Azure built-in roles · ai machine learning
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit 86eb506 · +395 −3 lines · also on GitHub
⋯ 206 unchanged lines
207207
"type": "Microsoft.Authorization/roleDefinitions"
208208
}
209209
```
210
+## Azure AI Account Owner
210211
212
+Grants full access to manage AI projects and accounts. Includes an ABAC condition to constrain role assignments. Grants conditional assignment of the Azure AI User role to other user principles. Applies for new Foundry resources.
213
+
214
+[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)
215
+
216
+> [!div class="mx-tableFixed"]
217
+> | Actions | Description |
218
+> | --- | --- |
219
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
220
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
221
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
222
+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
223
+> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/features/read | Gets the features of a subscription. |
224
+> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/read | Gets the feature of a subscription in a given resource provider. |
225
+> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/register/action | Registers the feature for a subscription in a given resource provider. |
226
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
227
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/* | Creates, updates, or reads the diagnostic setting for Analysis Server |
228
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logDefinitions/read | Read log definitions |
229
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricdefinitions/read | Read metric definitions |
230
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |
231
+> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
232
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
233
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
234
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
235
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
236
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |
237
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
238
+> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
239
+> | **NotActions** | |
240
+> | *none* | |
241
+> | **DataActions** | |
242
+> | *none* | |
243
+> | **NotDataActions** | |
244
+> | *none* | |
245
+> | **Condition** | |
246
+> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) | Add or remove role assignments for the following roles:<br/>Azure AI User |
247
+
248
+```json
249
+{
250
+ "assignableScopes": [
251
+ "/"
252
+ ],
253
+ "description": "Grants full access to manage AI projects and accounts. Grants conditional assignment of the Azure AI User role to other user principles.",
254
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/e47c6f54-e4a2-4754-9501-8e0985b135e1",
255
+ "name": "e47c6f54-e4a2-4754-9501-8e0985b135e1",
256
+ "permissions": [
257
+ {
258
+ "actions": [
259
+ "Microsoft.Authorization/*/read",
260
+ "Microsoft.Authorization/roleAssignments/write",
261
+ "Microsoft.Authorization/roleAssignments/delete",
262
+ "Microsoft.CognitiveServices/*",
263
+ "Microsoft.Features/features/read",
264
+ "Microsoft.Features/providers/features/read",
265
+ "Microsoft.Features/providers/features/register/action",
266
+ "Microsoft.Insights/alertRules/*",
267
+ "Microsoft.Insights/diagnosticSettings/*",
268
+ "Microsoft.Insights/logDefinitions/read",
269
+ "Microsoft.Insights/metricdefinitions/read",
270
+ "Microsoft.Insights/metrics/read",
271
+ "Microsoft.ResourceHealth/availabilityStatuses/read",
272
+ "Microsoft.Resources/deployments/*",
273
+ "Microsoft.Resources/deployments/operations/read",
274
+ "Microsoft.Resources/subscriptions/operationresults/read",
275
+ "Microsoft.Resources/subscriptions/read",
276
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
277
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
278
+ "Microsoft.Support/*"
279
+ ],
280
+ "notActions": [],
281
+ "dataActions": [],
282
+ "notDataActions": [],
283
+ "conditionVersion": "2.0",
284
+ "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d}))"
285
+ }
286
+ ],
287
+ "roleName": "Azure AI Account Owner",
288
+ "roleType": "BuiltInRole",
289
+ "type": "Microsoft.Authorization/roleDefinitions"
290
+}
291
+```
292
+
293
+## Azure AI Administrator
294
+
295
+A Built-In Role that has all control plane permissions to work with Azure AI and its dependencies. Applies to Azure Machine Learning and Foundry hubs only.
296
+
297
+[Learn more](/azure/machine-learning/how-to-assign-roles)
298
+
299
+> [!div class="mx-tableFixed"]
300
+> | Actions | Description |
301
+> | --- | --- |
302
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
303
+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
304
+> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/* | |
305
+> | [Microsoft.DocumentDb](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/* | |
306
+> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/features/read | Gets the features of a subscription. |
307
+> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/read | Gets the feature of a subscription in a given resource provider. |
308
+> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/register/action | Registers the feature for a subscription in a given resource provider. |
309
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
310
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/components/* | Create and manage Insights components |
311
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/* | Creates, updates, or reads the diagnostic setting for Analysis Server |
312
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/generateLiveToken/read | Live Metrics get token |
313
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logDefinitions/read | Read log definitions |
314
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricAlerts/* | |
315
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricdefinitions/read | Read metric definitions |
316
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |
317
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/scheduledqueryrules/* | |
318
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/topology/read | Read Topology |
319
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/transactions/read | Read Transactions |
320
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/webtests/* | Create and manage Insights web tests |
321
+> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/* | |
322
+> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/* | |
323
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/joinViaServiceEndpoint/action | Joins resource such as storage account or SQL database to a subnet. Not alertable. |
324
+> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
325
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
326
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
327
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
328
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
329
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |
330
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
331
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/write | Creates or updates a resource group. |
332
+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/* | Create and manage storage accounts |
333
+> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
334
+> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/write | Creates or updates the search service. |
335
+> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/read | Reads the search service. |
336
+> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/delete | Deletes the search service. |
337
+> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/indexes/* | |
338
+> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/listAdminKeys/action | Reads the admin keys. |
339
+> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnections/* | |
340
+> | [Microsoft.DataFactory](../permissions/analytics.md#microsoftdatafactory)/factories/* | |
341
+> | **NotActions** | |
342
+> | *none* | |
343
+> | **DataActions** | |
344
+> | *none* | |
345
+> | **NotDataActions** | |
346
+> | *none* | |
347
+
348
+```json
349
+{
350
+ "assignableScopes": [
351
+ "/"
352
+ ],
353
+ "description": "A Built-In Role that has all control plane permissions to work with Azure AI and its dependencies.",
354
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/b78c5d69-af96-48a3-bf8d-a8b4d589de94",
355
+ "name": "b78c5d69-af96-48a3-bf8d-a8b4d589de94",
356
+ "permissions": [
357
+ {
358
+ "actions": [
359
+ "Microsoft.Authorization/*/read",
360
+ "Microsoft.CognitiveServices/*",
361
+ "Microsoft.ContainerRegistry/registries/*",
362
+ "Microsoft.DocumentDb/databaseAccounts/*",
363
+ "Microsoft.Features/features/read",
364
+ "Microsoft.Features/providers/features/read",
365
+ "Microsoft.Features/providers/features/register/action",
366
+ "Microsoft.Insights/alertRules/*",
367
+ "Microsoft.Insights/components/*",
368
+ "Microsoft.Insights/diagnosticSettings/*",
369
+ "Microsoft.Insights/generateLiveToken/read",
370
+ "Microsoft.Insights/logDefinitions/read",
371
+ "Microsoft.Insights/metricAlerts/*",
372
+ "Microsoft.Insights/metricdefinitions/read",
373
+ "Microsoft.Insights/metrics/read",
374
+ "Microsoft.Insights/scheduledqueryrules/*",
375
+ "Microsoft.Insights/topology/read",
376
+ "Microsoft.Insights/transactions/read",
377
+ "Microsoft.Insights/webtests/*",
378
+ "Microsoft.KeyVault/*",
379
+ "Microsoft.MachineLearningServices/workspaces/*",
380
+ "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
381
+ "Microsoft.ResourceHealth/availabilityStatuses/read",
382
+ "Microsoft.Resources/deployments/*",
383
+ "Microsoft.Resources/deployments/operations/read",
384
+ "Microsoft.Resources/subscriptions/operationresults/read",
385
+ "Microsoft.Resources/subscriptions/read",
386
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
387
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
388
+ "Microsoft.Resources/subscriptions/resourceGroups/write",
389
+ "Microsoft.Storage/storageAccounts/*",
390
+ "Microsoft.Support/*",
391
+ "Microsoft.Search/searchServices/write",
392
+ "Microsoft.Search/searchServices/read",
393
+ "Microsoft.Search/searchServices/delete",
394
+ "Microsoft.Search/searchServices/indexes/*",
395
+ "Microsoft.Search/searchServices/listAdminKeys/action",
396
+ "Microsoft.Search/searchServices/privateEndpointConnections/*",
397
+ "Microsoft.DataFactory/factories/*"
398
+ ],
399
+ "notActions": [],
400
+ "dataActions": [],
401
+ "notDataActions": []
402
+ }
403
+ ],
404
+ "roleName": "Azure AI Administrator",
405
+ "roleType": "BuiltInRole",
406
+ "type": "Microsoft.Authorization/roleDefinitions"
407
+}
408
+```
409
+
211410
## Azure AI Developer
212411
213
−Can perform all actions within an Azure AI resource besides managing the resource itself.
412
+Can perform all actions within an Azure AI resource besides managing the resource itself. Applies to Azure Machine Learning and Foundry hubs only.
214413
215
−[Learn more](/azure/ai-studio/concepts/rbac-ai-studio)
414
+[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)
216415
217416
> [!div class="mx-tableFixed"]
218417
> | Actions | Description |
⋯ 289 unchanged lines
508707
509708
Can perform all actions required to create a resource deployment within a resource group.
510709
511
−[Learn more](/azure/ai-studio/concepts/rbac-ai-studio)
710
+[Learn more](/azure/ai-foundry/concepts/hub-rbac-azure-ai-foundry)
512711
513712
> [!div class="mx-tableFixed"]
514713
> | Actions | Description |
⋯ 29 unchanged lines
544743
}
545744
],
546745
"roleName": "Azure AI Inference Deployment Operator",
746
+ "roleType": "BuiltInRole",
747
+ "type": "Microsoft.Authorization/roleDefinitions"
748
+}
749
+```
750
+
751
+## Azure AI Owner
752
+
753
+Grants full to manage AI project and accounts. Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project. Applies for new Foundry resources.
754
+
755
+[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)
756
+
757
+> [!div class="mx-tableFixed"]
758
+> | Actions | Description |
759
+> | --- | --- |
760
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
761
+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
762
+> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
763
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
764
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
765
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
766
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
767
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |
768
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
769
+> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
770
+> | **NotActions** | |
771
+> | *none* | |
772
+> | **DataActions** | |
773
+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
774
+> | **NotDataActions** | |
775
+> | *none* | |
776
+
777
+```json
778
+{
779
+ "assignableScopes": [
780
+ "/"
781
+ ],
782
+ "description": "Grants full to manage AI project and accounts. Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project.",
783
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/c883944f-8b7b-4483-af10-35834be79c4a",
784
+ "name": "c883944f-8b7b-4483-af10-35834be79c4a",
785
+ "permissions": [
786
+ {
787
+ "actions": [
788
+ "Microsoft.Authorization/*/read",
789
+ "Microsoft.CognitiveServices/*",
790
+ "Microsoft.ResourceHealth/availabilityStatuses/read",
791
+ "Microsoft.Resources/deployments/*",
792
+ "Microsoft.Resources/deployments/operations/read",
793
+ "Microsoft.Resources/subscriptions/operationresults/read",
794
+ "Microsoft.Resources/subscriptions/read",
795
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
796
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
797
+ "Microsoft.Support/*"
798
+ ],
799
+ "notActions": [],
800
+ "dataActions": [
801
+ "Microsoft.CognitiveServices/*"
802
+ ],
803
+ "notDataActions": []
804
+ }
805
+ ],
806
+ "roleName": "Azure AI Owner",
807
+ "roleType": "BuiltInRole",
808
+ "type": "Microsoft.Authorization/roleDefinitions"
809
+}
810
+```
811
+
812
+## Azure AI Project Manager
813
+
814
+Lets you perform developer actions and management actions on Foundry Projects. Includes an ABAC condition to constrain role assignments. Allows for making role assignments, but limited to Azure AI User role. Applies for new Foundry resources.
815
+
816
+[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)
817
+
818
+> [!div class="mx-tableFixed"]
819
+> | Actions | Description |
820
+> | --- | --- |
821
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
822
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
823
+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/*/read | |
824
+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/projects/* | |
825
+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/locations/*/read | |
826
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
827
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
828
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
829
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
830
+> | **NotActions** | |
831
+> | *none* | |
832
+> | **DataActions** | |
833
+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
834
+> | **NotDataActions** | |
835
+> | *none* | |
836
+> | **Condition** | |
837
+> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) | Add or remove role assignments for the following roles:<br/>Azure AI User |
838
+
839
+```json
840
+{
841
+ "assignableScopes": [
842
+ "/"
843
+ ],
844
+ "description": "Lets you perform developer actions and management actions on Azure AI Foundry Projects. Allows for making role assignments, but limited to Cognitive Service User role.",
845
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/eadc314b-1a2d-4efa-be10-5d325db5065e",
846
+ "name": "eadc314b-1a2d-4efa-be10-5d325db5065e",
847
+ "permissions": [
848
+ {
849
+ "actions": [
850
+ "Microsoft.Authorization/roleAssignments/write",
851
+ "Microsoft.Authorization/roleAssignments/delete",
852
+ "Microsoft.CognitiveServices/accounts/*/read",
853
+ "Microsoft.CognitiveServices/accounts/projects/*",
854
+ "Microsoft.CognitiveServices/locations/*/read",
855
+ "Microsoft.Authorization/*/read",
856
+ "Microsoft.Insights/alertRules/*",
857
+ "Microsoft.Resources/deployments/*",
858
+ "Microsoft.Resources/subscriptions/resourceGroups/read"
859
+ ],
860
+ "notActions": [],
861
+ "dataActions": [
862
+ "Microsoft.CognitiveServices/*"
863
+ ],
864
+ "notDataActions": [],
865
+ "conditionVersion": "2.0",
866
+ "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d}))"
867
+ }
868
+ ],
869
+ "roleName": "Azure AI Project Manager",
870
+ "roleType": "BuiltInRole",
871
+ "type": "Microsoft.Authorization/roleDefinitions"
872
+}
873
+```
874
+
875
+## Azure AI User
876
+
877
+Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project.
878
+
879
+[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)
880
+
881
+> [!div class="mx-tableFixed"]
882
+> | Actions | Description |
883
+> | --- | --- |
884
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
885
+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |
886
+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/listkeys/action | List keys |
887
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/read | Read a classic metric alert |
888
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/read | Read a resource diagnostic setting |
889
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logDefinitions/read | Read log definitions |
890
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricdefinitions/read | Read metric definitions |
891
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |
892
+> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
893
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
894
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
895
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
896
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
897
+> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
898
+> | **NotActions** | |
899
+> | *none* | |
900
+> | **DataActions** | |
901
+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
902
+> | **NotDataActions** | |
903
+> | *none* | |
904
+
905
+```json
906
+{
907
+ "assignableScopes": [
908
+ "/"
909
+ ],
910
+ "description": "Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project.",
911
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/53ca6127-db72-4b80-b1b0-d745d6d5456d",
912
+ "name": "53ca6127-db72-4b80-b1b0-d745d6d5456d",
913
+ "permissions": [
914
+ {
915
+ "actions": [
916
+ "Microsoft.Authorization/*/read",
917
+ "Microsoft.CognitiveServices/*/read",
918
+ "Microsoft.CognitiveServices/accounts/listkeys/action",
919
+ "Microsoft.Insights/alertRules/read",
920
+ "Microsoft.Insights/diagnosticSettings/read",
921
+ "Microsoft.Insights/logDefinitions/read",
922
+ "Microsoft.Insights/metricdefinitions/read",
923
+ "Microsoft.Insights/metrics/read",
924
+ "Microsoft.ResourceHealth/availabilityStatuses/read",
925
+ "Microsoft.Resources/deployments/*",
926
+ "Microsoft.Resources/subscriptions/operationresults/read",
927
+ "Microsoft.Resources/subscriptions/read",
928
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
929
+ "Microsoft.Support/*"
930
+ ],
931
+ "notActions": [],
932
+ "dataActions": [
933
+ "Microsoft.CognitiveServices/*"
934
+ ],
935
+ "notDataActions": []
936
+ }
937
+ ],
938
+ "roleName": "Azure AI User",
547939
"roleType": "BuiltInRole",
548940
"type": "Microsoft.Authorization/roleDefinitions"
549941
}
⋯ 1978 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 08:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.