You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/ai-studio/concepts/rbac-ai-studio.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,15 +2,15 @@
2
2
title: Role-based access control in Azure AI Studio
3
3
titleSuffix: Azure AI Studio
4
4
description: This article introduces role-based access control in Azure AI Studio
5
-
manager: nitinme
5
+
manager: scottpolly
6
6
ms.service: azure-ai-studio
7
7
ms.custom:
8
8
- ignite-2023
9
9
ms.topic: conceptual
10
10
ms.date: 11/15/2023
11
-
ms.reviewer: eur
12
-
ms.author: eur
13
-
author: eric-urban
11
+
ms.reviewer: meyetman
12
+
ms.author: larryfr
13
+
author: Blackmist
14
14
---
15
15
16
16
# Role-based access control in Azure AI Studio
@@ -34,9 +34,9 @@ Here's a table of the built-in roles and their permissions for the Azure AI reso
34
34
| Role | Description |
35
35
| --- | --- |
36
36
| Owner | Full access to the Azure AI resource, including the ability to manage and create new Azure AI resources and assign permissions. This role is automatically assigned to the Azure AI resource creator|
37
-
| Contributor |User has full access to the Azure AI resource, including the ability to create new Azure AI resources, but isn't able to manage Azure AI resource permissions on the existing resource. |
38
-
| Azure AI Developer |Perform all actions except create new Azure AI resources and manage the Azure AI resource permissions. For example, users can create projects, compute, and connections. Users can assign permissions within their project. Users can interact with existing AI resources such as Azure OpenAI, Azure AI Search, and Azure AI services. |
39
-
| Reader |Read only access to the Azure AI resource. This role is automatically assigned to all project members within the Azure AI resource. |
37
+
| Contributor |User has full access to the Azure AI resource, including the ability to create new Azure AI resources, but isn't able to manage Azure AI resource permissions on the existing resource. |
38
+
| Azure AI Developer |Perform all actions except create new Azure AI resources and manage the Azure AI resource permissions. For example, users can create projects, compute, and connections. Users can assign permissions within their project. Users can interact with existing AI resources such as Azure OpenAI, Azure AI Search, and Azure AI services. |
39
+
| Reader |Read only access to the Azure AI resource. This role is automatically assigned to all project members within the Azure AI resource. |
40
40
41
41
42
42
The key difference between Contributor and Azure AI Developer is the ability to make new Azure AI resources. If you don't want users to make new Azure AI resources (due to quota, cost, or just managing how many Azure AI resources you have), assign the AI Developer role.
@@ -87,9 +87,9 @@ Here's a table of the built-in roles and their permissions for the Azure AI proj
87
87
| Role | Description |
88
88
| --- | --- |
89
89
| Owner | Full access to the Azure AI project, including the ability to assign permissions to project users. |
90
-
| Contributor |User has full access to the Azure AI project but can't assign permissions to project users. |
91
-
| Azure AI Developer |User can perform most actions, including create deployments, but can't assign permissions to project users. |
92
-
| Reader |Read only access to the Azure AI project. |
90
+
| Contributor |User has full access to the Azure AI project but can't assign permissions to project users. |
91
+
| Azure AI Developer |User can perform most actions, including create deployments, but can't assign permissions to project users. |
92
+
| Reader |Read only access to the Azure AI project. |
93
93
94
94
When a user gets access to a project, two more roles are automatically assigned to the project user. The first role is Reader on the Azure AI resource. The second role is the Inference Deployment Operator role, which allows the user to create deployments on the resource group that the project is in. This role is composed of these two permissions: ```"Microsoft.Authorization/*/read"``` and ```"Microsoft.Resources/deployments/*"```.
Copy file name to clipboardExpand all lines: articles/ai-studio/how-to/create-azure-ai-resource.md
+18-18Lines changed: 18 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,15 +2,15 @@
2
2
title: How to create and manage an Azure AI resource
3
3
titleSuffix: Azure AI Studio
4
4
description: This article describes how to create and manage an Azure AI resource
5
-
manager: nitinme
5
+
manager: scottpolly
6
6
ms.service: azure-ai-studio
7
7
ms.custom:
8
8
- ignite-2023
9
9
ms.topic: how-to
10
10
ms.date: 11/15/2023
11
-
ms.reviewer: eur
12
-
ms.author: eur
13
-
author: eric-urban
11
+
ms.reviewer: deeikele
12
+
ms.author: larryfr
13
+
author: Blackmist
14
14
---
15
15
16
16
# How to create and manage an Azure AI resource
@@ -41,35 +41,35 @@ Follow these steps to create a new Azure AI resource in AI Studio.
41
41
If your organization is using [Azure Policy](../../governance/policy/overview.md), setup a resource that meets your organization's requirements instead of using AI Studio for resource creation.
42
42
43
43
1. From the Azure portal, search for `Azure AI Studio` and create a new resource by selecting **+ New Azure AI**
44
-
1.Fill in **Subscription**, **Resource group**, and **Region**. **Name** your new Azure AI resource.
44
+
1.Fill in **Subscription**, **Resource group**, and **Region**. **Name** your new Azure AI resource.
45
45
- For advanced settings, select **Next: Resources** to specify resources, networking, encryption, identity, and tags.
46
46
- Your subscription must have access to Azure AI to create this resource.
47
47
48
-
:::image type="content" source="../media/how-to/resource-create-basics.png" alt-text="Screenshot of the option to set Azure AI resource basic information." lightbox="../media/how-to/resource-create-basics.png":::
48
+
:::image type="content" source="../media/how-to/resource-create-basics.png" alt-text="Screenshot of the option to set Azure AI resource basic information." lightbox="../media/how-to/resource-create-basics.png":::
49
49
50
-
1.Select an existing **Azure AI services** or create a new one. New Azure AI services include multiple API endpoints for Speech, Content Safety and Azure OpenAI. You can also bring an existing Azure OpenAI resource. Optionally, choose an existing **Storage account**, **Key vault**, **Container Registry**, and **Application insights** to host artifacts generated when you use AI Studio.
50
+
1.Select an existing **Azure AI services** or create a new one. New Azure AI services include multiple API endpoints for Speech, Content Safety and Azure OpenAI. You can also bring an existing Azure OpenAI resource. Optionally, choose an existing **Storage account**, **Key vault**, **Container Registry**, and **Application insights** to host artifacts generated when you use AI Studio.
51
51
52
52
:::image type="content" source="../media/how-to/resource-create-resources.png" alt-text="Screenshot of the Create an Azure AI resource with the option to set resource information." lightbox="../media/how-to/resource-create-resources.png":::
53
53
54
-
1.Set up Network isolation. Read more on [network isolation](configure-managed-network.md).
54
+
1.Set up Network isolation. Read more on [network isolation](configure-managed-network.md).
55
55
56
56
:::image type="content" source="../media/how-to/resource-create-networking.png" alt-text="Screenshot of the Create an Azure AI resource with the option to set network isolation information." lightbox="../media/how-to/resource-create-networking.png":::
57
57
58
-
1.Set up data encryption. You can either use **Microsoft-managed keys** or enable **Customer-managed keys**.
58
+
1.Set up data encryption. You can either use **Microsoft-managed keys** or enable **Customer-managed keys**.
59
59
60
60
:::image type="content" source="../media/how-to/resource-create-encryption.png" alt-text="Screenshot of the Create an Azure AI resource with the option to select your encryption type." lightbox="../media/how-to/resource-create-encryption.png":::
61
61
62
-
1.By default, **System assigned identity** is enabled, but you can switch to **User assigned identity** if existing storage, key vault, and container registry are selected in Resources.
62
+
1.By default, **System assigned identity** is enabled, but you can switch to **User assigned identity** if existing storage, key vault, and container registry are selected in Resources.
63
63
64
64
:::image type="content" source="../media/how-to/resource-create-identity.png" alt-text="Screenshot of the Create an Azure AI resource with the option to select a managed identity." lightbox="../media/how-to/resource-create-identity.png":::
65
65
>[!Note]
66
66
>If you select **User assigned identity**, your identity needs to have the `Cognitive Services Contributor` role in order to successfully create a new Azure AI resource.
67
67
68
-
1.Add tags.
68
+
1.Add tags.
69
69
70
70
:::image type="content" source="../media/how-to/resource-create-tags.png" alt-text="Screenshot of the Create an Azure AI resource with the option to add tags." lightbox="../media/how-to/resource-create-tags.png":::
71
71
72
-
1.Select **Review + create**
72
+
1.Select **Review + create**
73
73
74
74
75
75
## Manage your Azure AI resource from the Azure portal
@@ -84,17 +84,17 @@ View your keys and endpoints for your Azure AI resource from the overview page w
84
84
Manage role assignments from **Access control (IAM)** within the Azure portal. Learn more about Azure AI resource [role-based access control](../concepts/rbac-ai-studio.md).
85
85
86
86
To add grant users permissions:
87
-
1.Select **+ Add** to add users to your Azure AI resource
87
+
1.Select **+ Add** to add users to your Azure AI resource
88
88
89
-
1.Select the **Role** you want to assign.
89
+
1.Select the **Role** you want to assign.
90
90
91
91
:::image type="content" source="../media/how-to/resource-rbac-role.png" alt-text="Screenshot of the page to add a role within the Azure AI resource Azure portal view." lightbox="../media/how-to/resource-rbac-role.png":::
92
92
93
-
1.Select the **Members** you want to give the role to.
93
+
1.Select the **Members** you want to give the role to.
94
94
95
95
:::image type="content" source="../media/how-to/resource-rbac-members.png" alt-text="Screenshot of the add members page within the Azure AI resource Azure portal view." lightbox="../media/how-to/resource-rbac-members.png":::
96
96
97
-
1.**Review + assign**. It can take up to an hour for permissions to be applied to users.
97
+
1.**Review + assign**. It can take up to an hour for permissions to be applied to users.
98
98
99
99
### Networking
100
100
Azure AI resource networking settings can be set during resource creation or changed in the Networking tab in the Azure portal view. Creating a new Azure AI resource invokes a Managed Virtual Network. This streamlines and automates your network isolation configuration with a built-in Managed Virtual Network. The Managed Virtual Network settings are applied to all projects created within an Azure AI resource.
@@ -131,8 +131,8 @@ You can view all Projects that use this Azure AI resource. Be linked to the Azur
131
131
### Permissions
132
132
Within Permissions you can view who has access to the Azure AI resource and also manage permissions. Learn more about [permissions](../concepts/rbac-ai-studio.md).
133
133
To add members:
134
-
1.Select **+ Add member**
135
-
1.Enter the member's name in **Add member** and assign a **Role**. For most users, we recommend the AI Developer role. This permission applies to the entire Azure AI resource. If you wish to only grant access to a specific Project, manage permissions in the [Project](create-projects.md)
134
+
1.Select **+ Add member**
135
+
1.Enter the member's name in **Add member** and assign a **Role**. For most users, we recommend the AI Developer role. This permission applies to the entire Azure AI resource. If you wish to only grant access to a specific Project, manage permissions in the [Project](create-projects.md)
136
136
137
137
### Compute instances
138
138
View and manage computes for your Azure AI resource. Create computes, delete computes, and review all compute resources you have in one place.
0 commit comments