Merge pull request #236003 from santiagxf/santiagxf/mlflow-permissions

Update how-to-use-mlflow-configure-tracking.md

Author: prmerger-automator[bot]

articles/machine-learning/how-to-use-mlflow-configure-tracking.md

@@ -54,6 +54,19 @@ The Azure Machine Learning plugin for MLflow supports several authentication mec
 If you'd rather use a certificate instead of a secret, you can configure the environment variables `AZURE_CLIENT_CERTIFICATE_PATH` to the path to a `PEM` or `PKCS12` certificate file (including private key) and 
 `AZURE_CLIENT_CERTIFICATE_PASSWORD` with the password of the certificate file, if any.
 
+### Configure authorization and permission levels
+
+Some default roles like [AzureML Data Scientist or contributor](how-to-assign-roles.md#default-roles) are already configured to perform MLflow operations in an Azure Machine Learning workspace. If using a custom roles, you need the following permissions:
+
+* **To use MLflow tracking:** 
+    * `Microsoft.MachineLearningServices/workspaces/experiments/*`.
+    * `Microsoft.MachineLearningServices/workspaces/jobs/*`.
+
+* **To use MLflow model registry:**
+    * `Microsoft.MachineLearningServices/workspaces/models/*/*`
+
+Grant access for the service principal you created or user account to your workspace as explained at [Grant access](../role-based-access-control/quickstart-assign-role-user-portal.md#grant-access).
+
 ### Troubleshooting authentication
 
 MLflow will try to authenticate to Azure Machine Learning on the first operation interacting with the service, like `mlflow.set_experiment()` or `mlflow.start_run()`. If you find issues or unexpected authentication prompts during the process, you can increase the logging level to get more details about the error: