Microsoft's edit · Azure built-in roles · ai machine learning

77 author: rolyon

88 manager: pmwongera

99 ms.author: rolyon

10 −ms.date: 05/25/2026

11 −ms.custom: generated

12 −---

13 −

14 −# Azure built-in roles for AI + machine learning

15 −

16 −This article lists the Azure built-in roles in the AI + machine learning category.

17 −

18 −

19 −## Azure AI Administrator

20 −

21 −A Built-In Role that has all control plane permissions to work with Azure AI and its dependencies. Applies to Azure Machine Learning and Foundry hubs only.

22 −

23 −[Learn more](/azure/machine-learning/how-to-assign-roles)

24 −

25 −> [!div class="mx-tableFixed"]

26 −> | Actions | Description |

27 −> | --- | --- |

28 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

29 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |

30 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/* | |

31 −> | [Microsoft.DocumentDb](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/* | |

32 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/features/read | Gets the features of a subscription. |

33 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/read | Gets the feature of a subscription in a given resource provider. |

34 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/register/action | Registers the feature for a subscription in a given resource provider. |

35 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

36 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/components/* | Create and manage Insights components |

37 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/* | Creates, updates, or reads the diagnostic setting for Analysis Server |

38 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/generateLiveToken/read | Live Metrics get token |

39 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logDefinitions/read | Read log definitions |

40 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricAlerts/* | |

41 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricdefinitions/read | Read metric definitions |

42 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |

43 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/scheduledqueryrules/* | |

44 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/topology/read | Read Topology |

45 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/transactions/read | Read Transactions |

46 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/webtests/* | Create and manage Insights web tests |

47 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/* | |

48 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/* | |

49 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/joinViaServiceEndpoint/action | Joins resource such as storage account or SQL database to a subnet. Not alertable. |

50 −> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

51 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

52 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |

53 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

54 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

55 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |

56 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

57 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/write | Creates or updates a resource group. |

58 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/* | Create and manage storage accounts |

59 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

60 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/write | Creates or updates the search service. |

61 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/read | Reads the search service. |

62 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/delete | Deletes the search service. |

63 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/indexes/* | |

64 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/listAdminKeys/action | Reads the admin keys. |

65 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnections/* | |

66 −> | [Microsoft.DataFactory](../permissions/analytics.md#microsoftdatafactory)/factories/* | |

67 −> | **NotActions** | |

68 −> | *none* | |

69 −> | **DataActions** | |

70 −> | *none* | |

71 −> | **NotDataActions** | |

72 −> | *none* | |

73 −

74 −```json

75 −{

76 − "assignableScopes": [

77 − "/"

78 − ],

79 − "description": "A Built-In Role that has all control plane permissions to work with Azure AI and its dependencies.",

80 − "id": "/providers/Microsoft.Authorization/roleDefinitions/b78c5d69-af96-48a3-bf8d-a8b4d589de94",

81 − "name": "b78c5d69-af96-48a3-bf8d-a8b4d589de94",

82 − "permissions": [

83 − {

84 − "actions": [

85 − "Microsoft.Authorization/*/read",

86 − "Microsoft.CognitiveServices/*",

87 − "Microsoft.ContainerRegistry/registries/*",

88 − "Microsoft.DocumentDb/databaseAccounts/*",

89 − "Microsoft.Features/features/read",

90 − "Microsoft.Features/providers/features/read",

91 − "Microsoft.Features/providers/features/register/action",

92 − "Microsoft.Insights/alertRules/*",

93 − "Microsoft.Insights/components/*",

94 − "Microsoft.Insights/diagnosticSettings/*",

95 − "Microsoft.Insights/generateLiveToken/read",

96 − "Microsoft.Insights/logDefinitions/read",

97 − "Microsoft.Insights/metricAlerts/*",

98 − "Microsoft.Insights/metricdefinitions/read",

99 − "Microsoft.Insights/metrics/read",

100 − "Microsoft.Insights/scheduledqueryrules/*",

101 − "Microsoft.Insights/topology/read",

102 − "Microsoft.Insights/transactions/read",

103 − "Microsoft.Insights/webtests/*",

104 − "Microsoft.KeyVault/*",

105 − "Microsoft.MachineLearningServices/workspaces/*",

106 − "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",

107 − "Microsoft.ResourceHealth/availabilityStatuses/read",

108 − "Microsoft.Resources/deployments/*",

109 − "Microsoft.Resources/deployments/operations/read",

110 − "Microsoft.Resources/subscriptions/operationresults/read",

111 − "Microsoft.Resources/subscriptions/read",

112 − "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",

113 − "Microsoft.Resources/subscriptions/resourceGroups/read",

114 − "Microsoft.Resources/subscriptions/resourceGroups/write",

115 − "Microsoft.Storage/storageAccounts/*",

116 − "Microsoft.Support/*",

117 − "Microsoft.Search/searchServices/write",

118 − "Microsoft.Search/searchServices/read",

119 − "Microsoft.Search/searchServices/delete",

120 − "Microsoft.Search/searchServices/indexes/*",

121 − "Microsoft.Search/searchServices/listAdminKeys/action",

122 − "Microsoft.Search/searchServices/privateEndpointConnections/*",

123 − "Microsoft.DataFactory/factories/*"

124 − ],

125 − "notActions": [],

126 − "dataActions": [],

127 − "notDataActions": []

128 − }

129 − ],

130 − "roleName": "Azure AI Administrator",

131 − "roleType": "BuiltInRole",

132 − "type": "Microsoft.Authorization/roleDefinitions"

133 −}

134 −```

135 −

136 −## Azure AI Developer

137 −

138 −Can perform all actions within an Azure Machine Learning workspace besides managing the workspace itself. For Foundry project access, use the Foundry User or Foundry Owner roles instead.

139 −

140 −[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)

141 −

142 −> [!div class="mx-tableFixed"]

143 −> | Actions | Description |

144 −> | --- | --- |

145 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/read | |

146 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/action | |

147 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/delete | |

148 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/write | |

149 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/locations/*/read | |

150 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

151 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

152 −> | **NotActions** | |

153 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/delete | Deletes the Machine Learning Services Workspace(s) |

154 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/write | Creates or updates a Machine Learning Services Workspace(s) |

155 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/listKeys/action | List secrets for a Machine Learning Services Workspace |

156 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/write | Creates or updates a Machine Learning Services Hub Workspace(s) |

157 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/delete | Deletes the Machine Learning Services Hub Workspace(s) |

158 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/write | Creates or Updates the Machine Learning Services FeatureStore(s) |

159 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/delete | Deletes the Machine Learning Services FeatureStore(s) |

160 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/evaluations/results/labels/read | Reads evaluation results' label from a Machine Learning Services Workspace |

161 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/evaluations/results/reasonings/read | Reads evaluation results' reasoning from a Machine Learning Services Workspace |

162 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/simulations/results/images/read | Reads image simulation results from a Machine Learning Services Workspace |

163 −> | **DataActions** | |

164 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/* | |

165 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/* | |

166 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/ContentSafety/* | |

167 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/MaaS/* | |

168 −> | **NotDataActions** | |

169 −> | *none* | |

170 −

171 −```json

172 −{

173 − "assignableScopes": [

174 − "/"

175 − ],

176 − "description": "Can perform all actions within an Azure Machine Learning workspace besides managing the workspace itself. For Foundry project access, use the Foundry User or Foundry Owner roles instead.",

177 − "id": "/providers/Microsoft.Authorization/roleDefinitions/64702f94-c441-49e6-a78b-ef80e0188fee",

178 − "name": "64702f94-c441-49e6-a78b-ef80e0188fee",

179 − "permissions": [

180 − {

181 − "actions": [

182 − "Microsoft.MachineLearningServices/workspaces/*/read",

183 − "Microsoft.MachineLearningServices/workspaces/*/action",

184 − "Microsoft.MachineLearningServices/workspaces/*/delete",

185 − "Microsoft.MachineLearningServices/workspaces/*/write",

186 − "Microsoft.MachineLearningServices/locations/*/read",

187 − "Microsoft.Authorization/*/read",

188 − "Microsoft.Resources/deployments/*"

189 − ],

190 − "notActions": [

191 − "Microsoft.MachineLearningServices/workspaces/delete",

192 − "Microsoft.MachineLearningServices/workspaces/write",

193 − "Microsoft.MachineLearningServices/workspaces/listKeys/action",

194 − "Microsoft.MachineLearningServices/workspaces/hubs/write",

195 − "Microsoft.MachineLearningServices/workspaces/hubs/delete",

196 − "Microsoft.MachineLearningServices/workspaces/featurestores/write",

197 − "Microsoft.MachineLearningServices/workspaces/featurestores/delete",

198 − "Microsoft.MachineLearningServices/workspaces/evaluations/results/labels/read",

199 − "Microsoft.MachineLearningServices/workspaces/evaluations/results/reasonings/read",

200 − "Microsoft.MachineLearningServices/workspaces/simulations/results/images/read"

201 − ],

202 − "dataActions": [

203 − "Microsoft.CognitiveServices/accounts/OpenAI/*",

204 − "Microsoft.CognitiveServices/accounts/SpeechServices/*",

205 − "Microsoft.CognitiveServices/accounts/ContentSafety/*",

206 − "Microsoft.CognitiveServices/accounts/MaaS/*"

207 − ],

208 − "notDataActions": []

209 − }

210 − ],

211 − "roleName": "Azure AI Developer",

212 − "roleType": "BuiltInRole",

213 − "type": "Microsoft.Authorization/roleDefinitions"

214 −}

215 −```

216 −

217 −## Azure AI Enterprise Network Connection Approver

218 −

219 −Can approve private endpoint connections to Azure AI common dependency resources

220 −

221 −[Learn more](/azure/machine-learning/how-to-managed-network)

222 −

223 −> [!div class="mx-tableFixed"]

224 −> | Actions | Description |

225 −> | --- | --- |

226 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/privateEndpointConnections/read | Get Private Endpoint Connections |

227 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/privateEndpointConnections/write | Approve Or Reject Private Endpoint Connections |

228 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/privateLinkResources/read | Get Private Link Group resources |

229 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/read | Read metadata for an API Management Service instance |

230 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnectionsApproval/action | Auto Approves a Private Endpoint Connection |

231 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnections/read | Gets the properties of private endpoint connection or list all the private endpoint connections for the specified container registry |

232 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnections/write | Approves/Rejects the private endpoint connection |

233 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/read | View the Redis Cache's settings and configuration in the management portal |

234 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnections/read | Read a private endpoint connection |

235 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnections/write | Write a private endpoint connection |

236 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateLinkResources/read | Read 'groupId' of redis subresource that a private link can be connected to |

237 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |

238 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/read | View the Redis Enterprise cache's settings and configuration in the management portal |

239 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnections/read | Read a private endpoint connection |

240 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnections/write | Write a private endpoint connection |

241 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateLinkResources/read | Read 'groupId' of redis subresource that a private link can be connected to |

242 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |

243 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/read | Reads API accounts. |

244 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateEndpointConnections/read | Reads private endpoint connections. |

245 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateEndpointConnections/write | Writes a private endpoint connections. |

246 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateLinkResources/read | Reads private link resources for an account. |

247 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateEndpointConnectionsApproval/action | Determines if the user is allowed to approve a private endpoint connection |

248 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection. |

249 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |

250 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateLinkResources/read | Return a list containing private link resource or gets the specified private link resource. |

251 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/read | Return the list of servers or gets the properties for the specified server. |

252 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection for PostgreSQL SGv2 |

253 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection |

254 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |

255 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateLinkResources/read | Get the private link resources for the corresponding PostgreSQL SGv2 |

256 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection |

257 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateEndpointConnections/read | |

258 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |

259 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateLinkResources/read | Get the private link resources for the corresponding MySQL Server |

260 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/read | Returns the list of servers or gets the properties for the specified server. |

261 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnectionsApproval/action | Manage a private endpoint connection of Database Account |

262 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/operationResults/read | Read Status of privateEndpointConnections asynchronous operation |

263 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/read | Read a private endpoint connection or list all the private endpoint connections of a Database Account |

264 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/write | Create or update a private endpoint connection of a Database Account |

265 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateLinkResources/read | Read a private link resource or list all the private link resources of a Database Account |

266 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/read | Reads a database account. |

267 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |

268 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

269 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

270 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateLinkResources/read | Get the available private link resources for the specified instance of Key Vault |

271 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/read | View the properties of a key vault |

272 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |

273 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

274 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

275 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateLinkResources/read | Gets the available private link resources for the specified instance of the Machine Learning Services registry(ies) |

276 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/read | Gets the Machine Learning Services registry(ies) |

277 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |

278 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

279 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

280 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateLinkResources/read | Gets the available private link resources for the specified instance of the Machine Learning Services Workspace(s) |

281 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/read | Gets the Machine Learning Services Workspace(s) |

282 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateEndpointConnections/read | Get Private Endpoint Connection |

283 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateEndpointConnections/write | Put Private Endpoint Connection |

284 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateLinkResources/read | Get StorageAccount groupids |

285 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/read | Returns the list of storage accounts or gets the properties for the specified storage account. |

286 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/PrivateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |

287 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection |

288 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection. |

289 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |

290 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateLinkResources/read | Get the private link resources for the corresponding sql server |

291 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/read | Return the list of servers or gets the properties for the specified server. |

292 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connection |

293 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateEndpointConnections/read | Get Private Endpoint Connection |

294 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateEndpointConnections/write | Create or Update Private Endpoint Connection |

295 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateLinkResources/read | Gets the resource types that support private endpoint connections |

296 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/read | Get the list of Namespace Resource Description |

297 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connection |

298 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connections |

299 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnections/write | Creates a private endpoint connections with the specified parameters or updates the properties or tags for the specified private endpoint connections |

300 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/sharedPrivateLinkResources/read | Returns the list of shared private link resources or gets the properties for the specified shared private link resource |

301 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/read | Reads the search service. |

302 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |

303 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateEndpointConnections/read | Read a private endpoint connection |

304 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateEndpointConnections/write | Create or update a private endpoint connection |

305 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateLinkResources/read | Read a private link resource |

306 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/read | Read a private link scope |

307 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/privateEndpointConnectionsApproval/action | Approve or reject PrivateEndpoint connection on PrivateLinkService |

308 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/privateEndpointConnections/read | Gets an private endpoint connection definition. |

309 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/privateEndpointConnections/write | Creates a new private endpoint connection, or updates an existing private endpoint connection. |

310 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/read | Gets an private link service resource. |

311 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/privateEndpointConnections/read | Gets Application Gateway PrivateEndpoint Connections |

312 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/privateEndpointConnections/write | Updates Application Gateway PrivateEndpoint Connection |

313 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/privateLinkResources/read | Gets ApplicationGateway PrivateLink Resources |

314 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/read | Gets an application gateway |

315 −> | **NotActions** | |

316 −> | *none* | |

317 −> | **DataActions** | |

318 −> | *none* | |

319 −> | **NotDataActions** | |

320 −> | *none* | |

321 −

322 −```json

323 −{

324 − "assignableScopes": [

325 − "/"

326 − ],

327 − "description": "Can approve private endpoint connections to Azure AI common dependency resources",

328 − "id": "/providers/Microsoft.Authorization/roleDefinitions/b556d68e-0be0-4f35-a333-ad7ee1ce17ea",

329 − "name": "b556d68e-0be0-4f35-a333-ad7ee1ce17ea",

330 − "permissions": [

331 − {

332 − "actions": [

333 − "Microsoft.ApiManagement/service/privateEndpointConnections/read",

334 − "Microsoft.ApiManagement/service/privateEndpointConnections/write",

335 − "Microsoft.ApiManagement/service/privateLinkResources/read",

336 − "Microsoft.ApiManagement/service/read",

337 − "Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",

338 − "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",

339 − "Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",

340 − "Microsoft.Cache/redis/read",

341 − "Microsoft.Cache/redis/privateEndpointConnections/read",

342 − "Microsoft.Cache/redis/privateEndpointConnections/write",

343 − "Microsoft.Cache/redis/privateLinkResources/read",

344 − "Microsoft.Cache/redis/privateEndpointConnectionsApproval/action",

345 − "Microsoft.Cache/redisEnterprise/read",

346 − "Microsoft.Cache/redisEnterprise/privateEndpointConnections/read",

347 − "Microsoft.Cache/redisEnterprise/privateEndpointConnections/write",

348 − "Microsoft.Cache/redisEnterprise/privateLinkResources/read",

349 − "Microsoft.Cache/redisEnterprise/privateEndpointConnectionsApproval/action",

350 − "Microsoft.CognitiveServices/accounts/read",

351 − "Microsoft.CognitiveServices/accounts/privateEndpointConnections/read",

352 − "Microsoft.CognitiveServices/accounts/privateEndpointConnections/write",

353 − "Microsoft.CognitiveServices/accounts/privateLinkResources/read",

354 − "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnectionsApproval/action",

355 − "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read",

356 − "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/write",

357 − "Microsoft.DBforPostgreSQL/flexibleServers/privateLinkResources/read",

358 − "Microsoft.DBforPostgreSQL/flexibleServers/read",

359 − "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnectionsApproval/action",

360 − "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/read",

361 − "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/write",

362 − "Microsoft.DBforPostgreSQL/serverGroupsv2/privateLinkResources/read",

363 − "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnectionsApproval/action",

364 − "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/read",

365 − "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/write",

366 − "Microsoft.DBforMySQL/flexibleServers/privateLinkResources/read",

367 − "Microsoft.DBforMySQL/flexibleServers/read",

368 − "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionsApproval/action",

369 − "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/operationResults/read",

370 − "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/read",

371 − "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write",

372 − "Microsoft.DocumentDB/databaseAccounts/privateLinkResources/read",

373 − "Microsoft.DocumentDB/databaseAccounts/read",

374 − "Microsoft.KeyVault/vaults/privateEndpointConnectionsApproval/action",

375 − "Microsoft.KeyVault/vaults/privateEndpointConnections/read",

376 − "Microsoft.KeyVault/vaults/privateEndpointConnections/write",

377 − "Microsoft.KeyVault/vaults/privateLinkResources/read",

378 − "Microsoft.KeyVault/vaults/read",

379 − "Microsoft.MachineLearningServices/registries/privateEndpointConnectionsApproval/action",

380 − "Microsoft.MachineLearningServices/registries/privateEndpointConnections/read",

381 − "Microsoft.MachineLearningServices/registries/privateEndpointConnections/write",

382 − "Microsoft.MachineLearningServices/registries/privateLinkResources/read",

383 − "Microsoft.MachineLearningServices/registries/read",

384 − "Microsoft.MachineLearningServices/workspaces/privateEndpointConnectionsApproval/action",

385 − "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read",

386 − "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write",

387 − "Microsoft.MachineLearningServices/workspaces/privateLinkResources/read",

388 − "Microsoft.MachineLearningServices/workspaces/read",

389 − "Microsoft.Storage/storageAccounts/privateEndpointConnections/read",

390 − "Microsoft.Storage/storageAccounts/privateEndpointConnections/write",

391 − "Microsoft.Storage/storageAccounts/privateLinkResources/read",

392 − "Microsoft.Storage/storageAccounts/read",

393 − "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",

394 − "Microsoft.Sql/servers/privateEndpointConnectionsApproval/action",

395 − "Microsoft.Sql/servers/privateEndpointConnections/read",

396 − "Microsoft.Sql/servers/privateEndpointConnections/write",

397 − "Microsoft.Sql/servers/privateLinkResources/read",

398 − "Microsoft.Sql/servers/read",

399 − "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",

400 − "Microsoft.EventHub/namespaces/privateEndpointConnections/read",

401 − "Microsoft.EventHub/namespaces/privateEndpointConnections/write",

402 − "Microsoft.EventHub/namespaces/privateLinkResources/read",

403 − "Microsoft.EventHub/namespaces/read",

404 − "Microsoft.Search/searchServices/privateEndpointConnectionsApproval/action",

405 − "Microsoft.Search/searchServices/privateEndpointConnections/read",

406 − "Microsoft.Search/searchServices/privateEndpointConnections/write",

407 − "Microsoft.Search/searchServices/sharedPrivateLinkResources/read",

408 − "Microsoft.Search/searchServices/read",

409 − "Microsoft.Insights/privatelinkscopes/privateEndpointConnectionsApproval/action",

410 − "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/read",

411 − "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/write",

412 − "Microsoft.Insights/privatelinkscopes/privateLinkResources/read",

413 − "Microsoft.Insights/privatelinkscopes/read",

414 − "Microsoft.Network/privateLinkServices/privateEndpointConnectionsApproval/action",

415 − "Microsoft.Network/privateLinkServices/privateEndpointConnections/read",

416 − "Microsoft.Network/privateLinkServices/privateEndpointConnections/write",

417 − "Microsoft.Network/privateLinkServices/read",

418 − "Microsoft.Network/applicationGateways/privateEndpointConnections/read",

419 − "Microsoft.Network/applicationGateways/privateEndpointConnections/write",

420 − "Microsoft.Network/applicationGateways/privateLinkResources/read",

421 − "Microsoft.Network/applicationGateways/read"

422 − ],

423 − "notActions": [],

424 − "dataActions": [],

425 − "notDataActions": []

426 − }

427 − ],

428 − "roleName": "Azure AI Enterprise Network Connection Approver",

429 − "roleType": "BuiltInRole",

430 − "type": "Microsoft.Authorization/roleDefinitions"

431 −}

432 −```

433 −

434 −## Azure AI Inference Deployment Operator

435 −

436 −Can perform all actions required to create a resource deployment within a resource group.

437 −

438 −[Learn more](/azure/ai-foundry/concepts/hub-rbac-azure-ai-foundry)

439 −

440 −> [!div class="mx-tableFixed"]

441 −> | Actions | Description |

442 −> | --- | --- |

443 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

444 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

445 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AutoscaleSettings/write | Create or update an autoscale setting |

446 −> | **NotActions** | |

447 −> | *none* | |

448 −> | **DataActions** | |

449 −> | *none* | |

450 −> | **NotDataActions** | |

451 −> | *none* | |

452 −

453 −```json

454 −{

455 − "assignableScopes": [

456 − "/"

457 − ],

458 − "description": "Can perform all actions required to create a resource deployment within a resource group.",

459 − "id": "/providers/Microsoft.Authorization/roleDefinitions/3afb7f49-54cb-416e-8c09-6dc049efa503",

460 − "name": "3afb7f49-54cb-416e-8c09-6dc049efa503",

461 − "permissions": [

462 − {

463 − "actions": [

464 − "Microsoft.Authorization/*/read",

465 − "Microsoft.Resources/deployments/*",

466 − "Microsoft.Insights/AutoscaleSettings/write"

467 − ],

468 − "notActions": [],

469 − "dataActions": [],

470 − "notDataActions": []

471 − }

472 − ],

473 − "roleName": "Azure AI Inference Deployment Operator",

474 − "roleType": "BuiltInRole",

475 − "type": "Microsoft.Authorization/roleDefinitions"

476 −}

477 −```

478 −

479 −## AzureML Compute Operator

480 −

481 −Can access and perform CRUD operations on Machine Learning Services managed compute resources (including Notebook VMs).

482 −

483 −[Learn more](/azure/machine-learning/how-to-assign-roles)

484 −

485 −> [!div class="mx-tableFixed"]

486 −> | Actions | Description |

487 −> | --- | --- |

488 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/computes/* | |

489 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/notebooks/vm/* | |

490 −> | **NotActions** | |

491 −> | *none* | |

492 −> | **DataActions** | |

493 −> | *none* | |

494 −> | **NotDataActions** | |

495 −> | *none* | |

496 −

497 −```json

498 −{

499 − "assignableScopes": [

500 − "/"

501 − ],

502 − "description": "Can access and perform CRUD operations on Machine Learning Services managed compute resources (including Notebook VMs).",

503 − "id": "/providers/Microsoft.Authorization/roleDefinitions/e503ece1-11d0-4e8e-8e2c-7a6c3bf38815",

504 − "name": "e503ece1-11d0-4e8e-8e2c-7a6c3bf38815",

505 − "permissions": [

506 − {

507 − "actions": [

508 − "Microsoft.MachineLearningServices/workspaces/computes/*",

509 − "Microsoft.MachineLearningServices/workspaces/notebooks/vm/*"

510 − ],

511 − "notActions": [],

512 − "dataActions": [],

513 − "notDataActions": []

514 − }

515 − ],

516 − "roleName": "AzureML Compute Operator",

517 − "roleType": "BuiltInRole",

518 − "type": "Microsoft.Authorization/roleDefinitions"

519 −}

520 −```

521 −

522 −## AzureML Data Scientist

523 −

524 −Can perform all actions within an Azure Machine Learning workspace, except for creating or deleting compute resources and modifying the workspace itself.

525 −

526 −[Learn more](/azure/machine-learning/how-to-assign-roles)

527 −

528 −> [!div class="mx-tableFixed"]

529 −> | Actions | Description |

530 −> | --- | --- |

531 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/read | |

532 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/action | |

533 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/delete | |

534 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/write | |

535 −> | **NotActions** | |

536 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/delete | Deletes the Machine Learning Services Workspace(s) |

537 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/write | Creates or updates a Machine Learning Services Workspace(s) |

538 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/computes/*/write | |

539 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/computes/*/delete | |

540 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/computes/listKeys/action | List secrets for compute resources in Machine Learning Services Workspace |

541 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/listKeys/action | List secrets for a Machine Learning Services Workspace |

542 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/write | Creates or updates a Machine Learning Services Hub Workspace(s) |

543 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/delete | Deletes the Machine Learning Services Hub Workspace(s) |

544 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/write | Creates or Updates the Machine Learning Services FeatureStore(s) |

545 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/delete | Deletes the Machine Learning Services FeatureStore(s) |

546 −> | **DataActions** | |

547 −> | *none* | |

548 −> | **NotDataActions** | |

549 −> | *none* | |

550 −

551 −```json

552 −{

553 − "assignableScopes": [

554 − "/"

555 − ],

556 − "description": "Can perform all actions within an Azure Machine Learning workspace, except for creating or deleting compute resources and modifying the workspace itself.",

557 − "id": "/providers/Microsoft.Authorization/roleDefinitions/f6c7c914-8db3-469d-8ca1-694a8f32e121",

558 − "name": "f6c7c914-8db3-469d-8ca1-694a8f32e121",

559 − "permissions": [

560 − {

561 − "actions": [

562 − "Microsoft.MachineLearningServices/workspaces/*/read",

563 − "Microsoft.MachineLearningServices/workspaces/*/action",

564 − "Microsoft.MachineLearningServices/workspaces/*/delete",

565 − "Microsoft.MachineLearningServices/workspaces/*/write"

566 − ],

567 − "notActions": [

568 − "Microsoft.MachineLearningServices/workspaces/delete",

569 − "Microsoft.MachineLearningServices/workspaces/write",

570 − "Microsoft.MachineLearningServices/workspaces/computes/*/write",

571 − "Microsoft.MachineLearningServices/workspaces/computes/*/delete",

572 − "Microsoft.MachineLearningServices/workspaces/computes/listKeys/action",

573 − "Microsoft.MachineLearningServices/workspaces/listKeys/action",

574 − "Microsoft.MachineLearningServices/workspaces/hubs/write",

575 − "Microsoft.MachineLearningServices/workspaces/hubs/delete",

576 − "Microsoft.MachineLearningServices/workspaces/featurestores/write",

577 − "Microsoft.MachineLearningServices/workspaces/featurestores/delete"

578 − ],

579 − "dataActions": [],

580 − "notDataActions": []

581 − }

582 − ],

583 − "roleName": "AzureML Data Scientist",

584 − "roleType": "BuiltInRole",

585 − "type": "Microsoft.Authorization/roleDefinitions"

586 −}

587 −```

588 −

589 −## AzureML Metrics Writer (preview)

590 −

591 −Lets you write metrics to AzureML workspace

592 −

593 −[Learn more](/azure/machine-learning/concept-endpoints-online-auth)

594 −

595 −> [!div class="mx-tableFixed"]

596 −> | Actions | Description |

597 −> | --- | --- |

598 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/metrics/*/write | |

599 −> | **NotActions** | |

600 −> | *none* | |

601 −> | **DataActions** | |

602 −> | *none* | |

603 −> | **NotDataActions** | |

604 −> | *none* | |

605 −

606 −```json

607 −{

608 − "assignableScopes": [

609 − "/"

610 − ],

611 − "description": "Lets you write metrics to AzureML workspace",

612 − "id": "/providers/Microsoft.Authorization/roleDefinitions/635dd51f-9968-44d3-b7fb-6d9a6bd613ae",

613 − "name": "635dd51f-9968-44d3-b7fb-6d9a6bd613ae",

614 − "permissions": [

615 − {

616 − "actions": [

617 − "Microsoft.MachineLearningServices/workspaces/metrics/*/write"

618 − ],

619 − "notActions": [],

620 − "dataActions": [],

621 − "notDataActions": []

622 − }

623 − ],

624 − "roleName": "AzureML Metrics Writer (preview)",

625 − "roleType": "BuiltInRole",

626 − "type": "Microsoft.Authorization/roleDefinitions"

627 −}

628 −```

629 −

630 −## AzureML Registry User

631 −

632 −Can perform all actions on Machine Learning Services Registry assets as well as get Registry resources.

633 −

634 −[Learn more](/azure/machine-learning/how-to-assign-roles)

635 −

636 −> [!div class="mx-tableFixed"]

637 −> | Actions | Description |

638 −> | --- | --- |

639 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/read | Gets the Machine Learning Services registry(ies) |

640 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/assets/* | |

641 −> | **NotActions** | |

642 −> | *none* | |

643 −> | **DataActions** | |

644 −> | *none* | |

645 −> | **NotDataActions** | |

646 −> | *none* | |

647 −

648 −```json

649 −{

650 − "assignableScopes": [

651 − "/"

652 − ],

653 − "description": "Can perform all actions on Machine Learning Services Registry assets as well as get Registry resources.",

654 − "id": "/providers/Microsoft.Authorization/roleDefinitions/1823dd4f-9b8c-4ab6-ab4e-7397a3684615",

655 − "name": "1823dd4f-9b8c-4ab6-ab4e-7397a3684615",

656 − "permissions": [

657 − {

658 − "actions": [

659 − "Microsoft.MachineLearningServices/registries/read",

660 − "Microsoft.MachineLearningServices/registries/assets/*"

661 − ],

662 − "notActions": [],

663 − "dataActions": [],

664 − "notDataActions": []

665 − }

666 − ],

667 − "roleName": "AzureML Registry User",

668 − "roleType": "BuiltInRole",

669 − "type": "Microsoft.Authorization/roleDefinitions"

670 −}

671 −```

672 −

673 −## Cognitive Services Contributor

674 −

675 −Lets you create, read, update, delete and manage keys of Cognitive Services.

676 −

677 −[Learn more](/azure/ai-services/openai/how-to/role-based-access-control)

678 −

679 −> [!div class="mx-tableFixed"]

680 −> | Actions | Description |

681 −> | --- | --- |

682 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

683 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |

684 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/features/read | Gets the features of a subscription. |

685 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/read | Gets the feature of a subscription in a given resource provider. |

686 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/register/action | Registers the feature for a subscription in a given resource provider. |

687 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

688 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/* | Creates, updates, or reads the diagnostic setting for Analysis Server |

689 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logDefinitions/read | Read log definitions |

690 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricdefinitions/read | Read metric definitions |

691 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |

692 −> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

693 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

694 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |

695 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

696 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

697 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |

698 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

699 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

700 −> | **NotActions** | |

701 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/raiPolicy/write | |

702 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/raiPolicy/delete | |

703 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/raiExternalSafetyProviders/write | Write External Safety Providers |

704 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/raiExternalSafetyProviders/delete | |

705 −> | **DataActions** | |

706 −> | *none* | |

707 −> | **NotDataActions** | |

708 −> | *none* | |

709 −

710 −```json

711 −{

712 − "assignableScopes": [

713 − "/"

714 − ],

715 − "description": "Lets you create, read, update, delete and manage keys of Cognitive Services.",

716 − "id": "/providers/Microsoft.Authorization/roleDefinitions/25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68",

717 − "name": "25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68",

718 − "permissions": [

719 − {

720 − "actions": [

721 − "Microsoft.Authorization/*/read",

722 − "Microsoft.CognitiveServices/*",

723 − "Microsoft.Features/features/read",

724 − "Microsoft.Features/providers/features/read",

725 − "Microsoft.Features/providers/features/register/action",

726 − "Microsoft.Insights/alertRules/*",

727 − "Microsoft.Insights/diagnosticSettings/*",

728 − "Microsoft.Insights/logDefinitions/read",

729 − "Microsoft.Insights/metricdefinitions/read",

730 − "Microsoft.Insights/metrics/read",

731 − "Microsoft.ResourceHealth/availabilityStatuses/read",

732 − "Microsoft.Resources/deployments/*",

733 − "Microsoft.Resources/deployments/operations/read",

734 − "Microsoft.Resources/subscriptions/operationresults/read",

735 − "Microsoft.Resources/subscriptions/read",

736 − "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",

737 − "Microsoft.Resources/subscriptions/resourceGroups/read",

738 − "Microsoft.Support/*"

739 − ],

740 − "notActions": [

741 − "Microsoft.CognitiveServices/raiPolicy/write",

742 − "Microsoft.CognitiveServices/raiPolicy/delete",

743 − "Microsoft.CognitiveServices/raiExternalSafetyProviders/write",

744 − "Microsoft.CognitiveServices/raiExternalSafetyProviders/delete"

745 − ],

746 − "dataActions": [],

747 − "notDataActions": []

748 − }

749 − ],

750 − "roleName": "Cognitive Services Contributor",

751 − "roleType": "BuiltInRole",

752 − "type": "Microsoft.Authorization/roleDefinitions"

753 −}

754 −```

755 −

756 −## Cognitive Services Custom Vision Contributor

757 −

758 −Full access to the project, including the ability to view, create, edit, or delete projects.

759 −

760 −[Learn more](/azure/ai-services/custom-vision-service/role-based-access-control)

761 −

762 −> [!div class="mx-tableFixed"]

763 −> | Actions | Description |

764 −> | --- | --- |

765 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |

766 −> | **NotActions** | |

767 −> | *none* | |

768 −> | **DataActions** | |

769 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/CustomVision/* | |

770 −> | **NotDataActions** | |

771 −> | *none* | |

772 −

773 −```json

774 −{

775 − "assignableScopes": [

776 − "/"

777 − ],

778 − "description": "Full access to the project, including the ability to view, create, edit, or delete projects.",

779 − "id": "/providers/Microsoft.Authorization/roleDefinitions/c1ff6cc2-c111-46fe-8896-e0ef812ad9f3",

780 − "name": "c1ff6cc2-c111-46fe-8896-e0ef812ad9f3",

781 − "permissions": [

782 − {

783 − "actions": [

784 − "Microsoft.CognitiveServices/*/read"

785 − ],

786 − "notActions": [],

787 − "dataActions": [

788 − "Microsoft.CognitiveServices/accounts/CustomVision/*"

789 − ],

790 − "notDataActions": []

791 − }

792 − ],

793 − "roleName": "Cognitive Services Custom Vision Contributor",

794 − "roleType": "BuiltInRole",

795 − "type": "Microsoft.Authorization/roleDefinitions"

796 −}

797 −```

798 −

799 −## Cognitive Services Custom Vision Deployment

800 −

801 −Publish, unpublish or export models. Deployment can view the project but can't update.

802 −

803 −[Learn more](/azure/ai-services/custom-vision-service/role-based-access-control)

804 −

805 −> [!div class="mx-tableFixed"]

Azure built-in roles · ai machine learning

Microsoft's edit · 20 Jun 20:53 UTC