Microsoft's edit · Azure built-in roles · ai machine learning

77 author: rolyon

88 manager: pmwongera

99 ms.author: rolyon

10 −ms.date: 05/25/2025

11 −ms.custom: generated

12 −---

13 −

14 −# Azure built-in roles for AI + machine learning

15 −

16 −This article lists the Azure built-in roles in the AI + machine learning category.

17 −

18 −

19 −## AgFood Platform Sensor Partner Contributor

20 −

21 −Provides contribute access to manage sensor related entities in AgFood Platform Service

22 −

23 −[Learn more](/azure/data-manager-for-agri/how-to-set-up-sensors-customer)

24 −

25 −> [!div class="mx-tableFixed"]

26 −> | Actions | Description |

27 −> | --- | --- |

28 −> | *none* | |

29 −> | **NotActions** | |

30 −> | *none* | |

31 −> | **DataActions** | |

32 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/sensorPartnerScope/* | |

33 −> | **NotDataActions** | |

34 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/sensorPartnerScope/sensors/delete | Deletes an existing AgFoodPlatform sensors resource restricted to caller's sensor partner scope. |

35 −

36 −```json

37 −{

38 − "assignableScopes": [

39 − "/"

40 − ],

41 − "description": "Provides contribute access to manage sensor related entities in AgFood Platform Service",

42 − "id": "/providers/Microsoft.Authorization/roleDefinitions/6b77f0a0-0d89-41cc-acd1-579c22c17a67",

43 − "name": "6b77f0a0-0d89-41cc-acd1-579c22c17a67",

44 − "permissions": [

45 − {

46 − "actions": [],

47 − "notActions": [],

48 − "dataActions": [

49 − "Microsoft.AgFoodPlatform/farmBeats/sensorPartnerScope/*"

50 − ],

51 − "notDataActions": [

52 − "Microsoft.AgFoodPlatform/farmBeats/sensorPartnerScope/sensors/delete"

53 − ]

54 − }

55 − ],

56 − "roleName": "AgFood Platform Sensor Partner Contributor",

57 − "roleType": "BuiltInRole",

58 − "type": "Microsoft.Authorization/roleDefinitions"

59 −}

60 −```

61 −

62 −## AgFood Platform Service Admin

63 −

64 −Provides admin access to AgFood Platform Service

65 −

66 −[Learn more](/azure/data-manager-for-agri/quickstart-install-data-manager-for-agriculture)

67 −

68 −> [!div class="mx-tableFixed"]

69 −> | Actions | Description |

70 −> | --- | --- |

71 −> | *none* | |

72 −> | **NotActions** | |

73 −> | *none* | |

74 −> | **DataActions** | |

75 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/* | Create, update, read and delete any AgFood Platform resources. |

76 −> | **NotDataActions** | |

77 −> | *none* | |

78 −

79 −```json

80 −{

81 − "assignableScopes": [

82 − "/"

83 − ],

84 − "description": "Provides admin access to AgFood Platform Service",

85 − "id": "/providers/Microsoft.Authorization/roleDefinitions/f8da80de-1ff9-4747-ad80-a19b7f6079e3",

86 − "name": "f8da80de-1ff9-4747-ad80-a19b7f6079e3",

87 − "permissions": [

88 − {

89 − "actions": [],

90 − "notActions": [],

91 − "dataActions": [

92 − "Microsoft.AgFoodPlatform/*"

93 − ],

94 − "notDataActions": []

95 − }

96 − ],

97 − "roleName": "AgFood Platform Service Admin",

98 − "roleType": "BuiltInRole",

99 − "type": "Microsoft.Authorization/roleDefinitions"

100 −}

101 −```

102 −

103 −## AgFood Platform Service Contributor

104 −

105 −Provides contribute access to AgFood Platform Service

106 −

107 −[Learn more](/azure/data-manager-for-agri/quickstart-install-data-manager-for-agriculture)

108 −

109 −> [!div class="mx-tableFixed"]

110 −> | Actions | Description |

111 −> | --- | --- |

112 −> | *none* | |

113 −> | **NotActions** | |

114 −> | *none* | |

115 −> | **DataActions** | |

116 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/action | |

117 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/read | Read any AgFood Platform resources. |

118 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/write | Create and update any AgFood Platform resources. |

119 −> | **NotDataActions** | |

120 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/farmers/write | Creates or Updates AgFoodPlatform farmers. |

121 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/deletionJobs/*/write | |

122 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/parties/write | Creates or Updates AgFoodPlatform parties. |

123 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/datasets/write | Creates or Updates AgFoodPlatform datasets. |

124 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/datasetRecords/write | Creates or Updates AgFoodPlatform Dataset Records. |

125 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/datasets/access/*/action | |

126 −

127 −```json

128 −{

129 − "assignableScopes": [

130 − "/"

131 − ],

132 − "description": "Provides contribute access to AgFood Platform Service",

133 − "id": "/providers/Microsoft.Authorization/roleDefinitions/8508508a-4469-4e45-963b-2518ee0bb728",

134 − "name": "8508508a-4469-4e45-963b-2518ee0bb728",

135 − "permissions": [

136 − {

137 − "actions": [],

138 − "notActions": [],

139 − "dataActions": [

140 − "Microsoft.AgFoodPlatform/*/action",

141 − "Microsoft.AgFoodPlatform/*/read",

142 − "Microsoft.AgFoodPlatform/*/write"

143 − ],

144 − "notDataActions": [

145 − "Microsoft.AgFoodPlatform/farmBeats/farmers/write",

146 − "Microsoft.AgFoodPlatform/farmBeats/deletionJobs/*/write",

147 − "Microsoft.AgFoodPlatform/farmBeats/parties/write",

148 − "Microsoft.AgFoodPlatform/farmBeats/datasets/write",

149 − "Microsoft.AgFoodPlatform/farmBeats/datasetRecords/write",

150 − "Microsoft.AgFoodPlatform/farmBeats/datasets/access/*/action"

151 − ]

152 − }

153 − ],

154 − "roleName": "AgFood Platform Service Contributor",

155 − "roleType": "BuiltInRole",

156 − "type": "Microsoft.Authorization/roleDefinitions"

157 −}

158 −```

159 −

160 −## AgFood Platform Service Reader

161 −

162 −Provides read access to AgFood Platform Service

163 −

164 −[Learn more](/azure/data-manager-for-agri/quickstart-install-data-manager-for-agriculture)

165 −

166 −> [!div class="mx-tableFixed"]

167 −> | Actions | Description |

168 −> | --- | --- |

169 −> | *none* | |

170 −> | **NotActions** | |

171 −> | *none* | |

172 −> | **DataActions** | |

173 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/list/action | |

174 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/read | Read any AgFood Platform resources. |

175 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/search/action | |

176 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/download/action | |

177 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/overlap/action | |

178 −> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/checkConsent/action | |

179 −> | **NotDataActions** | |

180 −> | *none* | |

181 −

182 −```json

183 −{

184 − "assignableScopes": [

185 − "/"

186 − ],

187 − "description": "Provides read access to AgFood Platform Service",

188 − "id": "/providers/Microsoft.Authorization/roleDefinitions/7ec7ccdc-f61e-41fe-9aaf-980df0a44eba",

189 − "name": "7ec7ccdc-f61e-41fe-9aaf-980df0a44eba",

190 − "permissions": [

191 − {

192 − "actions": [],

193 − "notActions": [],

194 − "dataActions": [

195 − "Microsoft.AgFoodPlatform/*/list/action",

196 − "Microsoft.AgFoodPlatform/*/read",

197 − "Microsoft.AgFoodPlatform/*/search/action",

198 − "Microsoft.AgFoodPlatform/*/download/action",

199 − "Microsoft.AgFoodPlatform/*/overlap/action",

200 − "Microsoft.AgFoodPlatform/*/checkConsent/action"

201 − ],

202 − "notDataActions": []

203 − }

204 − ],

205 − "roleName": "AgFood Platform Service Reader",

206 − "roleType": "BuiltInRole",

207 − "type": "Microsoft.Authorization/roleDefinitions"

208 −}

209 −```

210 −## Azure AI Account Owner

211 −

212 −Grants full access to manage AI projects and accounts. Includes an ABAC condition to constrain role assignments. Grants conditional assignment of the Azure AI User role to other user principles. Applies for new Foundry resources.

213 −

214 −[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)

215 −

216 −> [!div class="mx-tableFixed"]

217 −> | Actions | Description |

218 −> | --- | --- |

219 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

220 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |

221 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |

222 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |

223 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/features/read | Gets the features of a subscription. |

224 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/read | Gets the feature of a subscription in a given resource provider. |

225 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/register/action | Registers the feature for a subscription in a given resource provider. |

226 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

227 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/* | Creates, updates, or reads the diagnostic setting for Analysis Server |

228 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logDefinitions/read | Read log definitions |

229 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricdefinitions/read | Read metric definitions |

230 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |

231 −> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

232 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

233 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |

234 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

235 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

236 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |

237 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

238 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

239 −> | **NotActions** | |

240 −> | *none* | |

241 −> | **DataActions** | |

242 −> | *none* | |

243 −> | **NotDataActions** | |

244 −> | *none* | |

245 −> | **Condition** | |

246 −> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) | Add or remove role assignments for the following roles:<br/>Azure AI User |

247 −

248 −```json

249 −{

250 − "assignableScopes": [

251 − "/"

252 − ],

253 − "description": "Grants full access to manage AI projects and accounts. Grants conditional assignment of the Azure AI User role to other user principles.",

254 − "id": "/providers/Microsoft.Authorization/roleDefinitions/e47c6f54-e4a2-4754-9501-8e0985b135e1",

255 − "name": "e47c6f54-e4a2-4754-9501-8e0985b135e1",

256 − "permissions": [

257 − {

258 − "actions": [

259 − "Microsoft.Authorization/*/read",

260 − "Microsoft.Authorization/roleAssignments/write",

261 − "Microsoft.Authorization/roleAssignments/delete",

262 − "Microsoft.CognitiveServices/*",

263 − "Microsoft.Features/features/read",

264 − "Microsoft.Features/providers/features/read",

265 − "Microsoft.Features/providers/features/register/action",

266 − "Microsoft.Insights/alertRules/*",

267 − "Microsoft.Insights/diagnosticSettings/*",

268 − "Microsoft.Insights/logDefinitions/read",

269 − "Microsoft.Insights/metricdefinitions/read",

270 − "Microsoft.Insights/metrics/read",

271 − "Microsoft.ResourceHealth/availabilityStatuses/read",

272 − "Microsoft.Resources/deployments/*",

273 − "Microsoft.Resources/deployments/operations/read",

274 − "Microsoft.Resources/subscriptions/operationresults/read",

275 − "Microsoft.Resources/subscriptions/read",

276 − "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",

277 − "Microsoft.Resources/subscriptions/resourceGroups/read",

278 − "Microsoft.Support/*"

279 − ],

280 − "notActions": [],

281 − "dataActions": [],

282 − "notDataActions": [],

283 − "conditionVersion": "2.0",

284 − "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d}))"

285 − }

286 − ],

287 − "roleName": "Azure AI Account Owner",

288 − "roleType": "BuiltInRole",

289 − "type": "Microsoft.Authorization/roleDefinitions"

290 −}

291 −```

292 −

293 −## Azure AI Administrator

294 −

295 −A Built-In Role that has all control plane permissions to work with Azure AI and its dependencies. Applies to Azure Machine Learning and Foundry hubs only.

296 −

297 −[Learn more](/azure/machine-learning/how-to-assign-roles)

298 −

299 −> [!div class="mx-tableFixed"]

300 −> | Actions | Description |

301 −> | --- | --- |

302 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

303 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |

304 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/* | |

305 −> | [Microsoft.DocumentDb](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/* | |

306 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/features/read | Gets the features of a subscription. |

307 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/read | Gets the feature of a subscription in a given resource provider. |

308 −> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/register/action | Registers the feature for a subscription in a given resource provider. |

309 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

310 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/components/* | Create and manage Insights components |

311 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/* | Creates, updates, or reads the diagnostic setting for Analysis Server |

312 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/generateLiveToken/read | Live Metrics get token |

313 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logDefinitions/read | Read log definitions |

314 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricAlerts/* | |

315 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricdefinitions/read | Read metric definitions |

316 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |

317 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/scheduledqueryrules/* | |

318 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/topology/read | Read Topology |

319 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/transactions/read | Read Transactions |

320 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/webtests/* | Create and manage Insights web tests |

321 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/* | |

322 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/* | |

323 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/joinViaServiceEndpoint/action | Joins resource such as storage account or SQL database to a subnet. Not alertable. |

324 −> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

325 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

326 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |

327 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

328 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

329 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |

330 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

331 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/write | Creates or updates a resource group. |

332 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/* | Create and manage storage accounts |

333 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

334 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/write | Creates or updates the search service. |

335 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/read | Reads the search service. |

336 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/delete | Deletes the search service. |

337 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/indexes/* | |

338 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/listAdminKeys/action | Reads the admin keys. |

339 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnections/* | |

340 −> | [Microsoft.DataFactory](../permissions/analytics.md#microsoftdatafactory)/factories/* | |

341 −> | **NotActions** | |

342 −> | *none* | |

343 −> | **DataActions** | |

344 −> | *none* | |

345 −> | **NotDataActions** | |

346 −> | *none* | |

347 −

348 −```json

349 −{

350 − "assignableScopes": [

351 − "/"

352 − ],

353 − "description": "A Built-In Role that has all control plane permissions to work with Azure AI and its dependencies.",

354 − "id": "/providers/Microsoft.Authorization/roleDefinitions/b78c5d69-af96-48a3-bf8d-a8b4d589de94",

355 − "name": "b78c5d69-af96-48a3-bf8d-a8b4d589de94",

356 − "permissions": [

357 − {

358 − "actions": [

359 − "Microsoft.Authorization/*/read",

360 − "Microsoft.CognitiveServices/*",

361 − "Microsoft.ContainerRegistry/registries/*",

362 − "Microsoft.DocumentDb/databaseAccounts/*",

363 − "Microsoft.Features/features/read",

364 − "Microsoft.Features/providers/features/read",

365 − "Microsoft.Features/providers/features/register/action",

366 − "Microsoft.Insights/alertRules/*",

367 − "Microsoft.Insights/components/*",

368 − "Microsoft.Insights/diagnosticSettings/*",

369 − "Microsoft.Insights/generateLiveToken/read",

370 − "Microsoft.Insights/logDefinitions/read",

371 − "Microsoft.Insights/metricAlerts/*",

372 − "Microsoft.Insights/metricdefinitions/read",

373 − "Microsoft.Insights/metrics/read",

374 − "Microsoft.Insights/scheduledqueryrules/*",

375 − "Microsoft.Insights/topology/read",

376 − "Microsoft.Insights/transactions/read",

377 − "Microsoft.Insights/webtests/*",

378 − "Microsoft.KeyVault/*",

379 − "Microsoft.MachineLearningServices/workspaces/*",

380 − "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",

381 − "Microsoft.ResourceHealth/availabilityStatuses/read",

382 − "Microsoft.Resources/deployments/*",

383 − "Microsoft.Resources/deployments/operations/read",

384 − "Microsoft.Resources/subscriptions/operationresults/read",

385 − "Microsoft.Resources/subscriptions/read",

386 − "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",

387 − "Microsoft.Resources/subscriptions/resourceGroups/read",

388 − "Microsoft.Resources/subscriptions/resourceGroups/write",

389 − "Microsoft.Storage/storageAccounts/*",

390 − "Microsoft.Support/*",

391 − "Microsoft.Search/searchServices/write",

392 − "Microsoft.Search/searchServices/read",

393 − "Microsoft.Search/searchServices/delete",

394 − "Microsoft.Search/searchServices/indexes/*",

395 − "Microsoft.Search/searchServices/listAdminKeys/action",

396 − "Microsoft.Search/searchServices/privateEndpointConnections/*",

397 − "Microsoft.DataFactory/factories/*"

398 − ],

399 − "notActions": [],

400 − "dataActions": [],

401 − "notDataActions": []

402 − }

403 − ],

404 − "roleName": "Azure AI Administrator",

405 − "roleType": "BuiltInRole",

406 − "type": "Microsoft.Authorization/roleDefinitions"

407 −}

408 −```

409 −

410 −## Azure AI Developer

411 −

412 −Can perform all actions within an Azure AI resource besides managing the resource itself. Applies to Azure Machine Learning and Foundry hubs only.

413 −

414 −[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)

415 −

416 −> [!div class="mx-tableFixed"]

417 −> | Actions | Description |

418 −> | --- | --- |

419 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/read | |

420 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/action | |

421 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/delete | |

422 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/write | |

423 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/locations/*/read | |

424 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

425 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

426 −> | **NotActions** | |

427 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/delete | Deletes the Machine Learning Services Workspace(s) |

428 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/write | Creates or updates a Machine Learning Services Workspace(s) |

429 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/listKeys/action | List secrets for a Machine Learning Services Workspace |

430 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/write | Creates or updates a Machine Learning Services Hub Workspace(s) |

431 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/delete | Deletes the Machine Learning Services Hub Workspace(s) |

432 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/write | Creates or Updates the Machine Learning Services FeatureStore(s) |

433 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/delete | Deletes the Machine Learning Services FeatureStore(s) |

434 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/evaluations/results/labels/read | Reads evaluation results' label from a Machine Learning Services Workspace |

435 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/evaluations/results/reasonings/read | Reads evaluation results' reasoning from a Machine Learning Services Workspace |

436 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/simulations/results/images/read | Reads image simulation results from a Machine Learning Services Workspace |

437 −> | **DataActions** | |

438 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/* | |

439 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/* | |

440 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/ContentSafety/* | |

441 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/MaaS/* | |

442 −> | **NotDataActions** | |

443 −> | *none* | |

444 −

445 −```json

446 −{

447 − "assignableScopes": [

448 − "/"

449 − ],

450 − "description": "Can perform all actions within an Azure AI resource besides managing the resource itself.",

451 − "id": "/providers/Microsoft.Authorization/roleDefinitions/64702f94-c441-49e6-a78b-ef80e0188fee",

452 − "name": "64702f94-c441-49e6-a78b-ef80e0188fee",

453 − "permissions": [

454 − {

455 − "actions": [

456 − "Microsoft.MachineLearningServices/workspaces/*/read",

457 − "Microsoft.MachineLearningServices/workspaces/*/action",

458 − "Microsoft.MachineLearningServices/workspaces/*/delete",

459 − "Microsoft.MachineLearningServices/workspaces/*/write",

460 − "Microsoft.MachineLearningServices/locations/*/read",

461 − "Microsoft.Authorization/*/read",

462 − "Microsoft.Resources/deployments/*"

463 − ],

464 − "notActions": [

465 − "Microsoft.MachineLearningServices/workspaces/delete",

466 − "Microsoft.MachineLearningServices/workspaces/write",

467 − "Microsoft.MachineLearningServices/workspaces/listKeys/action",

468 − "Microsoft.MachineLearningServices/workspaces/hubs/write",

469 − "Microsoft.MachineLearningServices/workspaces/hubs/delete",

470 − "Microsoft.MachineLearningServices/workspaces/featurestores/write",

471 − "Microsoft.MachineLearningServices/workspaces/featurestores/delete",

472 − "Microsoft.MachineLearningServices/workspaces/evaluations/results/labels/read",

473 − "Microsoft.MachineLearningServices/workspaces/evaluations/results/reasonings/read",

474 − "Microsoft.MachineLearningServices/workspaces/simulations/results/images/read"

475 − ],

476 − "dataActions": [

477 − "Microsoft.CognitiveServices/accounts/OpenAI/*",

478 − "Microsoft.CognitiveServices/accounts/SpeechServices/*",

479 − "Microsoft.CognitiveServices/accounts/ContentSafety/*",

480 − "Microsoft.CognitiveServices/accounts/MaaS/*"

481 − ],

482 − "notDataActions": []

483 − }

484 − ],

485 − "roleName": "Azure AI Developer",

486 − "roleType": "BuiltInRole",

487 − "type": "Microsoft.Authorization/roleDefinitions"

488 −}

489 −```

490 −

491 −## Azure AI Enterprise Network Connection Approver

492 −

493 −Can approve private endpoint connections to Azure AI common dependency resources

494 −

495 −[Learn more](/azure/machine-learning/how-to-managed-network)

496 −

497 −> [!div class="mx-tableFixed"]

498 −> | Actions | Description |

499 −> | --- | --- |

500 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/privateEndpointConnections/read | Get Private Endpoint Connections |

501 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/privateEndpointConnections/write | Approve Or Reject Private Endpoint Connections |

502 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/privateLinkResources/read | Get Private Link Group resources |

503 −> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/read | Read metadata for an API Management Service instance |

504 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnectionsApproval/action | Auto Approves a Private Endpoint Connection |

505 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnections/read | Gets the properties of private endpoint connection or list all the private endpoint connections for the specified container registry |

506 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnections/write | Approves/Rejects the private endpoint connection |

507 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/read | View the Redis Cache's settings and configuration in the management portal |

508 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnections/read | Read a private endpoint connection |

509 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnections/write | Write a private endpoint connection |

510 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateLinkResources/read | Read 'groupId' of redis subresource that a private link can be connected to |

511 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |

512 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/read | View the Redis Enterprise cache's settings and configuration in the management portal |

513 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnections/read | Read a private endpoint connection |

514 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnections/write | Write a private endpoint connection |

515 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateLinkResources/read | Read 'groupId' of redis subresource that a private link can be connected to |

516 −> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |

517 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/read | Reads API accounts. |

518 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateEndpointConnections/read | Reads private endpoint connections. |

519 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateEndpointConnections/write | Writes a private endpoint connections. |

520 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateLinkResources/read | Reads private link resources for an account. |

521 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateEndpointConnectionsApproval/action | Determines if the user is allowed to approve a private endpoint connection |

522 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection. |

523 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |

524 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateLinkResources/read | Return a list containing private link resource or gets the specified private link resource. |

525 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/read | Return the list of servers or gets the properties for the specified server. |

526 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection for PostgreSQL SGv2 |

527 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection |

528 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |

529 −> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateLinkResources/read | Get the private link resources for the corresponding PostgreSQL SGv2 |

530 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection |

531 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateEndpointConnections/read | |

532 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |

533 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateLinkResources/read | Get the private link resources for the corresponding MySQL Server |

534 −> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/read | Returns the list of servers or gets the properties for the specified server. |

535 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnectionsApproval/action | Manage a private endpoint connection of Database Account |

536 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/read | Read a private endpoint connection or list all the private endpoint connections of a Database Account |

537 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/write | Create or update a private endpoint connection of a Database Account |

538 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateLinkResources/read | Read a private link resource or list all the private link resources of a Database Account |

539 −> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/read | Reads a database account. |

540 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |

541 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

542 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

543 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateLinkResources/read | Get the available private link resources for the specified instance of Key Vault |

544 −> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/read | View the properties of a key vault |

545 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |

546 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

547 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

548 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateLinkResources/read | Gets the available private link resources for the specified instance of the Machine Learning Services registry(ies) |

549 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/read | Gets the Machine Learning Services registry(ies) |

550 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |

551 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

552 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |

553 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateLinkResources/read | Gets the available private link resources for the specified instance of the Machine Learning Services Workspace(s) |

554 −> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/read | Gets the Machine Learning Services Workspace(s) |

555 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateEndpointConnections/read | Get Private Endpoint Connection |

556 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateEndpointConnections/write | Put Private Endpoint Connection |

557 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateLinkResources/read | Get StorageAccount groupids |

558 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/read | Returns the list of storage accounts or gets the properties for the specified storage account. |

559 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/PrivateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |

560 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection |

561 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection. |

562 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |

563 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateLinkResources/read | Get the private link resources for the corresponding sql server |

564 −> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/read | Return the list of servers or gets the properties for the specified server. |

565 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connection |

566 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateEndpointConnections/read | Get Private Endpoint Connection |

567 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateEndpointConnections/write | Create or Update Private Endpoint Connection |

568 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateLinkResources/read | Gets the resource types that support private endpoint connections |

569 −> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/read | Get the list of Namespace Resource Description |

570 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connection |

571 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connections |

572 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnections/write | Creates a private endpoint connections with the specified parameters or updates the properties or tags for the specified private endpoint connections |

573 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/sharedPrivateLinkResources/read | Returns the list of shared private link resources or gets the properties for the specified shared private link resource |

574 −> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/read | Reads the search service. |

575 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |

576 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateEndpointConnections/read | Read a private endpoint connection |

577 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateEndpointConnections/write | Create or update a private endpoint connection |

578 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateLinkResources/read | Read a private link resource |

579 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/read | Read a private link scope |

580 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/privateEndpointConnectionsApproval/action | Approve or reject PrivateEndpoint connection on PrivateLinkService |

581 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/privateEndpointConnections/read | Gets an private endpoint connection definition. |

582 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/privateEndpointConnections/write | Creates a new private endpoint connection, or updates an existing private endpoint connection. |

583 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/read | Gets an private link service resource. |

584 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/privateEndpointConnections/read | Gets Application Gateway PrivateEndpoint Connections |

585 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/privateEndpointConnections/write | Updates Application Gateway PrivateEndpoint Connection |

586 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/privateLinkResources/read | Gets ApplicationGateway PrivateLink Resources |

587 −> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/read | Gets an application gateway |

588 −> | **NotActions** | |

589 −> | *none* | |

590 −> | **DataActions** | |

591 −> | *none* | |

592 −> | **NotDataActions** | |

593 −> | *none* | |

594 −

595 −```json

596 −{

597 − "assignableScopes": [

598 − "/"

599 − ],

600 − "description": "Can approve private endpoint connections to Azure AI common dependency resources",

601 − "id": "/providers/Microsoft.Authorization/roleDefinitions/b556d68e-0be0-4f35-a333-ad7ee1ce17ea",

602 − "name": "b556d68e-0be0-4f35-a333-ad7ee1ce17ea",

603 − "permissions": [

604 − {

605 − "actions": [

606 − "Microsoft.ApiManagement/service/privateEndpointConnections/read",

607 − "Microsoft.ApiManagement/service/privateEndpointConnections/write",

608 − "Microsoft.ApiManagement/service/privateLinkResources/read",

609 − "Microsoft.ApiManagement/service/read",

610 − "Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",

611 − "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",

612 − "Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",

613 − "Microsoft.Cache/redis/read",

614 − "Microsoft.Cache/redis/privateEndpointConnections/read",

615 − "Microsoft.Cache/redis/privateEndpointConnections/write",

616 − "Microsoft.Cache/redis/privateLinkResources/read",

617 − "Microsoft.Cache/redis/privateEndpointConnectionsApproval/action",

618 − "Microsoft.Cache/redisEnterprise/read",

619 − "Microsoft.Cache/redisEnterprise/privateEndpointConnections/read",

620 − "Microsoft.Cache/redisEnterprise/privateEndpointConnections/write",

621 − "Microsoft.Cache/redisEnterprise/privateLinkResources/read",

622 − "Microsoft.Cache/redisEnterprise/privateEndpointConnectionsApproval/action",

623 − "Microsoft.CognitiveServices/accounts/read",

624 − "Microsoft.CognitiveServices/accounts/privateEndpointConnections/read",

625 − "Microsoft.CognitiveServices/accounts/privateEndpointConnections/write",

626 − "Microsoft.CognitiveServices/accounts/privateLinkResources/read",

627 − "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnectionsApproval/action",

628 − "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read",

629 − "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/write",

630 − "Microsoft.DBforPostgreSQL/flexibleServers/privateLinkResources/read",

631 − "Microsoft.DBforPostgreSQL/flexibleServers/read",

632 − "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnectionsApproval/action",

633 − "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/read",

634 − "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/write",

635 − "Microsoft.DBforPostgreSQL/serverGroupsv2/privateLinkResources/read",

636 − "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnectionsApproval/action",

637 − "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/read",

638 − "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/write",

639 − "Microsoft.DBforMySQL/flexibleServers/privateLinkResources/read",

640 − "Microsoft.DBforMySQL/flexibleServers/read",

641 − "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionsApproval/action",

642 − "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/read",

643 − "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write",

644 − "Microsoft.DocumentDB/databaseAccounts/privateLinkResources/read",

645 − "Microsoft.DocumentDB/databaseAccounts/read",

646 − "Microsoft.KeyVault/vaults/privateEndpointConnectionsApproval/action",

647 − "Microsoft.KeyVault/vaults/privateEndpointConnections/read",

648 − "Microsoft.KeyVault/vaults/privateEndpointConnections/write",

649 − "Microsoft.KeyVault/vaults/privateLinkResources/read",

650 − "Microsoft.KeyVault/vaults/read",

651 − "Microsoft.MachineLearningServices/registries/privateEndpointConnectionsApproval/action",

652 − "Microsoft.MachineLearningServices/registries/privateEndpointConnections/read",

653 − "Microsoft.MachineLearningServices/registries/privateEndpointConnections/write",

654 − "Microsoft.MachineLearningServices/registries/privateLinkResources/read",

655 − "Microsoft.MachineLearningServices/registries/read",

656 − "Microsoft.MachineLearningServices/workspaces/privateEndpointConnectionsApproval/action",

657 − "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read",

658 − "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write",

659 − "Microsoft.MachineLearningServices/workspaces/privateLinkResources/read",

660 − "Microsoft.MachineLearningServices/workspaces/read",

661 − "Microsoft.Storage/storageAccounts/privateEndpointConnections/read",

662 − "Microsoft.Storage/storageAccounts/privateEndpointConnections/write",

663 − "Microsoft.Storage/storageAccounts/privateLinkResources/read",

664 − "Microsoft.Storage/storageAccounts/read",

665 − "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",

666 − "Microsoft.Sql/servers/privateEndpointConnectionsApproval/action",

667 − "Microsoft.Sql/servers/privateEndpointConnections/read",

668 − "Microsoft.Sql/servers/privateEndpointConnections/write",

669 − "Microsoft.Sql/servers/privateLinkResources/read",

670 − "Microsoft.Sql/servers/read",

671 − "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",

672 − "Microsoft.EventHub/namespaces/privateEndpointConnections/read",

673 − "Microsoft.EventHub/namespaces/privateEndpointConnections/write",

674 − "Microsoft.EventHub/namespaces/privateLinkResources/read",

675 − "Microsoft.EventHub/namespaces/read",

676 − "Microsoft.Search/searchServices/privateEndpointConnectionsApproval/action",

677 − "Microsoft.Search/searchServices/privateEndpointConnections/read",

678 − "Microsoft.Search/searchServices/privateEndpointConnections/write",

679 − "Microsoft.Search/searchServices/sharedPrivateLinkResources/read",

680 − "Microsoft.Search/searchServices/read",

681 − "Microsoft.Insights/privatelinkscopes/privateEndpointConnectionsApproval/action",

682 − "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/read",

683 − "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/write",

684 − "Microsoft.Insights/privatelinkscopes/privateLinkResources/read",

685 − "Microsoft.Insights/privatelinkscopes/read",

686 − "Microsoft.Network/privateLinkServices/privateEndpointConnectionsApproval/action",

687 − "Microsoft.Network/privateLinkServices/privateEndpointConnections/read",

688 − "Microsoft.Network/privateLinkServices/privateEndpointConnections/write",

689 − "Microsoft.Network/privateLinkServices/read",

690 − "Microsoft.Network/applicationGateways/privateEndpointConnections/read",

691 − "Microsoft.Network/applicationGateways/privateEndpointConnections/write",

692 − "Microsoft.Network/applicationGateways/privateLinkResources/read",

693 − "Microsoft.Network/applicationGateways/read"

694 − ],

695 − "notActions": [],

696 − "dataActions": [],

697 − "notDataActions": []

698 − }

699 − ],

700 − "roleName": "Azure AI Enterprise Network Connection Approver",

701 − "roleType": "BuiltInRole",

702 − "type": "Microsoft.Authorization/roleDefinitions"

703 −}

704 −```

705 −

706 −## Azure AI Inference Deployment Operator

707 −

708 −Can perform all actions required to create a resource deployment within a resource group.

709 −

710 −[Learn more](/azure/ai-foundry/concepts/hub-rbac-azure-ai-foundry)

711 −

712 −> [!div class="mx-tableFixed"]

713 −> | Actions | Description |

714 −> | --- | --- |

715 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

716 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

717 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AutoscaleSettings/write | Create or update an autoscale setting |

718 −> | **NotActions** | |

719 −> | *none* | |

720 −> | **DataActions** | |

721 −> | *none* | |

722 −> | **NotDataActions** | |

723 −> | *none* | |

724 −

725 −```json

726 −{

727 − "assignableScopes": [

728 − "/"

729 − ],

730 − "description": "Can perform all actions required to create a resource deployment within a resource group.",

731 − "id": "/providers/Microsoft.Authorization/roleDefinitions/3afb7f49-54cb-416e-8c09-6dc049efa503",

732 − "name": "3afb7f49-54cb-416e-8c09-6dc049efa503",

733 − "permissions": [

734 − {

735 − "actions": [

736 − "Microsoft.Authorization/*/read",

737 − "Microsoft.Resources/deployments/*",

738 − "Microsoft.Insights/AutoscaleSettings/write"

739 − ],

740 − "notActions": [],

741 − "dataActions": [],

742 − "notDataActions": []

743 − }

744 − ],

745 − "roleName": "Azure AI Inference Deployment Operator",

746 − "roleType": "BuiltInRole",

747 − "type": "Microsoft.Authorization/roleDefinitions"

748 −}

749 −```

750 −

751 −## Azure AI Owner

752 −

753 −Grants full to manage AI project and accounts. Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project. Applies for new Foundry resources.

754 −

755 −[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)

756 −

757 −> [!div class="mx-tableFixed"]

758 −> | Actions | Description |

759 −> | --- | --- |

760 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

761 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |

762 −> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

763 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

764 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |

765 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

766 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

767 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |

768 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

769 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

770 −> | **NotActions** | |

771 −> | *none* | |

772 −> | **DataActions** | |

773 −> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |

774 −> | **NotDataActions** | |

775 −> | *none* | |

776 −

777 −```json

778 −{

779 − "assignableScopes": [

780 − "/"

781 − ],

782 − "description": "Grants full to manage AI project and accounts. Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project.",

783 − "id": "/providers/Microsoft.Authorization/roleDefinitions/c883944f-8b7b-4483-af10-35834be79c4a",

784 − "name": "c883944f-8b7b-4483-af10-35834be79c4a",

785 − "permissions": [

786 − {

787 − "actions": [

788 − "Microsoft.Authorization/*/read",

789 − "Microsoft.CognitiveServices/*",

790 − "Microsoft.ResourceHealth/availabilityStatuses/read",

791 − "Microsoft.Resources/deployments/*",

792 − "Microsoft.Resources/deployments/operations/read",

793 − "Microsoft.Resources/subscriptions/operationresults/read",

794 − "Microsoft.Resources/subscriptions/read",

795 − "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",

796 − "Microsoft.Resources/subscriptions/resourceGroups/read",

797 − "Microsoft.Support/*"

798 − ],

799 − "notActions": [],

800 − "dataActions": [

801 − "Microsoft.CognitiveServices/*"

802 − ],

803 − "notDataActions": []

804 − }

805 − ],

Azure built-in roles · ai machine learning

Microsoft's edit · 2 Jan 19:05 UTC