generateLiveToken/read",
139+
"Microsoft.Insights/logDefinitions/read",
140+
"Microsoft.Insights/metricAlerts/*",
141+
"Microsoft.Insights/metricdefinitions/read",
142+
"Microsoft.Insights/metrics/read",
143+
"Microsoft.Insights/scheduledqueryrules/*",
144+
"Microsoft.Insights/topology/read",
145+
"Microsoft.Insights/transactions/read",
146+
"Microsoft.Insights/webtests/*",
147+
"Microsoft.KeyVault/*",
148+
"Microsoft.MachineLearningServices/workspaces/*",
149+
"Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
150+
"Microsoft.ResourceHealth/availabilityStatuses/read",
151+
"Microsoft.Resources/deployments/*",
152+
"Microsoft.Resources/deployments/operations/read",
153+
"Microsoft.Resources/subscriptions/operationresults/read",
154+
"Microsoft.Resources/subscriptions/read",
155+
"Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
156+
"Microsoft.Resources/subscriptions/resourceGroups/read",
157+
"Microsoft.Resources/subscriptions/resourceGroups/write",
158+
"Microsoft.Storage/storageAccounts/*",
159+
"Microsoft.Support/*",
160+
"Microsoft.Search/searchServices/write",
161+
"Microsoft.Search/searchServices/read",
162+
"Microsoft.Search/searchServices/delete",
163+
"Microsoft.Search/searchServices/indexes/*",
164+
"Microsoft.DataFactory/factories/*"
165+
],
166+
"notActions": [],
167+
"dataActions": [],
168+
"notDataActions": []
169+
}
170+
]
171+
}
172+
```
173+
174+
### Convert an existing system-managed identity to the Azure AI Administrator role
175+
176+
> [!TIP]
177+
> We recommend that you convert hubs created before 11/19/2024 to use the Azure AI Administrator role. The Azure AI Administrator role is more narrowly scoped than the previously used Contributor role and follows the principal of least privilege.
178+
179+
You can convert hubs created before 11/19/2024 by using one of the following methods:
180+
181+
- Azure REST API: Use a `PATCH` request to the Azure REST API for the workspace. The body of the request should set `{"properties":{"allowRoleAssignmeentOnRG":true}}`. The following example shows a `PATCH` request using `curl`. Replace `<your-subscription>`, `<resource-group-name>`, `<workspace-name>`, and `<YOUR-ACCESS-TOKEN>` with the values for your scenario. For more information on using REST APIs, visit the [Azure REST API documentation](/rest/api/azure/).
182+
183+
```bash
184+
curl -X PATCH https://management.azure.com/subscriptions/<your-subscription>/resourcegroups/<resource-group-name>/providers/Microsoft.MachineLearningServices/workspaces/<workspace-name>?api-version=2024-04-01-preview -H "Authorization:Bearer <YOUR-ACCESS-TOKEN>"
185+
```
186+
187+
- Azure CLI: Use the `az ml workspace update` command with the `--allow-roleassignment-on-rg true` parameter. The following example updates a workspace named `myworkspace`. This command requires the Azure Machine Learning CLI extension version 2.27.0 or later.
188+
189+
```azurecli
190+
az ml workspace update --name myworkspace --allow-roleassignment-on-rg true
191+
```
192+
193+
- Azure Python SDK: Set the `allow_roleassignment_on_rg` property of the Workspace object to `True` and then perform an update operation. The following example updates a workspace named `myworkspace`. This operation requires the Azure Machine Learning SDK version 1.17.0 or later.
194+
195+
```python
196+
ws = ml_client.workspaces.get(name="myworkspace")
197+
ws.allow_roleassignment_on_rg = True
198+
ws = ml_client.workspaces.begin_update(workspace=ws).result()
199+
```
200+
113201
## Dependency service Azure RBAC permissions
114202

115203
The hub has dependencies on other Azure services. The following table lists the permissions required for these services when you create a hub. The person that creates the hub needs these permissions. The person who creates a project from the hub doesn't need them.

‎articles/machine-learning/how-to-assign-roles.md

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,94 @@ You can combine the roles to grant different levels of access. For example, you
5252
> [!IMPORTANT]
5353
> Role access can be scoped to multiple levels in Azure. For example, someone with owner access to a workspace may not have owner access to the resource group that contains the workspace. For more information, see [How Azure RBAC works](/azure/role-based-access-control/overview#how-azure-rbac-works).
5454
55+
## Azure AI Administrator role
56+
57+
Prior to 11/19/2024, the system-assigned managed identity created for the workspace was automatically assigned the __Contributor__ role for the resource group that contains the workspace. Workspaces created after this date have the system-assigned managed identity assigned to the __Azure AI Administrator__ role. This role is more narrowly scoped to the minimum permissions needed for the managed identity to perform its tasks.
58+
59+
The __Azure AI Administrator__ role is currently in public preview.
60+
61+
[!INCLUDE [machine-learning-preview-generic-disclaimer](includes/machine-learning-preview-generic-disclaimer.md)]
62+
63+
The __Azure AI Administrator__ role has the following permissions:
64+
65+
```json
66+
{
67+
"permissions": [
68+
{
69+
"actions": [
70+
"Microsoft.Authorization/*/read",
71+
"Microsoft.CognitiveServices/*",
72+
"Microsoft.ContainerRegistry/registries/*",
73+
"Microsoft.DocumentDb/databaseAccounts/*",
74+
"Microsoft.Features/features/read",
75+
"Microsoft.Features/providers/features/read",
76+
"Microsoft.Features/providers/features/register/action",
77+
"Microsoft.Insights/alertRules/*",
78+
"Microsoft.Insights/components/*",
79+
"Microsoft.Insights/diagnosticSettings/*",
80+
"Microsoft.Insights/generateLiveToken/read",
81+
"Microsoft.Insights/logDefinitions/read",
82+
"Microsoft.Insights/metricAlerts/*",
83+
"Microsoft.Insights/metricdefinitions/read",
84+
"Microsoft.Insights/metrics/read",
85+
"Microsoft.Insights/scheduledqueryrules/*",
86+
"Microsoft.Insights/topology/read",
87+
"Microsoft.Insights/transactions/read",
88+
"Microsoft.Insights/webtests/*",
89+
"Microsoft.KeyVault/*",
90+
"Microsoft.MachineLearningServices/workspaces/*",
91+
"Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
92+
"Microsoft.ResourceHealth/availabilityStatuses/read",
93+
"Microsoft.Resources/deployments/*",
94+
"Microsoft.Resources/deployments/operations/read",
95+
"Microsoft.Resources/subscriptions/operationresults/read",
96+
"Microsoft.Resources/subscriptions/read",
97+
"Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
98+
"Microsoft.Resources/subscriptions/resourceGroups/read",
99+
"Microsoft.Resources/subscriptions/resourceGroups/write",
100+
"Microsoft.Storage/storageAccounts/*",
101+
"Microsoft.Support/*",
102+
"Microsoft.Search/searchServices/write",
103+
"Microsoft.Search/searchServices/read",
104+
"Microsoft.Search/searchServices/delete",
105+
"Microsoft.Search/searchServices/indexes/*",
106+
"Microsoft.DataFactory/factories/*"
107+
],
108+
"notActions": [],
109+
"dataActions": [],
110+
"notDataActions": []
111+
}
112+
]
113+
}
114+
```
115+
116+
### Convert an existing system-managed identity to the Azure AI Administrator role
117+
118+
> [!TIP]
119+
> We recommend that you convert workspaces created before 11/19/2024 to use the Azure AI Administrator role. The Azure AI Administrator role is more narrowly scoped than the previously used Contributor role and follows the principal of least privilege.
120+
121+
You can convert workspaces created before 11/19/2024 by using one of the following methods:
122+
123+
- Azure REST API: Use a `PATCH` request to the Azure REST API for the workspace. The body of the request should set `{"properties":{"allowRoleAssignmeentOnRG":true}}`. The following example shows a `PATCH` request using `curl`. Replace `<your-subscription>`, `<resource-group-name>`, `<workspace-name>`, and `<YOUR-ACCESS-TOKEN>` with the values for your scenario. For more information on using REST APIs, visit the [Azure REST API documentation](/rest/api/azure/).
124+
125+
```bash
126+
curl -X PATCH https://management.azure.com/subscriptions/<your-subscription>/resourcegroups/<resource-group-name>/providers/Microsoft.MachineLearningServices/workspaces/<workspace-name>?api-version=2024-04-01-preview -H "Authorization:Bearer <YOUR-ACCESS-TOKEN>"
127+
```
128+
129+
- Azure CLI: Use the `az ml workspace update` command with the `--allow-roleassignment-on-rg true` parameter. The following example updates a workspace named `myworkspace`. This command requires the Azure Machine Learning CLI extension version 2.27.0 or later.
130+
131+
```azurecli
132+
az ml workspace update --name myworkspace --allow-roleassignment-on-rg true
133+
```
134+
135+
- Azure Python SDK: Set the `allow_roleassignment_on_rg` property of the Workspace object to `True` and then perform an update operation. The following example updates a workspace named `myworkspace`. This operation requires the Azure Machine Learning SDK version 1.17.0 or later.
136+
137+
```python
138+
ws = ml_client.workspaces.get(name="myworkspace")
139+
ws.allow_roleassignment_on_rg = True
140+
ws = ml_client.workspaces.begin_update(workspace=ws).result()
141+
```
142+
55143
## Manage workspace access
56144

57145
If you're an owner of a workspace, you can add and remove roles for the workspace. You can also assign roles to users. Use the following links to discover how to manage access:

0 commit comments

Comments
 (0)