Skip to content

Commit e1700b0

Browse files
authored
Merge pull request #268815 from sdgilley/sdg-data-labeling
Update how-to-add-users
2 parents ddc3abd + f728d84 commit e1700b0

File tree

5 files changed

+172
-174
lines changed

5 files changed

+172
-174
lines changed

articles/machine-learning/how-to-add-users.md

Lines changed: 43 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@ ms.reviewer: sgilley
88
ms.service: machine-learning
99
ms.subservice: mldata
1010
ms.topic: how-to
11-
ms.date: 02/08/2023
11+
ms.date: 03/12/2024
12+
# customer intent: As a data labeling project manager, I want to add users to my data labeling project so that they can label data, but with restricted permissions.
1213
---
1314

1415
# Add users to your data labeling project
@@ -28,27 +29,40 @@ You need certain permission levels to follow the steps in this article. If you c
2829

2930
## Add custom role
3031

31-
To add a custom role, you must have `Microsoft.Authorization/roleAssignments/write` permissions for your subscription - for example, [User Access Administrator](../../articles/role-based-access-control/built-in-roles.md).
32+
When you add a user to your project, you assign them a role to define their level of access. Before you add users, define the roles you want to use.
3233

33-
1. Open your workspace in [Azure Machine Learning studio](https://ml.azure.com)
34-
1. Open the menu on the top right, and select **View all properties in Azure Portal**. You use the Azure portal for the remaining steps in this article.
35-
1. Select the **Resource group** link in the middle of the page.
36-
1. On the left, select **Access control (IAM)**.
37-
1. At the top, select **+ Add > Add custom role**.
38-
1. For the **Custom role name**, type the name you want to use. For example, **Labeler**.
39-
1. In the **Description** box, add a description. For example, **Labeler access for data labeling projects**.
40-
1. Select **Start from JSON**.
41-
1. At the bottom of the page, select **Next**.
42-
1. Don't do anything for the **Permissions** tab. You add permissions in a later step. Select **Next**.
43-
1. The **Assignable scopes** tab shows your subscription information. Select **Next**.
44-
1. In the **JSON** tab, above the edit box, select **Edit**.
45-
1. Select lines starting with **"actions:"** and **"notActions:"**.
34+
There is a built-in role for data labeling, scoped only to labeling data. If you want to use the built-in role for all your labelers, skip this section and proceed to [add guest user](#add-guest-user).
35+
36+
The following custom roles give other levels of access for a data labeling project. Define all the roles you want to use before moving on to add the users.
37+
38+
To add a custom role, you must have `Microsoft.Authorization/roleAssignments/write` permissions for your subscription - for example, [User Access Administrator](../../articles/role-based-access-control/built-in-roles.md).
4639

47-
:::image type="content" source="media/how-to-add-users/replace-lines.png" alt-text="Create custom role: select lines to replace them in the editor.":::
40+
1. Access the resource group for your workspace in the Azure portal.
41+
1. Open your workspace in [Azure Machine Learning studio](https://ml.azure.com).
42+
1. Open the menu on the top right, and select **View all properties in Azure Portal**. You use the Azure portal for the remaining steps in this section.
43+
1. Select the **Resource group** link in the middle of the page.
44+
1. Add a custom role
45+
1. On the left, select **Access control (IAM)**.
46+
1. At the top, select **+ Add > Add custom role**.
47+
1. For the **Custom role name**, type the name you want to use. For example, **Labeling team lead**.
48+
1. In the **Description** box, add a description. For example, **Team leader for labeling projects**.
49+
1. Select **Start from JSON**.
50+
1. Ignore the **Select a file** entry, even though it is starred. You'll create the JSON in a future step.
51+
1. At the bottom of the page, select **Next**.
52+
1. Skip tabs.
53+
1. Don't do anything for the **Permissions** tab. You add permissions in a later step. Select **Next**.
54+
1. The **Assignable scopes** tab shows your subscription information. Select **Next**.
55+
1. Edit the JSON definition.
56+
1. In the **JSON** tab, above the edit box, select **Edit**.
57+
1. Select lines starting with **"actions:"** and **"notActions:"**.
4858

49-
1. Replace these two lines with the `Actions` and `NotActions` from the appropriate role listed at [Manage access to an Azure Machine Learning workspace](how-to-assign-roles.md#data-labeling). Make sure to copy from `Actions` through the closing bracket, `],`
59+
:::image type="content" source="media/how-to-add-users/replace-lines.png" alt-text="Create custom role: select lines to replace them in the editor.":::
5060

51-
1. Select **Save** at the top of the edit box to save your changes.
61+
1. Replace these two lines with the `Actions` and `NotActions` from the appropriate role in the following tabs. Make sure to copy from `Actions` through the closing bracket, `],`.
62+
63+
[!INCLUDE [custom-role-data-labeling](includes/custom-role-data-labeling.md)]
64+
65+
1. Select **Save** at the top of the edit box to save your changes.
5266

5367
> [!IMPORTANT]
5468
> Don't select **Next** until you've saved your edits.
@@ -59,7 +73,7 @@ To add a custom role, you must have `Microsoft.Authorization/roleAssignments/wri
5973

6074
## Add guest user
6175

62-
If your labelers are outside of your organization, add them, so they can access your workspace. If labelers are already inside your organization, skip this step.
76+
If your labelers are outside of your organization, add them, so they can access your workspace. If labelers are already inside your organization, skip this step and proceed to [add users to your workspace](#add-users-to-your-workspace).
6377

6478
To add a guest user, your organization's external collaboration settings need the correct configuration to allow you to invite guests.
6579

@@ -76,28 +90,26 @@ To add a guest user, your organization's external collaboration settings need th
7690

7791
:::image type="content" source="media/how-to-add-users/invite-user.png" alt-text="Invite guest user from Microsoft Entra ID.":::
7892

79-
Repeat these steps for each of your labelers. You can also use the link at the bottom of the **Invite user** box to invite multiple users in bulk.
93+
Repeat these steps for each of the guest users. Or use the link at the bottom of the **Invite user** box to invite multiple users in bulk.
8094

8195
> [!TIP]
82-
> Inform your labelers that they will receive this email. They must accept the invitation in order to gain access to your project.
96+
> Inform your labelers that they will receive an email. They must accept the invitation in order to gain access to your project.
8397
8498
## Add users to your workspace
8599

86-
Now that you added your labelers to the system, you can add them to your workspace.
100+
Once you have the appropriate users in your system and the role(s) defined, add the users to your workspace so that they can access your data labeling project.
87101

88102
To add users to your workspace, you must be an owner of the workspace.
89103

90-
1. In [Azure portal](https://portal.azure.com), in the top search field, type **Machine Learning**.
91-
1. Select **Machine Learning**.
92-
:::image type="content" source="media/how-to-manage-workspace/find-workspaces.png" alt-text="Search for Azure Machine Learning workspace.":::
93-
94-
1. Select the workspace that contains your data labeling project.
104+
1. Access your workspace in the Azure portal.
105+
1. Open your workspace in [Azure Machine Learning studio](https://ml.azure.com).
106+
1. Open the menu on the top right, and select **View all properties in Azure Portal**. You use the Azure portal for the remaining steps in this section.
95107
1. On the left, select **Access control (IAM)**.
96108
1. At the top, select **+ Add > Add role assignment**.
97109

98110
:::image type="content" source="media/how-to-add-users/add-role-assignment.png" alt-text="Add role assignment from your workspace.":::
99111

100-
1. Select the **Labeler** or **Labeling Team Lead** role in the list. Use **Search** if necessary to find it.
112+
1. Select the role you want to use from the list. Use **Search** if necessary to find it.
101113
1. Select **Next**.
102114
1. In the middle of the page, next to **Members**, select the **+ Select members** link.
103115
1. Select each of the users you want to add. Use **Search** if necessary to find them.
@@ -108,7 +120,7 @@ To add users to your workspace, you must be an owner of the workspace.
108120

109121
## For your labelers
110122

111-
Now, your labelers can begin labeling in your project. However, they still need information from you to access the project.
123+
Once labelers have been added as users in the workspace, they can begin labeling in your project. However, they still need information from you to access the project.
112124

113125
Be sure to create your labeling project before you contact your labelers.
114126

@@ -122,10 +134,10 @@ Send the following information to your labelers, after you fill in your workspac
122134
1. Open [Azure Machine Learning studio](https://ml.azure.com).
123135
1. Use the dropdown to select the workspace **\<workspace-name\>**.
124136
1. Select the **Label data** tool for **\<project-name\>**.
125-
:::image type="content" source="media/how-to-add-users/label-data.png" alt-text="Screenshot showing the label data tool.":::
137+
:::image type="content" source="media/how-to-add-users/label-data.png" alt-text="Screenshot shows the label data tool in a project.":::
126138
1. For more information about how to label data, see [Labeling images and text documents](how-to-label-data.md).
127139

128-
## Next steps
140+
## Related content
129141

130142
* Learn more about [working with a data labeling vendor company](how-to-outsource-data-labeling.md)
131143
* [Create an image labeling project and export labels](how-to-create-image-labeling-projects.md)

articles/machine-learning/how-to-assign-roles.md

Lines changed: 2 additions & 143 deletions
Original file line numberDiff line numberDiff line change
@@ -466,150 +466,9 @@ The workspace admin also cannot create a new role. It can only assign existing b
466466

467467
### Data labeling
468468

469-
# [Data labeler](#tab/labeler)
469+
There is a built-in role for data labeling, scoped only to labeling data. The following custom roles give other levels of access for a data labeling project.
470470

471-
Allows you to define a role scoped only to labeling data:
472-
473-
*labeler_custom_role.json* :
474-
475-
```json
476-
{
477-
"Name": "Labeler Custom",
478-
"IsCustom": true,
479-
"Description": "Can label data for Labeling",
480-
"Actions": [
481-
"Microsoft.MachineLearningServices/workspaces/read",
482-
"Microsoft.MachineLearningServices/workspaces/labeling/projects/read",
483-
"Microsoft.MachineLearningServices/workspaces/labeling/projects/summary/read",
484-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/read",
485-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/write"
486-
],
487-
"NotActions": [
488-
],
489-
"AssignableScopes": [
490-
"/subscriptions/<subscriptionId>"
491-
]
492-
}
493-
```
494-
495-
# [Labeling team lead](#tab/team-lead)
496-
497-
Allows you to review and reject the labeled dataset and view labeling insights. In addition to it, this role also allows you to perform the role of a labeler.
498-
499-
*labeling_team_lead_custom_role.json* :
500-
501-
```json
502-
{
503-
"Name": "Labeling Team Lead",
504-
"IsCustom": true,
505-
"Description": "Team lead for Labeling Projects",
506-
"Actions": [
507-
"Microsoft.MachineLearningServices/workspaces/read",
508-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/read",
509-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/write",
510-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/reject/action",
511-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/update/action",
512-
"Microsoft.MachineLearningServices/workspaces/labeling/projects/read",
513-
"Microsoft.MachineLearningServices/workspaces/labeling/projects/summary/read"
514-
],
515-
"NotActions": [
516-
"Microsoft.MachineLearningServices/workspaces/labeling/projects/write",
517-
"Microsoft.MachineLearningServices/workspaces/labeling/projects/delete",
518-
"Microsoft.MachineLearningServices/workspaces/labeling/export/action"
519-
],
520-
"AssignableScopes": [
521-
"/subscriptions/<subscriptionId>"
522-
]
523-
}
524-
```
525-
526-
# [Vendor account manager](#tab/vendor-admin)
527-
528-
A vendor account manager can help manage all the vendor roles and perform any labeling action. They can't modify projects or view MLAssist experiments.
529-
530-
*vendor_admin_role.json* :
531-
532-
```json
533-
{
534-
"Name": "Vendor account admin",
535-
"IsCustom": true,
536-
"Description": "Vendor account admin for Labeling Projects",
537-
"Actions": [
538-
"Microsoft.MachineLearningServices/workspaces/read",
539-
"Microsoft.MachineLearningServices/workspaces/experiments/runs/read",
540-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/read",
541-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/write",
542-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/reject/action",
543-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/update/action",
544-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/approve_unapprove/action",
545-
"Microsoft.MachineLearningServices/workspaces/labeling/projects/read",
546-
"Microsoft.MachineLearningServices/workspaces/labeling/projects/summary/read",
547-
"Microsoft.MachineLearningServices/workspaces/labeling/export/action",
548-
"Microsoft.MachineLearningServices/workspaces/datasets/registered/read"
549-
],
550-
"AssignableScopes": [
551-
"/subscriptions/<subscriptionId>"
552-
]
553-
}
554-
```
555-
556-
# [Customer QA](#tab/customer-qa)
557-
558-
A customer quality assurance role can view project dashboards, preview datasets, export a labeling project, and review submitted labels. This role can't submit labels.
559-
560-
*customer_qa_role.json* :
561-
562-
```json
563-
{
564-
"Name": "Customer QA",
565-
"IsCustom": true,
566-
"Description": "Customer QA for Labeling Projects",
567-
"Actions": [
568-
"Microsoft.MachineLearningServices/workspaces/read",
569-
"Microsoft.MachineLearningServices/workspaces/experiments/runs/read",
570-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/read",
571-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/reject/action",
572-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/approve_unapprove/action",
573-
"Microsoft.MachineLearningServices/workspaces/labeling/projects/read",
574-
"Microsoft.MachineLearningServices/workspaces/labeling/projects/summary/read",
575-
"Microsoft.MachineLearningServices/workspaces/labeling/export/action",
576-
"Microsoft.MachineLearningServices/workspaces/datasets/registered/read"
577-
],
578-
"AssignableScopes": [
579-
"/subscriptions/<subscriptionId>"
580-
]
581-
}
582-
```
583-
584-
# [Vendor QA](#tab/vendor-qa)
585-
586-
A vendor quality assurance role can perform a customer quality assurance role, but can't preview the dataset.
587-
588-
*vendor_qa_role.json*:
589-
590-
```json
591-
{
592-
"Name": "Vendor QA",
593-
"IsCustom": true,
594-
"Description": "Vendor QA for Labeling Projects",
595-
"Actions": [
596-
"Microsoft.MachineLearningServices/workspaces/read",
597-
"Microsoft.MachineLearningServices/workspaces/experiments/runs/read",
598-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/read",
599-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/reject/action",
600-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/update/action",
601-
"Microsoft.MachineLearningServices/workspaces/labeling/labels/approve_unapprove/action",
602-
"Microsoft.MachineLearningServices/workspaces/labeling/projects/read",
603-
"Microsoft.MachineLearningServices/workspaces/labeling/projects/summary/read",
604-
"Microsoft.MachineLearningServices/workspaces/labeling/export/action"
605-
],
606-
"AssignableScopes": [
607-
"/subscriptions/<subscriptionId>"
608-
]
609-
}
610-
```
611-
612-
---
471+
[!INCLUDE [custom-role-data-labeling](includes/custom-role-data-labeling.md)]
613472

614473
## Troubleshooting
615474

0 commit comments

Comments
 (0)