Skip to content

Commit bd73bac

Browse files
rolyonrolyon
committed
Azure AI roles
1 parent 3949b6a commit bd73bac

File tree

2 files changed

+242
-0
lines changed

2 files changed

+242
-0
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,9 @@ The following table provides a brief description of each built-in role. Click th
221221
> [!div class="mx-tableFixed"]
222222
> | Built-in role | Description | ID |
223223
> | --- | --- | --- |
224+
> | <a name='azure-ai-developer'></a>[Azure AI Developer](./built-in-roles/ai-machine-learning.md#azure-ai-developer) | Can perform all actions within an Azure AI resource besides managing the resource itself. | 64702f94-c441-49e6-a78b-ef80e0188fee |
225+
> | <a name='azure-ai-enterprise-network-connection-approver'></a>[Azure AI Enterprise Network Connection Approver](./built-in-roles/ai-machine-learning.md#azure-ai-enterprise-network-connection-approver) | Can approve private endpoint connections to Azure AI common dependency resources | b556d68e-0be0-4f35-a333-ad7ee1ce17ea |
226+
> | <a name='azure-ai-inference-deployment-operator'></a>[Azure AI Inference Deployment Operator](./built-in-roles/ai-machine-learning.md#azure-ai-inference-deployment-operator) | Can perform all actions required to create a resource deployment within a resource group. | 3afb7f49-54cb-416e-8c09-6dc049efa503 |
224227
> | <a name='azureml-compute-operator'></a>[AzureML Compute Operator](./built-in-roles/ai-machine-learning.md#azureml-compute-operator) | Can access and perform CRUD operations on Machine Learning Services managed compute resources (including Notebook VMs). | e503ece1-11d0-4e8e-8e2c-7a6c3bf38815 |
225228
> | <a name='azureml-data-scientist'></a>[AzureML Data Scientist](./built-in-roles/ai-machine-learning.md#azureml-data-scientist) | Can perform all actions within an Azure Machine Learning workspace, except for creating or deleting compute resources and modifying the workspace itself. | f6c7c914-8db3-469d-8ca1-694a8f32e121 |
226229
> | <a name='cognitive-services-contributor'></a>[Cognitive Services Contributor](./built-in-roles/ai-machine-learning.md#cognitive-services-contributor) | Lets you create, read, update, delete and manage keys of Cognitive Services. | 25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68 |

‎articles/role-based-access-control/built-in-roles/ai-machine-learning.md

Lines changed: 239 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,245 @@ ms.custom: generated
1616
This article lists the Azure built-in roles in the AI + machine learning category.
1717

1818

19+
## Azure AI Developer
20+
21+
Can perform all actions within an Azure AI resource besides managing the resource itself.
22+
23+
[Learn more](/azure/ai-studio/concepts/rbac-ai-studio)
24+
25+
> [!div class="mx-tableFixed"]
26+
> | Actions | Description |
27+
> | --- | --- |
28+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/read | |
29+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/action | |
30+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/delete | |
31+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/write | |
32+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/locations/*/read | |
33+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
34+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
35+
> | **NotActions** | |
36+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/delete | Deletes the Machine Learning Services Workspace(s) |
37+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/write | Creates or updates a Machine Learning Services Workspace(s) |
38+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/listKeys/action | List secrets for a Machine Learning Services Workspace |
39+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/write | Creates or updates a Machine Learning Services Hub Workspace(s) |
40+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/delete | Deletes the Machine Learning Services Hub Workspace(s) |
41+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/write | Creates or Updates the Machine Learning Services FeatureStore(s) |
42+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/delete | Deletes the Machine Learning Services FeatureStore(s) |
43+
> | **DataActions** | |
44+
> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/* | |
45+
> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/* | |
46+
> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/ContentSafety/* | |
47+
> | **NotDataActions** | |
48+
> | *none* | |
49+
50+
```json
51+
{
52+
"assignableScopes": [
53+
"/"
54+
],
55+
"description": "Can perform all actions within an Azure AI resource besides managing the resource itself.",
56+
"id": "/providers/Microsoft.Authorization/roleDefinitions/64702f94-c441-49e6-a78b-ef80e0188fee",
57+
"name": "64702f94-c441-49e6-a78b-ef80e0188fee",
58+
"permissions": [
59+
{
60+
"actions": [
61+
"Microsoft.MachineLearningServices/workspaces/*/read",
62+
"Microsoft.MachineLearningServices/workspaces/*/action",
63+
"Microsoft.MachineLearningServices/workspaces/*/delete",
64+
"Microsoft.MachineLearningServices/workspaces/*/write",
65+
"Microsoft.MachineLearningServices/locations/*/read",
66+
"Microsoft.Authorization/*/read",
67+
"Microsoft.Resources/deployments/*"
68+
],
69+
"notActions": [
70+
"Microsoft.MachineLearningServices/workspaces/delete",
71+
"Microsoft.MachineLearningServices/workspaces/write",
72+
"Microsoft.MachineLearningServices/workspaces/listKeys/action",
73+
"Microsoft.MachineLearningServices/workspaces/hubs/write",
74+
"Microsoft.MachineLearningServices/workspaces/hubs/delete",
75+
"Microsoft.MachineLearningServices/workspaces/featurestores/write",
76+
"Microsoft.MachineLearningServices/workspaces/featurestores/delete"
77+
],
78+
"dataActions": [
79+
"Microsoft.CognitiveServices/accounts/OpenAI/*",
80+
"Microsoft.CognitiveServices/accounts/SpeechServices/*",
81+
"Microsoft.CognitiveServices/accounts/ContentSafety/*"
82+
],
83+
"notDataActions": []
84+
}
85+
],
86+
"roleName": "Azure AI Developer",
87+
"roleType": "BuiltInRole",
88+
"type": "Microsoft.Authorization/roleDefinitions"
89+
}
90+
```
91+
92+
## Azure AI Enterprise Network Connection Approver
93+
94+
Can approve private endpoint connections to Azure AI common dependency resources
95+
96+
[Learn more](/azure/machine-learning/how-to-managed-network)
97+
98+
> [!div class="mx-tableFixed"]
99+
> | Actions | Description |
100+
> | --- | --- |
101+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnectionsApproval/action | Auto Approves a Private Endpoint Connection |
102+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnections/read | Gets the properties of private endpoint connection or list all the private endpoint connections for the specified container registry |
103+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnections/write | Approves/Rejects the private endpoint connection |
104+
> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/read | View the Redis Cache's settings and configuration in the management portal |
105+
> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnections/read | Read a private endpoint connection |
106+
> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnections/write | Write a private endpoint connection |
107+
> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateLinkResources/read | Read 'groupId' of redis subresource that a private link can be connected to |
108+
> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |
109+
> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/read | View the Redis Enterprise cache's settings and configuration in the management portal |
110+
> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnections/read | Read a private endpoint connection |
111+
> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnections/write | Write a private endpoint connection |
112+
> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateLinkResources/read | Read 'groupId' of redis subresource that a private link can be connected to |
113+
> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |
114+
> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/read | Reads API accounts. |
115+
> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateEndpointConnections/read | Reads private endpoint connections. |
116+
> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateEndpointConnections/write | Writes a private endpoint connections. |
117+
> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateLinkResources/read | Reads private link resources for an account. |
118+
> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnectionsApproval/action | Manage a private endpoint connection of Database Account |
119+
> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/read | Read a private endpoint connection or list all the private endpoint connections of a Database Account |
120+
> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/write | Create or update a private endpoint connection of a Database Account |
121+
> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateLinkResources/read | Read a private link resource or list all the private link resources of a Database Account |
122+
> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/read | Reads a database account. |
123+
> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |
124+
> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |
125+
> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |
126+
> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateLinkResources/read | Get the available private link resources for the specified instance of Key Vault |
127+
> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/read | View the properties of a key vault |
128+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |
129+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |
130+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |
131+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateLinkResources/read | Gets the available private link resources for the specified instance of the Machine Learning Services Workspace(s) |
132+
> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/read | Gets the Machine Learning Services Workspace(s) |
133+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateEndpointConnections/read | Get Private Endpoint Connection |
134+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateEndpointConnections/write | Put Private Endpoint Connection |
135+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateLinkResources/read | Get StorageAccount groupids |
136+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/read | Returns the list of storage accounts or gets the properties for the specified storage account. |
137+
> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection |
138+
> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection. |
139+
> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |
140+
> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateLinkResources/read | Get the private link resources for the corresponding sql server |
141+
> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/read | Return the list of servers or gets the properties for the specified server. |
142+
> | **NotActions** | |
143+
> | *none* | |
144+
> | **DataActions** | |
145+
> | *none* | |
146+
> | **NotDataActions** | |
147+
> | *none* | |
148+
149+
```json
150+
{
151+
"assignableScopes": [
152+
"/"
153+
],
154+
"description": "Can approve private endpoint connections to Azure AI common dependency resources",
155+
"id": "/providers/Microsoft.Authorization/roleDefinitions/b556d68e-0be0-4f35-a333-ad7ee1ce17ea",
156+
"name": "b556d68e-0be0-4f35-a333-ad7ee1ce17ea",
157+
"permissions": [
158+
{
159+
"actions": [
160+
"Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",
161+
"Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
162+
"Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",
163+
"Microsoft.Cache/redis/read",
164+
"Microsoft.Cache/redis/privateEndpointConnections/read",
165+
"Microsoft.Cache/redis/privateEndpointConnections/write",
166+
"Microsoft.Cache/redis/privateLinkResources/read",
167+
"Microsoft.Cache/redis/privateEndpointConnectionsApproval/action",
168+
"Microsoft.Cache/redisEnterprise/read",
169+
"Microsoft.Cache/redisEnterprise/privateEndpointConnections/read",
170+
"Microsoft.Cache/redisEnterprise/privateEndpointConnections/write",
171+
"Microsoft.Cache/redisEnterprise/privateLinkResources/read",
172+
"Microsoft.Cache/redisEnterprise/privateEndpointConnectionsApproval/action",
173+
"Microsoft.CognitiveServices/accounts/read",
174+
"Microsoft.CognitiveServices/accounts/privateEndpointConnections/read",
175+
"Microsoft.CognitiveServices/accounts/privateEndpointConnections/write",
176+
"Microsoft.CognitiveServices/accounts/privateLinkResources/read",
177+
"Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionsApproval/action",
178+
"Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/read",
179+
"Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write",
180+
"Microsoft.DocumentDB/databaseAccounts/privateLinkResources/read",
181+
"Microsoft.DocumentDB/databaseAccounts/read",
182+
"Microsoft.KeyVault/vaults/privateEndpointConnectionsApproval/action",
183+
"Microsoft.KeyVault/vaults/privateEndpointConnections/read",
184+
"Microsoft.KeyVault/vaults/privateEndpointConnections/write",
185+
"Microsoft.KeyVault/vaults/privateLinkResources/read",
186+
"Microsoft.KeyVault/vaults/read",
187+
"Microsoft.MachineLearningServices/workspaces/privateEndpointConnectionsApproval/action",
188+
"Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read",
189+
"Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write",
190+
"Microsoft.MachineLearningServices/workspaces/privateLinkResources/read",
191+
"Microsoft.MachineLearningServices/workspaces/read",
192+
"Microsoft.Storage/storageAccounts/privateEndpointConnections/read",
193+
"Microsoft.Storage/storageAccounts/privateEndpointConnections/write",
194+
"Microsoft.Storage/storageAccounts/privateLinkResources/read",
195+
"Microsoft.Storage/storageAccounts/read",
196+
"Microsoft.Sql/servers/privateEndpointConnectionsApproval/action",
197+
"Microsoft.Sql/servers/privateEndpointConnections/read",
198+
"Microsoft.Sql/servers/privateEndpointConnections/write",
199+
"Microsoft.Sql/servers/privateLinkResources/read",
200+
"Microsoft.Sql/servers/read"
201+
],
202+
"notActions": [],
203+
"dataActions": [],
204+
"notDataActions": []
205+
}
206+
],
207+
"roleName": "Azure AI Enterprise Network Connection Approver",
208+
"roleType": "BuiltInRole",
209+
"type": "Microsoft.Authorization/roleDefinitions"
210+
}
211+
```
212+
213+
## Azure AI Inference Deployment Operator
214+
215+
Can perform all actions required to create a resource deployment within a resource group.
216+
217+
[Learn more](/azure/ai-studio/concepts/rbac-ai-studio)
218+
219+
> [!div class="mx-tableFixed"]
220+
> | Actions | Description |
221+
> | --- | --- |
222+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
223+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
224+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AutoscaleSettings/write | Create or update an autoscale setting |
225+
> | **NotActions** | |
226+
> | *none* | |
227+
> | **DataActions** | |
228+
> | *none* | |
229+
> | **NotDataActions** | |
230+
> | *none* | |
231+
232+
```json
233+
{
234+
"assignableScopes": [
235+
"/"
236+
],
237+
"description": "Can perform all actions required to create a resource deployment within a resource group.",
238+
"id": "/providers/Microsoft.Authorization/roleDefinitions/3afb7f49-54cb-416e-8c09-6dc049efa503",
239+
"name": "3afb7f49-54cb-416e-8c09-6dc049efa503",
240+
"permissions": [
241+
{
242+
"actions": [
243+
"Microsoft.Authorization/*/read",
244+
"Microsoft.Resources/deployments/*",
245+
"Microsoft.Insights/AutoscaleSettings/write"
246+
],
247+
"notActions": [],
248+
"dataActions": [],
249+
"notDataActions": []
250+
}
251+
],
252+
"roleName": "Azure AI Inference Deployment Operator",
253+
"roleType": "BuiltInRole",
254+
"type": "Microsoft.Authorization/roleDefinitions"
255+
}
256+
```
257+
19258
## AzureML Compute Operator
20259

21260
Can access and perform CRUD operations on Machine Learning Services managed compute resources (including Notebook VMs).

0 commit comments

Comments
 (0)