Microsoft's edit · Azure built-in roles · ai machine learning

77 author: rolyon

88 manager: femila

99 ms.author: rolyon

10 −ms.date: 04/25/2025

11 −ms.custom: generated

12 −---

13 −

14 −# Azure built-in roles for AI + machine learning

15 −

16 −This article lists the Azure built-in roles in the AI + machine learning category.

17 −

18 −

19 −## AgFood Platform Sensor Partner Contributor

20 −

21 −Provides contribute access to manage sensor related entities in AgFood Platform Service

22 −

23 −[Learn more](/azure/data-manager-for-agri/how-to-set-up-sensors-customer)

24 −

25 −> [!div class="mx-tableFixed"]

26 −> | Actions | Description |

27 −> | --- | --- |

28 −> | *none* | |

29 −> | **NotActions** | |

30 −> | *none* | |

31 −> | **DataActions** | |

32 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/sensorPartnerScope/* | |

33 −> | **NotDataActions** | |

34 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/sensorPartnerScope/sensors/delete | Deletes an existing AgFoodPlatform sensors resource restricted to caller's sensor partner scope. |

35 −

36 −```json

37 −{

38 − "assignableScopes": [

39 − "/"

40 − ],

41 − "description": "Provides contribute access to manage sensor related entities in AgFood Platform Service",

42 − "id": "/providers/Microsoft.Authorization/roleDefinitions/6b77f0a0-0d89-41cc-acd1-579c22c17a67",

43 − "name": "6b77f0a0-0d89-41cc-acd1-579c22c17a67",

44 − "permissions": [

45 − {

46 − "actions": [],

47 − "notActions": [],

48 − "dataActions": [

49 − "Microsoft.AgFoodPlatform/farmBeats/sensorPartnerScope/*"

50 − ],

51 − "notDataActions": [

52 − "Microsoft.AgFoodPlatform/farmBeats/sensorPartnerScope/sensors/delete"

53 − ]

54 − }

55 − ],

56 − "roleName": "AgFood Platform Sensor Partner Contributor",

57 − "roleType": "BuiltInRole",

58 − "type": "Microsoft.Authorization/roleDefinitions"

59 −}

60 −```

61 −

62 −## AgFood Platform Service Admin

63 −

64 −Provides admin access to AgFood Platform Service

65 −

66 −[Learn more](/azure/data-manager-for-agri/quickstart-install-data-manager-for-agriculture)

67 −

68 −> [!div class="mx-tableFixed"]

69 −> | Actions | Description |

70 −> | --- | --- |

71 −> | *none* | |

72 −> | **NotActions** | |

73 −> | *none* | |

74 −> | **DataActions** | |

75 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/* | Create, update, read and delete any AgFood Platform resources. |

76 −> | **NotDataActions** | |

77 −> | *none* | |

78 −

79 −```json

80 −{

81 − "assignableScopes": [

82 − "/"

83 − ],

84 − "description": "Provides admin access to AgFood Platform Service",

85 − "id": "/providers/Microsoft.Authorization/roleDefinitions/f8da80de-1ff9-4747-ad80-a19b7f6079e3",

86 − "name": "f8da80de-1ff9-4747-ad80-a19b7f6079e3",

87 − "permissions": [

88 − {

89 − "actions": [],

90 − "notActions": [],

91 − "dataActions": [

92 − "Microsoft.AgFoodPlatform/*"

93 − ],

94 − "notDataActions": []

95 − }

96 − ],

97 − "roleName": "AgFood Platform Service Admin",

98 − "roleType": "BuiltInRole",

99 − "type": "Microsoft.Authorization/roleDefinitions"

100 −}

101 −```

102 −

103 −## AgFood Platform Service Contributor

104 −

105 −Provides contribute access to AgFood Platform Service

106 −

107 −[Learn more](/azure/data-manager-for-agri/quickstart-install-data-manager-for-agriculture)

108 −

109 −> [!div class="mx-tableFixed"]

110 −> | Actions | Description |

111 −> | --- | --- |

112 −> | *none* | |

113 −> | **NotActions** | |

114 −> | *none* | |

115 −> | **DataActions** | |

116 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/action | |

117 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/read | Read any AgFood Platform resources. |

118 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/write | Create and update any AgFood Platform resources. |

119 −> | **NotDataActions** | |

120 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/farmers/write | Creates or Updates AgFoodPlatform farmers. |

121 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/deletionJobs/*/write | |

122 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/parties/write | Creates or Updates AgFoodPlatform parties. |

123 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/datasets/write | Creates or Updates AgFoodPlatform datasets. |

124 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/datasetRecords/write | Creates or Updates AgFoodPlatform Dataset Records. |

125 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/datasets/access/*/action | |

126 −

127 −```json

128 −{

129 − "assignableScopes": [

130 − "/"

131 − ],

132 − "description": "Provides contribute access to AgFood Platform Service",

133 − "id": "/providers/Microsoft.Authorization/roleDefinitions/8508508a-4469-4e45-963b-2518ee0bb728",

134 − "name": "8508508a-4469-4e45-963b-2518ee0bb728",

135 − "permissions": [

136 − {

137 − "actions": [],

138 − "notActions": [],

139 − "dataActions": [

140 − "Microsoft.AgFoodPlatform/*/action",

141 − "Microsoft.AgFoodPlatform/*/read",

142 − "Microsoft.AgFoodPlatform/*/write"

143 − ],

144 − "notDataActions": [

145 − "Microsoft.AgFoodPlatform/farmBeats/farmers/write",

146 − "Microsoft.AgFoodPlatform/farmBeats/deletionJobs/*/write",

147 − "Microsoft.AgFoodPlatform/farmBeats/parties/write",

148 − "Microsoft.AgFoodPlatform/farmBeats/datasets/write",

149 − "Microsoft.AgFoodPlatform/farmBeats/datasetRecords/write",

150 − "Microsoft.AgFoodPlatform/farmBeats/datasets/access/*/action"

151 − ]

152 − }

153 − ],

154 − "roleName": "AgFood Platform Service Contributor",

155 − "roleType": "BuiltInRole",

156 − "type": "Microsoft.Authorization/roleDefinitions"

157 −}

158 −```

159 −

160 −## AgFood Platform Service Reader

161 −

162 −Provides read access to AgFood Platform Service

163 −

164 −[Learn more](/azure/data-manager-for-agri/quickstart-install-data-manager-for-agriculture)

165 −

166 −> [!div class="mx-tableFixed"]

167 −> | Actions | Description |

168 −> | --- | --- |

169 −> | *none* | |

170 −> | **NotActions** | |

171 −> | *none* | |

172 −> | **DataActions** | |

173 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/list/action | |

174 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/read | Read any AgFood Platform resources. |

175 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/search/action | |

176 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/download/action | |

177 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/overlap/action | |

178 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/checkConsent/action | |

179 −> | **NotDataActions** | |

180 −> | *none* | |

181 −

182 −```json

183 −{

184 − "assignableScopes": [

185 − "/"

186 − ],

187 − "description": "Provides read access to AgFood Platform Service",

188 − "id": "/providers/Microsoft.Authorization/roleDefinitions/7ec7ccdc-f61e-41fe-9aaf-980df0a44eba",

189 − "name": "7ec7ccdc-f61e-41fe-9aaf-980df0a44eba",

190 − "permissions": [

191 − {

192 − "actions": [],

193 − "notActions": [],

194 − "dataActions": [

195 − "Microsoft.AgFoodPlatform/*/list/action",

196 − "Microsoft.AgFoodPlatform/*/read",

197 − "Microsoft.AgFoodPlatform/*/search/action",

198 − "Microsoft.AgFoodPlatform/*/download/action",

199 − "Microsoft.AgFoodPlatform/*/overlap/action",

200 − "Microsoft.AgFoodPlatform/*/checkConsent/action"

201 − ],

202 − "notDataActions": []

203 − }

204 − ],

205 − "roleName": "AgFood Platform Service Reader",

206 − "roleType": "BuiltInRole",

207 − "type": "Microsoft.Authorization/roleDefinitions"

208 −}

209 −```

210 −

211 −## Azure AI Developer

212 −

213 −Can perform all actions within an Azure AI resource besides managing the resource itself.

214 −

215 −[Learn more](/azure/ai-studio/concepts/rbac-ai-studio)

216 −

217 −> [!div class="mx-tableFixed"]

218 −> | Actions | Description |

219 −> | --- | --- |

220 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/read | |

221 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/action | |

222 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/delete | |

223 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/write | |

224 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/locations/*/read | |

225 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

226 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

227 −> | **NotActions** | |

228 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/delete | Deletes the Machine Learning Services Workspace(s) |

229 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/write | Creates or updates a Machine Learning Services Workspace(s) |

230 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/listKeys/action | List secrets for a Machine Learning Services Workspace |

231 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/write | Creates or updates a Machine Learning Services Hub Workspace(s) |

232 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/delete | Deletes the Machine Learning Services Hub Workspace(s) |

233 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/write | Creates or Updates the Machine Learning Services FeatureStore(s) |

234 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/delete | Deletes the Machine Learning Services FeatureStore(s) |

235 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/evaluations/results/labels/read | Reads evaluation results' label from a Machine Learning Services Workspace |

236 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/evaluations/results/reasonings/read | Reads evaluation results' reasoning from a Machine Learning Services Workspace |

237 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/simulations/results/images/read | Reads image simulation results from a Machine Learning Services Workspace |

238 −> | **DataActions** | |

239 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/* | |

240 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/* | |

241 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/ContentSafety/* | |

242 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/MaaS/* | |

243 −> | **NotDataActions** | |

244 −> | *none* | |

245 −

246 −```json

247 −{

248 − "assignableScopes": [

249 − "/"

250 − ],

251 − "description": "Can perform all actions within an Azure AI resource besides managing the resource itself.",

252 − "id": "/providers/Microsoft.Authorization/roleDefinitions/64702f94-c441-49e6-a78b-ef80e0188fee",

253 − "name": "64702f94-c441-49e6-a78b-ef80e0188fee",

254 − "permissions": [

255 − {

256 − "actions": [

257 − "Microsoft.MachineLearningServices/workspaces/*/read",

258 − "Microsoft.MachineLearningServices/workspaces/*/action",

259 − "Microsoft.MachineLearningServices/workspaces/*/delete",

260 − "Microsoft.MachineLearningServices/workspaces/*/write",

261 − "Microsoft.MachineLearningServices/locations/*/read",

262 − "Microsoft.Authorization/*/read",

263 − "Microsoft.Resources/deployments/*"

264 − ],

265 − "notActions": [

266 − "Microsoft.MachineLearningServices/workspaces/delete",

267 − "Microsoft.MachineLearningServices/workspaces/write",

268 − "Microsoft.MachineLearningServices/workspaces/listKeys/action",

269 − "Microsoft.MachineLearningServices/workspaces/hubs/write",

270 − "Microsoft.MachineLearningServices/workspaces/hubs/delete",

271 − "Microsoft.MachineLearningServices/workspaces/featurestores/write",

272 − "Microsoft.MachineLearningServices/workspaces/featurestores/delete",

273 − "Microsoft.MachineLearningServices/workspaces/evaluations/results/labels/read",

274 − "Microsoft.MachineLearningServices/workspaces/evaluations/results/reasonings/read",

275 − "Microsoft.MachineLearningServices/workspaces/simulations/results/images/read"

276 − ],

277 − "dataActions": [

278 − "Microsoft.CognitiveServices/accounts/OpenAI/*",

279 − "Microsoft.CognitiveServices/accounts/SpeechServices/*",

280 − "Microsoft.CognitiveServices/accounts/ContentSafety/*",

281 − "Microsoft.CognitiveServices/accounts/MaaS/*"

282 − ],

283 − "notDataActions": []

284 − }

285 − ],

286 − "roleName": "Azure AI Developer",

287 − "roleType": "BuiltInRole",

288 − "type": "Microsoft.Authorization/roleDefinitions"

289 −}

290 −```

291 −

292 −## Azure AI Enterprise Network Connection Approver

293 −

294 −Can approve private endpoint connections to Azure AI common dependency resources

295 −

296 −[Learn more](/azure/machine-learning/how-to-managed-network)

297 −

298 −> [!div class="mx-tableFixed"]

299 −> | Actions | Description |

300 −> | --- | --- |

301 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/privateEndpointConnections/read | Get Private Endpoint Connections |

302 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/privateEndpointConnections/write | Approve Or Reject Private Endpoint Connections |

303 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/privateLinkResources/read | Get Private Link Group resources |

304 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/read | Read metadata for an API Management Service instance |

305 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnectionsApproval/action | Auto Approves a Private Endpoint Connection |

306 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnections/read | Gets the properties of private endpoint connection or list all the private endpoint connections for the specified container registry |

307 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnections/write | Approves/Rejects the private endpoint connection |

308 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/read | View the Redis Cache's settings and configuration in the management portal |

309 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnections/read | Read a private endpoint connection |

310 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnections/write | Write a private endpoint connection |

311 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateLinkResources/read | Read 'groupId' of redis subresource that a private link can be connected to |

312 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |

313 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/read | View the Redis Enterprise cache's settings and configuration in the management portal |

314 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnections/read | Read a private endpoint connection |

315 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnections/write | Write a private endpoint connection |

316 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateLinkResources/read | Read 'groupId' of redis subresource that a private link can be connected to |

317 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |

318 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/read | Reads API accounts. |

319 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateEndpointConnections/read | Reads private endpoint connections. |

320 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateEndpointConnections/write | Writes a private endpoint connections. |

321 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateLinkResources/read | Reads private link resources for an account. |

322 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateEndpointConnectionsApproval/action | Determines if the user is allowed to approve a private endpoint connection |

323 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection. |

324 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |

325 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateLinkResources/read | Return a list containing private link resource or gets the specified private link resource. |

326 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/read | Return the list of servers or gets the properties for the specified server. |

327 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection for PostgreSQL SGv2 |

328 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection |

329 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |

330 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateLinkResources/read | Get the private link resources for the corresponding PostgreSQL SGv2 |

331 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection |

332 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateEndpointConnections/read | |

333 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |

334 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateLinkResources/read | Get the private link resources for the corresponding MySQL Server |

335 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/read | Returns the list of servers or gets the properties for the specified server. |

336 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnectionsApproval/action | Manage a private endpoint connection of Database Account |

337 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/read | Read a private endpoint connection or list all the private endpoint connections of a Database Account |

338 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/write | Create or update a private endpoint connection of a Database Account |

339 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateLinkResources/read | Read a private link resource or list all the private link resources of a Database Account |

340 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/read | Reads a database account. |

341 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |

342 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

343 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

344 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateLinkResources/read | Get the available private link resources for the specified instance of Key Vault |

345 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/read | View the properties of a key vault |

346 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |

347 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

348 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

349 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateLinkResources/read | Gets the available private link resources for the specified instance of the Machine Learning Services registry(ies) |

350 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/read | Gets the Machine Learning Services registry(ies) |

351 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |

352 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

353 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

354 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateLinkResources/read | Gets the available private link resources for the specified instance of the Machine Learning Services Workspace(s) |

355 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/read | Gets the Machine Learning Services Workspace(s) |

356 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateEndpointConnections/read | Get Private Endpoint Connection |

357 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateEndpointConnections/write | Put Private Endpoint Connection |

358 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateLinkResources/read | Get StorageAccount groupids |

359 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/read | Returns the list of storage accounts or gets the properties for the specified storage account. |

360 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/PrivateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |

361 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection |

362 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection. |

363 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |

364 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateLinkResources/read | Get the private link resources for the corresponding sql server |

365 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/read | Return the list of servers or gets the properties for the specified server. |

366 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connection |

367 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateEndpointConnections/read | Get Private Endpoint Connection |

368 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateEndpointConnections/write | Create or Update Private Endpoint Connection |

369 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateLinkResources/read | Gets the resource types that support private endpoint connections |

370 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/read | Get the list of Namespace Resource Description |

371 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connection |

372 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connections |

373 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnections/write | Creates a private endpoint connections with the specified parameters or updates the properties or tags for the specified private endpoint connections |

374 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/sharedPrivateLinkResources/read | Returns the list of shared private link resources or gets the properties for the specified shared private link resource |

375 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/read | Reads the search service. |

376 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |

377 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateEndpointConnections/read | Read a private endpoint connection |

378 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateEndpointConnections/write | Create or update a private endpoint connection |

379 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateLinkResources/read | Read a private link resource |

380 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/read | Read a private link scope |

381 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/privateEndpointConnectionsApproval/action | Approve or reject PrivateEndpoint connection on PrivateLinkService |

382 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/privateEndpointConnections/read | Gets an private endpoint connection definition. |

383 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/privateEndpointConnections/write | Creates a new private endpoint connection, or updates an existing private endpoint connection. |

384 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/read | Gets an private link service resource. |

385 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/privateEndpointConnections/read | Gets Application Gateway PrivateEndpoint Connections |

386 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/privateEndpointConnections/write | Updates Application Gateway PrivateEndpoint Connection |

387 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/privateLinkResources/read | Gets ApplicationGateway PrivateLink Resources |

388 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/read | Gets an application gateway |

389 −> | **NotActions** | |

390 −> | *none* | |

391 −> | **DataActions** | |

392 −> | *none* | |

393 −> | **NotDataActions** | |

394 −> | *none* | |

395 −

396 −```json

397 −{

398 − "assignableScopes": [

399 − "/"

400 − ],

401 − "description": "Can approve private endpoint connections to Azure AI common dependency resources",

402 − "id": "/providers/Microsoft.Authorization/roleDefinitions/b556d68e-0be0-4f35-a333-ad7ee1ce17ea",

403 − "name": "b556d68e-0be0-4f35-a333-ad7ee1ce17ea",

404 − "permissions": [

405 − {

406 − "actions": [

407 − "Microsoft.ApiManagement/service/privateEndpointConnections/read",

408 − "Microsoft.ApiManagement/service/privateEndpointConnections/write",

409 − "Microsoft.ApiManagement/service/privateLinkResources/read",

410 − "Microsoft.ApiManagement/service/read",

411 − "Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",

412 − "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",

413 − "Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",

414 − "Microsoft.Cache/redis/read",

415 − "Microsoft.Cache/redis/privateEndpointConnections/read",

416 − "Microsoft.Cache/redis/privateEndpointConnections/write",

417 − "Microsoft.Cache/redis/privateLinkResources/read",

418 − "Microsoft.Cache/redis/privateEndpointConnectionsApproval/action",

419 − "Microsoft.Cache/redisEnterprise/read",

420 − "Microsoft.Cache/redisEnterprise/privateEndpointConnections/read",

421 − "Microsoft.Cache/redisEnterprise/privateEndpointConnections/write",

422 − "Microsoft.Cache/redisEnterprise/privateLinkResources/read",

423 − "Microsoft.Cache/redisEnterprise/privateEndpointConnectionsApproval/action",

424 − "Microsoft.CognitiveServices/accounts/read",

425 − "Microsoft.CognitiveServices/accounts/privateEndpointConnections/read",

426 − "Microsoft.CognitiveServices/accounts/privateEndpointConnections/write",

427 − "Microsoft.CognitiveServices/accounts/privateLinkResources/read",

428 − "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnectionsApproval/action",

429 − "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read",

430 − "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/write",

431 − "Microsoft.DBforPostgreSQL/flexibleServers/privateLinkResources/read",

432 − "Microsoft.DBforPostgreSQL/flexibleServers/read",

433 − "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnectionsApproval/action",

434 − "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/read",

435 − "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/write",

436 − "Microsoft.DBforPostgreSQL/serverGroupsv2/privateLinkResources/read",

437 − "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnectionsApproval/action",

438 − "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/read",

439 − "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/write",

440 − "Microsoft.DBforMySQL/flexibleServers/privateLinkResources/read",

441 − "Microsoft.DBforMySQL/flexibleServers/read",

442 − "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionsApproval/action",

443 − "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/read",

444 − "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write",

445 − "Microsoft.DocumentDB/databaseAccounts/privateLinkResources/read",

446 − "Microsoft.DocumentDB/databaseAccounts/read",

447 − "Microsoft.KeyVault/vaults/privateEndpointConnectionsApproval/action",

448 − "Microsoft.KeyVault/vaults/privateEndpointConnections/read",

449 − "Microsoft.KeyVault/vaults/privateEndpointConnections/write",

450 − "Microsoft.KeyVault/vaults/privateLinkResources/read",

451 − "Microsoft.KeyVault/vaults/read",

452 − "Microsoft.MachineLearningServices/registries/privateEndpointConnectionsApproval/action",

453 − "Microsoft.MachineLearningServices/registries/privateEndpointConnections/read",

454 − "Microsoft.MachineLearningServices/registries/privateEndpointConnections/write",

455 − "Microsoft.MachineLearningServices/registries/privateLinkResources/read",

456 − "Microsoft.MachineLearningServices/registries/read",

457 − "Microsoft.MachineLearningServices/workspaces/privateEndpointConnectionsApproval/action",

458 − "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read",

459 − "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write",

460 − "Microsoft.MachineLearningServices/workspaces/privateLinkResources/read",

461 − "Microsoft.MachineLearningServices/workspaces/read",

462 − "Microsoft.Storage/storageAccounts/privateEndpointConnections/read",

463 − "Microsoft.Storage/storageAccounts/privateEndpointConnections/write",

464 − "Microsoft.Storage/storageAccounts/privateLinkResources/read",

465 − "Microsoft.Storage/storageAccounts/read",

466 − "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",

467 − "Microsoft.Sql/servers/privateEndpointConnectionsApproval/action",

468 − "Microsoft.Sql/servers/privateEndpointConnections/read",

469 − "Microsoft.Sql/servers/privateEndpointConnections/write",

470 − "Microsoft.Sql/servers/privateLinkResources/read",

471 − "Microsoft.Sql/servers/read",

472 − "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",

473 − "Microsoft.EventHub/namespaces/privateEndpointConnections/read",

474 − "Microsoft.EventHub/namespaces/privateEndpointConnections/write",

475 − "Microsoft.EventHub/namespaces/privateLinkResources/read",

476 − "Microsoft.EventHub/namespaces/read",

477 − "Microsoft.Search/searchServices/privateEndpointConnectionsApproval/action",

478 − "Microsoft.Search/searchServices/privateEndpointConnections/read",

479 − "Microsoft.Search/searchServices/privateEndpointConnections/write",

480 − "Microsoft.Search/searchServices/sharedPrivateLinkResources/read",

481 − "Microsoft.Search/searchServices/read",

482 − "Microsoft.Insights/privatelinkscopes/privateEndpointConnectionsApproval/action",

483 − "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/read",

484 − "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/write",

485 − "Microsoft.Insights/privatelinkscopes/privateLinkResources/read",

486 − "Microsoft.Insights/privatelinkscopes/read",

487 − "Microsoft.Network/privateLinkServices/privateEndpointConnectionsApproval/action",

488 − "Microsoft.Network/privateLinkServices/privateEndpointConnections/read",

489 − "Microsoft.Network/privateLinkServices/privateEndpointConnections/write",

490 − "Microsoft.Network/privateLinkServices/read",

491 − "Microsoft.Network/applicationGateways/privateEndpointConnections/read",

492 − "Microsoft.Network/applicationGateways/privateEndpointConnections/write",

493 − "Microsoft.Network/applicationGateways/privateLinkResources/read",

494 − "Microsoft.Network/applicationGateways/read"

495 − ],

496 − "notActions": [],

497 − "dataActions": [],

498 − "notDataActions": []

499 − }

500 − ],

501 − "roleName": "Azure AI Enterprise Network Connection Approver",

502 − "roleType": "BuiltInRole",

503 − "type": "Microsoft.Authorization/roleDefinitions"

504 −}

505 −```

506 −

507 −## Azure AI Inference Deployment Operator

508 −

509 −Can perform all actions required to create a resource deployment within a resource group.

510 −

511 −[Learn more](/azure/ai-studio/concepts/rbac-ai-studio)

512 −

513 −> [!div class="mx-tableFixed"]

514 −> | Actions | Description |

515 −> | --- | --- |

516 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

517 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

518 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AutoscaleSettings/write | Create or update an autoscale setting |

519 −> | **NotActions** | |

520 −> | *none* | |

521 −> | **DataActions** | |

522 −> | *none* | |

523 −> | **NotDataActions** | |

524 −> | *none* | |

525 −

526 −```json

527 −{

528 − "assignableScopes": [

529 − "/"

530 − ],

531 − "description": "Can perform all actions required to create a resource deployment within a resource group.",

532 − "id": "/providers/Microsoft.Authorization/roleDefinitions/3afb7f49-54cb-416e-8c09-6dc049efa503",

533 − "name": "3afb7f49-54cb-416e-8c09-6dc049efa503",

534 − "permissions": [

535 − {

536 − "actions": [

537 − "Microsoft.Authorization/*/read",

538 − "Microsoft.Resources/deployments/*",

539 − "Microsoft.Insights/AutoscaleSettings/write"

540 − ],

541 − "notActions": [],

542 − "dataActions": [],

543 − "notDataActions": []

544 − }

545 − ],

546 − "roleName": "Azure AI Inference Deployment Operator",

547 − "roleType": "BuiltInRole",

548 − "type": "Microsoft.Authorization/roleDefinitions"

549 −}

550 −```

551 −

552 −## AzureML Compute Operator

553 −

554 −Can access and perform CRUD operations on Machine Learning Services managed compute resources (including Notebook VMs).

555 −

556 −[Learn more](/azure/machine-learning/how-to-assign-roles)

557 −

558 −> [!div class="mx-tableFixed"]

559 −> | Actions | Description |

560 −> | --- | --- |

561 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/computes/* | |

562 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/notebooks/vm/* | |

563 −> | **NotActions** | |

564 −> | *none* | |

565 −> | **DataActions** | |

566 −> | *none* | |

567 −> | **NotDataActions** | |

568 −> | *none* | |

569 −

570 −```json

571 −{

572 − "assignableScopes": [

573 − "/"

574 − ],

575 − "description": "Can access and perform CRUD operations on Machine Learning Services managed compute resources (including Notebook VMs).",

576 − "id": "/providers/Microsoft.Authorization/roleDefinitions/e503ece1-11d0-4e8e-8e2c-7a6c3bf38815",

577 − "name": "e503ece1-11d0-4e8e-8e2c-7a6c3bf38815",

578 − "permissions": [

579 − {

580 − "actions": [

581 − "Microsoft.MachineLearningServices/workspaces/computes/*",

582 − "Microsoft.MachineLearningServices/workspaces/notebooks/vm/*"

583 − ],

584 − "notActions": [],

585 − "dataActions": [],

586 − "notDataActions": []

587 − }

588 − ],

589 − "roleName": "AzureML Compute Operator",

590 − "roleType": "BuiltInRole",

591 − "type": "Microsoft.Authorization/roleDefinitions"

592 −}

593 −```

594 −

595 −## AzureML Data Scientist

596 −

597 −Can perform all actions within an Azure Machine Learning workspace, except for creating or deleting compute resources and modifying the workspace itself.

598 −

599 −[Learn more](/azure/machine-learning/how-to-assign-roles)

600 −

601 −> [!div class="mx-tableFixed"]

602 −> | Actions | Description |

603 −> | --- | --- |

604 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/read | |

605 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/action | |

606 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/delete | |

607 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/write | |

608 −> | **NotActions** | |

609 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/delete | Deletes the Machine Learning Services Workspace(s) |

610 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/write | Creates or updates a Machine Learning Services Workspace(s) |

611 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/computes/*/write | |

612 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/computes/*/delete | |

613 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/computes/listKeys/action | List secrets for compute resources in Machine Learning Services Workspace |

614 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/listKeys/action | List secrets for a Machine Learning Services Workspace |

615 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/write | Creates or updates a Machine Learning Services Hub Workspace(s) |

616 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/delete | Deletes the Machine Learning Services Hub Workspace(s) |

617 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/write | Creates or Updates the Machine Learning Services FeatureStore(s) |

618 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/delete | Deletes the Machine Learning Services FeatureStore(s) |

619 −> | **DataActions** | |

620 −> | *none* | |

621 −> | **NotDataActions** | |

622 −> | *none* | |

623 −

624 −```json

625 −{

626 − "assignableScopes": [

627 − "/"

628 − ],

629 − "description": "Can perform all actions within an Azure Machine Learning workspace, except for creating or deleting compute resources and modifying the workspace itself.",

630 − "id": "/providers/Microsoft.Authorization/roleDefinitions/f6c7c914-8db3-469d-8ca1-694a8f32e121",

631 − "name": "f6c7c914-8db3-469d-8ca1-694a8f32e121",

632 − "permissions": [

633 − {

634 − "actions": [

635 − "Microsoft.MachineLearningServices/workspaces/*/read",

636 − "Microsoft.MachineLearningServices/workspaces/*/action",

637 − "Microsoft.MachineLearningServices/workspaces/*/delete",

638 − "Microsoft.MachineLearningServices/workspaces/*/write"

639 − ],

640 − "notActions": [

641 − "Microsoft.MachineLearningServices/workspaces/delete",

642 − "Microsoft.MachineLearningServices/workspaces/write",

643 − "Microsoft.MachineLearningServices/workspaces/computes/*/write",

644 − "Microsoft.MachineLearningServices/workspaces/computes/*/delete",

645 − "Microsoft.MachineLearningServices/workspaces/computes/listKeys/action",

646 − "Microsoft.MachineLearningServices/workspaces/listKeys/action",

647 − "Microsoft.MachineLearningServices/workspaces/hubs/write",

648 − "Microsoft.MachineLearningServices/workspaces/hubs/delete",

649 − "Microsoft.MachineLearningServices/workspaces/featurestores/write",

650 − "Microsoft.MachineLearningServices/workspaces/featurestores/delete"

651 − ],

652 − "dataActions": [],

653 − "notDataActions": []

654 − }

655 − ],

656 − "roleName": "AzureML Data Scientist",

657 − "roleType": "BuiltInRole",

658 − "type": "Microsoft.Authorization/roleDefinitions"

659 −}

660 −```

661 −

662 −## AzureML Metrics Writer (preview)

663 −

664 −Lets you write metrics to AzureML workspace

665 −

666 −[Learn more](/azure/machine-learning/concept-endpoints-online-auth)

667 −

668 −> [!div class="mx-tableFixed"]

669 −> | Actions | Description |

670 −> | --- | --- |

671 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/metrics/*/write | |

672 −> | **NotActions** | |

673 −> | *none* | |

674 −> | **DataActions** | |

675 −> | *none* | |

676 −> | **NotDataActions** | |

677 −> | *none* | |

678 −

679 −```json

680 −{

681 − "assignableScopes": [

682 − "/"

683 − ],

684 − "description": "Lets you write metrics to AzureML workspace",

685 − "id": "/providers/Microsoft.Authorization/roleDefinitions/635dd51f-9968-44d3-b7fb-6d9a6bd613ae",

686 − "name": "635dd51f-9968-44d3-b7fb-6d9a6bd613ae",

687 − "permissions": [

688 − {

689 − "actions": [

690 − "Microsoft.MachineLearningServices/workspaces/metrics/*/write"

691 − ],

692 − "notActions": [],

693 − "dataActions": [],

694 − "notDataActions": []

695 − }

696 − ],

697 − "roleName": "AzureML Metrics Writer (preview)",

698 − "roleType": "BuiltInRole",

699 − "type": "Microsoft.Authorization/roleDefinitions"

700 −}

701 −```

702 −

703 −## AzureML Registry User

704 −

705 −Can perform all actions on Machine Learning Services Registry assets as well as get Registry resources.

706 −

707 −[Learn more](/azure/machine-learning/how-to-assign-roles)

708 −

709 −> [!div class="mx-tableFixed"]

710 −> | Actions | Description |

711 −> | --- | --- |

712 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/read | Gets the Machine Learning Services registry(ies) |

713 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/assets/* | |

714 −> | **NotActions** | |

715 −> | *none* | |

716 −> | **DataActions** | |

717 −> | *none* | |

718 −> | **NotDataActions** | |

719 −> | *none* | |

720 −

721 −```json

722 −{

723 − "assignableScopes": [

724 − "/"

725 − ],

726 − "description": "Can perform all actions on Machine Learning Services Registry assets as well as get Registry resources.",

727 − "id": "/providers/Microsoft.Authorization/roleDefinitions/1823dd4f-9b8c-4ab6-ab4e-7397a3684615",

728 − "name": "1823dd4f-9b8c-4ab6-ab4e-7397a3684615",

729 − "permissions": [

730 − {

731 − "actions": [

732 − "Microsoft.MachineLearningServices/registries/read",

733 − "Microsoft.MachineLearningServices/registries/assets/*"

734 − ],

735 − "notActions": [],

736 − "dataActions": [],

737 − "notDataActions": []

738 − }

739 − ],

740 − "roleName": "AzureML Registry User",

741 − "roleType": "BuiltInRole",

742 − "type": "Microsoft.Authorization/roleDefinitions"

743 −}

744 −```

745 −

746 −## Cognitive Services Contributor

747 −

748 −Lets you create, read, update, delete and manage keys of Cognitive Services.

749 −

750 −[Learn more](/azure/ai-services/openai/how-to/role-based-access-control)

751 −

752 −> [!div class="mx-tableFixed"]

753 −> | Actions | Description |

754 −> | --- | --- |

755 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

756 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |

757 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/features/read | Gets the features of a subscription. |

758 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/read | Gets the feature of a subscription in a given resource provider. |

759 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/register/action | Registers the feature for a subscription in a given resource provider. |

760 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

761 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/* | Creates, updates, or reads the diagnostic setting for Analysis Server |

762 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logDefinitions/read | Read log definitions |

763 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricdefinitions/read | Read metric definitions |

764 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |

765 −> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

766 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

767 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |

768 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

769 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

770 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |

771 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

772 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

773 −> | **NotActions** | |

774 −> | *none* | |

775 −> | **DataActions** | |

776 −> | *none* | |

777 −> | **NotDataActions** | |

778 −> | *none* | |

779 −

780 −```json

781 −{

782 − "assignableScopes": [

783 − "/"

784 − ],

785 − "description": "Lets you create, read, update, delete and manage keys of Cognitive Services.",

786 − "id": "/providers/Microsoft.Authorization/roleDefinitions/25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68",

787 − "name": "25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68",

788 − "permissions": [

789 − {

790 − "actions": [

791 − "Microsoft.Authorization/*/read",

792 − "Microsoft.CognitiveServices/*",

793 − "Microsoft.Features/features/read",

794 − "Microsoft.Features/providers/features/read",

795 − "Microsoft.Features/providers/features/register/action",

796 − "Microsoft.Insights/alertRules/*",

797 − "Microsoft.Insights/diagnosticSettings/*",

798 − "Microsoft.Insights/logDefinitions/read",

799 − "Microsoft.Insights/metricdefinitions/read",

800 − "Microsoft.Insights/metrics/read",

801 − "Microsoft.ResourceHealth/availabilityStatuses/read",

802 − "Microsoft.Resources/deployments/*",

803 − "Microsoft.Resources/deployments/operations/read",

804 − "Microsoft.Resources/subscriptions/operationresults/read",

805 − "Microsoft.Resources/subscriptions/read",

Azure built-in roles · ai machine learning

Microsoft's edit · 26 May 2025 19:45 UTC