Skip to content

Commit f50ace0

Browse files
BlackmistBlackmist
committed
incorporating feedback
1 parent 018b00a commit f50ace0

File tree

2 files changed

+97
-67
lines changed

2 files changed

+97
-67
lines changed

‎articles/ai-studio/concepts/rbac-ai-studio.md

Lines changed: 94 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ Here's a table of the built-in roles and their permissions for the hub:
3939
| Role | Description |
4040
| --- | --- |
4141
| Owner | Full access to the hub, including the ability to manage and create new hubs and assign permissions. This role is automatically assigned to the hub creator|
42-
| Contributor | User has full access to the hub, including the ability to create new hubs, but isn't able to manage hub permissions on the existing resource. |
42+
| Contributor | User has full access to the hub, including the ability to create new hubs, but isn't able to manage hub permissions on the existing resource. |
43+
| Azure AI Administrator (preview) | This role is automatically assigned to the system-assigned managed identity for the hub. The Azure AI Administrator role has the minimum permissions needed for the managed identity to perform its tasks. For more information, see [Azure AI Administrator role preview](#azure-ai-administrator-role-preview). |
4344
| Azure AI Developer | Perform all actions except create new hubs and manage the hub permissions. For example, users can create projects, compute, and connections. Users can assign permissions within their project. Users can interact with existing Azure AI resources such as Azure OpenAI, Azure AI Search, and Azure AI services. |
4445
| Azure AI Inference Deployment Operator | Perform all actions required to create a resource deployment within a resource group. |
4546
| Reader | Read only access to the hub. This role is automatically assigned to all project members within the hub. |
@@ -48,69 +49,7 @@ The key difference between Contributor and Azure AI Developer is the ability to
4849

4950
Only the Owner and Contributor roles allow you to make a hub. At this time, custom roles can't grant you permission to make hubs.
5051

51-
### Azure AI Developer role
52-
53-
The full set of permissions for the new "Azure AI Developer" role are as follows:
54-
55-
```json
56-
{
57-
"Permissions": [
58-
{
59-
"Actions": [
60-
"Microsoft.MachineLearningServices/workspaces/*/read",
61-
"Microsoft.MachineLearningServices/workspaces/*/action",
62-
"Microsoft.MachineLearningServices/workspaces/*/delete",
63-
"Microsoft.MachineLearningServices/workspaces/*/write",
64-
"Microsoft.MachineLearningServices/locations/*/read",
65-
"Microsoft.Authorization/*/read",
66-
"Microsoft.Resources/deployments/*"
67-
],
68-
69-
"NotActions": [
70-
"Microsoft.MachineLearningServices/workspaces/delete",
71-
"Microsoft.MachineLearningServices/workspaces/write",
72-
"Microsoft.MachineLearningServices/workspaces/listKeys/action",
73-
"Microsoft.MachineLearningServices/workspaces/hubs/write",
74-
"Microsoft.MachineLearningServices/workspaces/hubs/delete",
75-
"Microsoft.MachineLearningServices/workspaces/featurestores/write",
76-
"Microsoft.MachineLearningServices/workspaces/featurestores/delete"
77-
],
78-
"DataActions": [
79-
"Microsoft.CognitiveServices/accounts/OpenAI/*",
80-
"Microsoft.CognitiveServices/accounts/SpeechServices/*",
81-
"Microsoft.CognitiveServices/accounts/ContentSafety/*"
82-
],
83-
"NotDataActions": [],
84-
"Condition": null,
85-
"ConditionVersion": null
86-
}
87-
]
88-
}
89-
```
90-
91-
If the built-in Azure AI Developer role doesn't meet your needs, you can create a [custom role](#create-custom-roles).
92-
93-
## Default roles for projects
94-
95-
Projects in Azure AI Foundry portal have built-in roles that are available by default.
96-
97-
Here's a table of the built-in roles and their permissions for the project:
98-
99-
| Role | Description |
100-
| --- | --- |
101-
| Owner | Full access to the project, including the ability to assign permissions to project users. |
102-
| Contributor | User has full access to the project but can't assign permissions to project users. |
103-
| Azure AI Developer | User can perform most actions, including create deployments, but can't assign permissions to project users. |
104-
| Azure AI Inference Deployment Operator | Perform all actions required to create a resource deployment within a resource group. |
105-
| Reader | Read only access to the project. |
106-
107-
When a user is granted access to a project (for example, through the Azure AI Foundry portal permission management), two more roles are automatically assigned to the user. The first role is Reader on the hub. The second role is the Inference Deployment Operator role, which allows the user to create deployments on the resource group that the project is in. This role is composed of these two permissions: ```"Microsoft.Authorization/*/read"``` and ```"Microsoft.Resources/deployments/*"```.
108-
109-
In order to complete end-to-end AI development and deployment, users only need these two autoassigned roles and either the Contributor or Azure AI Developer role on a project.
110-
111-
The minimum permissions needed to create a project is a role that has the allowed action of `Microsoft.MachineLearningServices/workspaces/hubs/join` on the hub. The Azure AI Developer built-in role has this permission.
112-
113-
## Azure AI Administrator role
52+
### Azure AI Administrator role preview
11453

11554
Prior to 11/19/2024, the system-assigned managed identity created for the hub was automatically assigned the __Contributor__ role for the resource group that contains the hub and projects. Hubs created after this date have the system-assigned managed identity assigned to the __Azure AI Administrator__ role. This role is more narrowly scoped to the minimum permissions needed for the managed identity to perform its tasks.
11655

@@ -171,12 +110,10 @@ The __Azure AI Administrator__ role has the following permissions:
171110
}
172111
```
173112

174-
### Convert an existing system-managed identity to the Azure AI Administrator role
175-
176113
> [!TIP]
177114
> We recommend that you convert hubs created before 11/19/2024 to use the Azure AI Administrator role. The Azure AI Administrator role is more narrowly scoped than the previously used Contributor role and follows the principal of least privilege.
178115
179-
You can convert hubs created before 11/19/2024 by using one of the following methods:
116+
You can convert hubs created before 11/19/2024 to use the new Azure AI Administrator role by using one of the following methods:
180117

181118
- Azure REST API: Use a `PATCH` request to the Azure REST API for the workspace. The body of the request should set `{"properties":{"allowRoleAssignmeentOnRG":true}}`. The following example shows a `PATCH` request using `curl`. Replace `<your-subscription>`, `<resource-group-name>`, `<workspace-name>`, and `<YOUR-ACCESS-TOKEN>` with the values for your scenario. For more information on using REST APIs, visit the [Azure REST API documentation](/rest/api/azure/).
182119

@@ -198,6 +135,71 @@ You can convert hubs created before 11/19/2024 by using one of the following met
198135
ws = ml_client.workspaces.begin_update(workspace=ws).result()
199136
```
200137

138+
If you encounter problems with the Azure AI Administrator role, you can revert to the Contributor role as a troubleshooting step. For more information, see [Revert to the Contributor role](#revert-to-the-contributor-role).
139+
140+
### Azure AI Developer role
141+
142+
The full set of permissions for the new "Azure AI Developer" role are as follows:
143+
144+
```json
145+
{
146+
"Permissions": [
147+
{
148+
"Actions": [
149+
"Microsoft.MachineLearningServices/workspaces/*/read",
150+
"Microsoft.MachineLearningServices/workspaces/*/action",
151+
"Microsoft.MachineLearningServices/workspaces/*/delete",
152+
"Microsoft.MachineLearningServices/workspaces/*/write",
153+
"Microsoft.MachineLearningServices/locations/*/read",
154+
"Microsoft.Authorization/*/read",
155+
"Microsoft.Resources/deployments/*"
156+
],
157+
158+
"NotActions": [
159+
"Microsoft.MachineLearningServices/workspaces/delete",
160+
"Microsoft.MachineLearningServices/workspaces/write",
161+
"Microsoft.MachineLearningServices/workspaces/listKeys/action",
162+
"Microsoft.MachineLearningServices/workspaces/hubs/write",
163+
"Microsoft.MachineLearningServices/workspaces/hubs/delete",
164+
"Microsoft.MachineLearningServices/workspaces/featurestores/write",
165+
"Microsoft.MachineLearningServices/workspaces/featurestores/delete"
166+
],
167+
"DataActions": [
168+
"Microsoft.CognitiveServices/accounts/OpenAI/*",
169+
"Microsoft.CognitiveServices/accounts/SpeechServices/*",
170+
"Microsoft.CognitiveServices/accounts/ContentSafety/*"
171+
],
172+
"NotDataActions": [],
173+
"Condition": null,
174+
"ConditionVersion": null
175+
}
176+
]
177+
}
178+
```
179+
180+
If the built-in Azure AI Developer role doesn't meet your needs, you can create a [custom role](#create-custom-roles).
181+
182+
## Default roles for projects
183+
184+
Projects in Azure AI Foundry portal have built-in roles that are available by default.
185+
186+
Here's a table of the built-in roles and their permissions for the project:
187+
188+
| Role | Description |
189+
| --- | --- |
190+
| Owner | Full access to the project, including the ability to assign permissions to project users. |
191+
| Contributor | User has full access to the project but can't assign permissions to project users. |
192+
| Azure AI Administrator (preview) | This role is automatically assigned to the system-assigned managed identity for the hub. The Azure AI Administrator role has the minimum permissions needed for the managed identity to perform its tasks. For more information, see [Azure AI Administrator role preview](#azure-ai-administrator-role-preview). |
193+
| Azure AI Developer | User can perform most actions, including create deployments, but can't assign permissions to project users. |
194+
| Azure AI Inference Deployment Operator | Perform all actions required to create a resource deployment within a resource group. |
195+
| Reader | Read only access to the project. |
196+
197+
When a user is granted access to a project (for example, through the Azure AI Foundry portal permission management), two more roles are automatically assigned to the user. The first role is Reader on the hub. The second role is the Inference Deployment Operator role, which allows the user to create deployments on the resource group that the project is in. This role is composed of these two permissions: ```"Microsoft.Authorization/*/read"``` and ```"Microsoft.Resources/deployments/*"```.
198+
199+
In order to complete end-to-end AI development and deployment, users only need these two autoassigned roles and either the Contributor or Azure AI Developer role on a project.
200+
201+
The minimum permissions needed to create a project is a role that has the allowed action of `Microsoft.MachineLearningServices/workspaces/hubs/join` on the hub. The Azure AI Developer built-in role has this permission.
202+
201203
## Dependency service Azure RBAC permissions
202204

203205
The hub has dependencies on other Azure services. The following table lists the permissions required for these services when you create a hub. The person that creates the hub needs these permissions. The person who creates a project from the hub doesn't need them.
@@ -504,6 +506,31 @@ Assign the following roles to the user or service principal. The role you assign
504506
| Azure AI Search | Search Index Data Contributor | Required for indexing scenarios. |
505507
| Azure AI Search| Search Index Data Reader | Inference service queries the data from the index. Only used for inference scenarios. |
506508

509+
### Revert to the Contributor role
510+
511+
If you create a new hub and encounter errors with the new default role assignment of Azure AI Administrator for the managed identity, use the following steps to revert to the Contributor role:
512+
513+
> [!IMPORTANT]
514+
> We don't recommend reverting to the Contributor role unless you encounter problems. If reverting does solve the problems that you are encountering, please log a support incident with information on the problems that reverting solved so that we can invesitage further.
515+
516+
1. Delete the role assignment for the hub's managed-identity. The scope for this role assignment is the __resource group__ that contains the hub, so the role must be deleted from the resource group.
517+
518+
> [!TIP]
519+
> The system-assigned managed identity for the hub is the same as the hub name.
520+
521+
From the Azure portal, navigate to the __resource group__ that contains the hub. Select __Access control (IAM)__, and then select __Role assignments__. In the list of role assignments, find the role assignment for the managed identity. Select it, and then select __Delete__.
522+
523+
For information on deleting a role assignment, see [Remove role assigngments](/azure/role-based-access-control/role-assignments-remove).
524+
525+
1. Create a new role assignment on the __resource group__ for the __Contributor__ role. When adding this role assignment, select the managed-identity for the hub as the assignee. The name of the system-assigned managed identity is same as the hub name.
526+
527+
1. From the Azure portal, navigate to the __resource group__ that contains the hub. Select __Access control (IAM)__, and then select __Add role assignment__.
528+
1. From the __Role__ tab, select __Contributor__.
529+
1. From the __Members__ tab, select __Managed identity__, __+ Select members__, ans set the __Managed identity__ dropdown to __Azure AI hub__. In the __Select__ field, enter the name of the hub. Select the hub from the list, and then select __Select__.
530+
1. From the __Review + assign__ tab, select __Review + assign__.
531+
532+
1. If reverting to the Contributor role resolves the problem, and you would like to opt-out of using the Azure AI Administrator role and instead return to using the Contributor role as the default, please open a support incident and request that the Azure AI Administrator role be disabled for your subscription.
533+
507534
## Next steps
508535

509536
- [How to create an Azure AI Foundry hub](../how-to/create-azure-ai-resource.md)

‎articles/machine-learning/how-to-assign-roles.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -583,6 +583,9 @@ Here are a few things to be aware of while you use Azure RBAC:
583583
584584
If you create a new workspace and encounter errors with the new default role assignment of Azure AI Administrator for the workspace managed identity, use the following steps to revert to the Contributor role:
585585
586+
> [!IMPORTANT]
587+
> We don't recommend reverting to the Contributor role unless you encounter problems. If reverting does solve the problems that you are encountering, please log a support incident with information on the problems that reverting solved so that we can invesitage further.
588+
586589
1. Delete the role assignment for the workspace's managed-identity. The scope for this role assignment is the __resource group__ that contains the workspace, so the role must be deleted from the resource group.
587590
588591
> [!TIP]

0 commit comments

Comments
 (0)