Azure built-in roles · ai machine learning
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit a1a0143 · +0 −796 lines · also on GitHub
⋯ 15 unchanged lines
1616
This article lists the Azure built-in roles in the AI + machine learning category.
1717
1818
19
−## Foundry Account Owner
20
−
21
−Grants full access to manage AI projects and accounts. Includes an ABAC condition to constrain role assignments. Grants conditional assignment of the Foundry User role to other user principles. Applies for new Foundry resources.
22
−
23
−[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)
24
−
25
−> [!div class="mx-tableFixed"]
26
−> | Actions | Description |
27
−> | --- | --- |
28
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
29
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
30
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
31
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
32
−> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/features/read | Gets the features of a subscription. |
33
−> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/read | Gets the feature of a subscription in a given resource provider. |
34
−> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/register/action | Registers the feature for a subscription in a given resource provider. |
35
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
36
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/* | Creates, updates, or reads the diagnostic setting for Analysis Server |
37
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logDefinitions/read | Read log definitions |
38
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricdefinitions/read | Read metric definitions |
39
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |
40
−> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
41
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
42
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
43
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
44
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
45
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |
46
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
47
−> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
48
−> | **NotActions** | |
49
−> | *none* | |
50
−> | **DataActions** | |
51
−> | *none* | |
52
−> | **NotDataActions** | |
53
−> | *none* | |
54
−> | **Condition** | |
55
−> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) | Add or remove role assignments for the following roles:<br/>Foundry User |
56
−
57
−```json
58
−{
59
− "assignableScopes": [
60
− "/"
61
− ],
62
− "description": "Grants full access to manage AI projects and accounts. Grants conditional assignment of the Foundry User role to other user principles.",
63
− "id": "/providers/Microsoft.Authorization/roleDefinitions/e47c6f54-e4a2-4754-9501-8e0985b135e1",
64
− "name": "e47c6f54-e4a2-4754-9501-8e0985b135e1",
65
− "permissions": [
66
− {
67
− "actions": [
68
− "Microsoft.Authorization/*/read",
69
− "Microsoft.Authorization/roleAssignments/write",
70
− "Microsoft.Authorization/roleAssignments/delete",
71
− "Microsoft.CognitiveServices/*",
72
− "Microsoft.Features/features/read",
73
− "Microsoft.Features/providers/features/read",
74
− "Microsoft.Features/providers/features/register/action",
75
− "Microsoft.Insights/alertRules/*",
76
− "Microsoft.Insights/diagnosticSettings/*",
77
− "Microsoft.Insights/logDefinitions/read",
78
− "Microsoft.Insights/metricdefinitions/read",
79
− "Microsoft.Insights/metrics/read",
80
− "Microsoft.ResourceHealth/availabilityStatuses/read",
81
− "Microsoft.Resources/deployments/*",
82
− "Microsoft.Resources/deployments/operations/read",
83
− "Microsoft.Resources/subscriptions/operationresults/read",
84
− "Microsoft.Resources/subscriptions/read",
85
− "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
86
− "Microsoft.Resources/subscriptions/resourceGroups/read",
87
− "Microsoft.Support/*"
88
− ],
89
− "notActions": [],
90
− "dataActions": [],
91
− "notDataActions": [],
92
− "conditionVersion": "2.0",
93
− "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d}))"
94
− }
95
− ],
96
− "roleName": "Foundry Account Owner",
97
− "roleType": "BuiltInRole",
98
− "type": "Microsoft.Authorization/roleDefinitions"
99
−}
100
−```
101
−
102
−## Azure AI Administrator
103
−
104
−A Built-In Role that has all control plane permissions to work with Azure AI and its dependencies. Applies to Azure Machine Learning and Foundry hubs only.
105
−
106
−[Learn more](/azure/machine-learning/how-to-assign-roles)
107
−
108
−> [!div class="mx-tableFixed"]
109
−> | Actions | Description |
110
−> | --- | --- |
111
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
112
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
113
−> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/* | |
114
−> | [Microsoft.DocumentDb](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/* | |
115
−> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/features/read | Gets the features of a subscription. |
116
−> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/read | Gets the feature of a subscription in a given resource provider. |
117
−> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/register/action | Registers the feature for a subscription in a given resource provider. |
118
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
119
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/components/* | Create and manage Insights components |
120
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/* | Creates, updates, or reads the diagnostic setting for Analysis Server |
121
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/generateLiveToken/read | Live Metrics get token |
122
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logDefinitions/read | Read log definitions |
123
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricAlerts/* | |
124
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricdefinitions/read | Read metric definitions |
125
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |
126
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/scheduledqueryrules/* | |
127
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/topology/read | Read Topology |
128
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/transactions/read | Read Transactions |
129
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/webtests/* | Create and manage Insights web tests |
130
−> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/* | |
131
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/* | |
132
−> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/joinViaServiceEndpoint/action | Joins resource such as storage account or SQL database to a subnet. Not alertable. |
133
−> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
134
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
135
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
136
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
137
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
138
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |
139
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
140
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/write | Creates or updates a resource group. |
141
−> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/* | Create and manage storage accounts |
142
−> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
143
−> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/write | Creates or updates the search service. |
144
−> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/read | Reads the search service. |
145
−> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/delete | Deletes the search service. |
146
−> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/indexes/* | |
147
−> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/listAdminKeys/action | Reads the admin keys. |
148
−> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnections/* | |
149
−> | [Microsoft.DataFactory](../permissions/analytics.md#microsoftdatafactory)/factories/* | |
150
−> | **NotActions** | |
151
−> | *none* | |
152
−> | **DataActions** | |
153
−> | *none* | |
154
−> | **NotDataActions** | |
155
−> | *none* | |
156
−
157
−```json
158
−{
159
− "assignableScopes": [
160
− "/"
161
− ],
162
− "description": "A Built-In Role that has all control plane permissions to work with Azure AI and its dependencies.",
163
− "id": "/providers/Microsoft.Authorization/roleDefinitions/b78c5d69-af96-48a3-bf8d-a8b4d589de94",
164
− "name": "b78c5d69-af96-48a3-bf8d-a8b4d589de94",
165
− "permissions": [
166
− {
167
− "actions": [
168
− "Microsoft.Authorization/*/read",
169
− "Microsoft.CognitiveServices/*",
170
− "Microsoft.ContainerRegistry/registries/*",
171
− "Microsoft.DocumentDb/databaseAccounts/*",
172
− "Microsoft.Features/features/read",
173
− "Microsoft.Features/providers/features/read",
174
− "Microsoft.Features/providers/features/register/action",
175
− "Microsoft.Insights/alertRules/*",
176
− "Microsoft.Insights/components/*",
177
− "Microsoft.Insights/diagnosticSettings/*",
178
− "Microsoft.Insights/generateLiveToken/read",
179
− "Microsoft.Insights/logDefinitions/read",
180
− "Microsoft.Insights/metricAlerts/*",
181
− "Microsoft.Insights/metricdefinitions/read",
182
− "Microsoft.Insights/metrics/read",
183
− "Microsoft.Insights/scheduledqueryrules/*",
184
− "Microsoft.Insights/topology/read",
185
− "Microsoft.Insights/transactions/read",
186
− "Microsoft.Insights/webtests/*",
187
− "Microsoft.KeyVault/*",
188
− "Microsoft.MachineLearningServices/workspaces/*",
189
− "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
190
− "Microsoft.ResourceHealth/availabilityStatuses/read",
191
− "Microsoft.Resources/deployments/*",
192
− "Microsoft.Resources/deployments/operations/read",
193
− "Microsoft.Resources/subscriptions/operationresults/read",
194
− "Microsoft.Resources/subscriptions/read",
195
− "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
196
− "Microsoft.Resources/subscriptions/resourceGroups/read",
197
− "Microsoft.Resources/subscriptions/resourceGroups/write",
198
− "Microsoft.Storage/storageAccounts/*",
199
− "Microsoft.Support/*",
200
− "Microsoft.Search/searchServices/write",
201
− "Microsoft.Search/searchServices/read",
202
− "Microsoft.Search/searchServices/delete",
203
− "Microsoft.Search/searchServices/indexes/*",
204
− "Microsoft.Search/searchServices/listAdminKeys/action",
205
− "Microsoft.Search/searchServices/privateEndpointConnections/*",
206
− "Microsoft.DataFactory/factories/*"
207
− ],
208
− "notActions": [],
209
− "dataActions": [],
210
− "notDataActions": []
211
− }
212
− ],
213
− "roleName": "Azure AI Administrator",
214
− "roleType": "BuiltInRole",
215
− "type": "Microsoft.Authorization/roleDefinitions"
216
−}
217
−```
218
−
219
−## Azure AI Developer
220
−
221
−Can perform all actions within an Azure AI resource besides managing the resource itself. Applies to Azure Machine Learning and Foundry hubs only.
222
−
223
−[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)
224
−
225
−> [!div class="mx-tableFixed"]
226
−> | Actions | Description |
227
−> | --- | --- |
228
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/read | |
229
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/action | |
230
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/delete | |
231
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/*/write | |
232
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/locations/*/read | |
233
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
234
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
235
−> | **NotActions** | |
236
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/delete | Deletes the Machine Learning Services Workspace(s) |
237
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/write | Creates or updates a Machine Learning Services Workspace(s) |
238
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/listKeys/action | List secrets for a Machine Learning Services Workspace |
239
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/write | Creates or updates a Machine Learning Services Hub Workspace(s) |
240
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/hubs/delete | Deletes the Machine Learning Services Hub Workspace(s) |
241
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/write | Creates or Updates the Machine Learning Services FeatureStore(s) |
242
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/featurestores/delete | Deletes the Machine Learning Services FeatureStore(s) |
243
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/evaluations/results/labels/read | Reads evaluation results' label from a Machine Learning Services Workspace |
244
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/evaluations/results/reasonings/read | Reads evaluation results' reasoning from a Machine Learning Services Workspace |
245
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/simulations/results/images/read | Reads image simulation results from a Machine Learning Services Workspace |
246
−> | **DataActions** | |
247
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/* | |
248
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/* | |
249
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/ContentSafety/* | |
250
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/MaaS/* | |
251
−> | **NotDataActions** | |
252
−> | *none* | |
253
−
254
−```json
255
−{
256
− "assignableScopes": [
257
− "/"
258
− ],
259
− "description": "Can perform all actions within an Azure AI resource besides managing the resource itself.",
260
− "id": "/providers/Microsoft.Authorization/roleDefinitions/64702f94-c441-49e6-a78b-ef80e0188fee",
261
− "name": "64702f94-c441-49e6-a78b-ef80e0188fee",
262
− "permissions": [
263
− {
264
− "actions": [
265
− "Microsoft.MachineLearningServices/workspaces/*/read",
266
− "Microsoft.MachineLearningServices/workspaces/*/action",
267
− "Microsoft.MachineLearningServices/workspaces/*/delete",
268
− "Microsoft.MachineLearningServices/workspaces/*/write",
269
− "Microsoft.MachineLearningServices/locations/*/read",
270
− "Microsoft.Authorization/*/read",
271
− "Microsoft.Resources/deployments/*"
272
− ],
273
− "notActions": [
274
− "Microsoft.MachineLearningServices/workspaces/delete",
275
− "Microsoft.MachineLearningServices/workspaces/write",
276
− "Microsoft.MachineLearningServices/workspaces/listKeys/action",
277
− "Microsoft.MachineLearningServices/workspaces/hubs/write",
278
− "Microsoft.MachineLearningServices/workspaces/hubs/delete",
279
− "Microsoft.MachineLearningServices/workspaces/featurestores/write",
280
− "Microsoft.MachineLearningServices/workspaces/featurestores/delete",
281
− "Microsoft.MachineLearningServices/workspaces/evaluations/results/labels/read",
282
− "Microsoft.MachineLearningServices/workspaces/evaluations/results/reasonings/read",
283
− "Microsoft.MachineLearningServices/workspaces/simulations/results/images/read"
284
− ],
285
− "dataActions": [
286
− "Microsoft.CognitiveServices/accounts/OpenAI/*",
287
− "Microsoft.CognitiveServices/accounts/SpeechServices/*",
288
− "Microsoft.CognitiveServices/accounts/ContentSafety/*",
289
− "Microsoft.CognitiveServices/accounts/MaaS/*"
290
− ],
291
− "notDataActions": []
292
− }
293
− ],
294
− "roleName": "Azure AI Developer",
295
− "roleType": "BuiltInRole",
296
− "type": "Microsoft.Authorization/roleDefinitions"
297
−}
298
−```
299
−
300
−## Azure AI Enterprise Network Connection Approver
301
−
302
−Can approve private endpoint connections to Azure AI common dependency resources
303
−
304
−[Learn more](/azure/machine-learning/how-to-managed-network)
305
−
306
−> [!div class="mx-tableFixed"]
307
−> | Actions | Description |
308
−> | --- | --- |
309
−> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/privateEndpointConnections/read | Get Private Endpoint Connections |
310
−> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/privateEndpointConnections/write | Approve Or Reject Private Endpoint Connections |
311
−> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/privateLinkResources/read | Get Private Link Group resources |
312
−> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/read | Read metadata for an API Management Service instance |
313
−> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnectionsApproval/action | Auto Approves a Private Endpoint Connection |
314
−> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnections/read | Gets the properties of private endpoint connection or list all the private endpoint connections for the specified container registry |
315
−> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/privateEndpointConnections/write | Approves/Rejects the private endpoint connection |
316
−> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/read | View the Redis Cache's settings and configuration in the management portal |
317
−> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnections/read | Read a private endpoint connection |
318
−> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnections/write | Write a private endpoint connection |
319
−> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateLinkResources/read | Read 'groupId' of redis subresource that a private link can be connected to |
320
−> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redis/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |
321
−> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/read | View the Redis Enterprise cache's settings and configuration in the management portal |
322
−> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnections/read | Read a private endpoint connection |
323
−> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnections/write | Write a private endpoint connection |
324
−> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateLinkResources/read | Read 'groupId' of redis subresource that a private link can be connected to |
325
−> | [Microsoft.Cache](../permissions/databases.md#microsoftcache)/redisEnterprise/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |
326
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/read | Reads API accounts. |
327
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateEndpointConnections/read | Reads private endpoint connections. |
328
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateEndpointConnections/write | Writes a private endpoint connections. |
329
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/privateLinkResources/read | Reads private link resources for an account. |
330
−> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateEndpointConnectionsApproval/action | Determines if the user is allowed to approve a private endpoint connection |
331
−> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection. |
332
−> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |
333
−> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/privateLinkResources/read | Return a list containing private link resource or gets the specified private link resource. |
334
−> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/read | Return the list of servers or gets the properties for the specified server. |
335
−> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection for PostgreSQL SGv2 |
336
−> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection |
337
−> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |
338
−> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/serverGroupsv2/privateLinkResources/read | Get the private link resources for the corresponding PostgreSQL SGv2 |
339
−> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection |
340
−> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateEndpointConnections/read | |
341
−> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |
342
−> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateLinkResources/read | Get the private link resources for the corresponding MySQL Server |
343
−> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/read | Returns the list of servers or gets the properties for the specified server. |
344
−> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnectionsApproval/action | Manage a private endpoint connection of Database Account |
345
−> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/operationResults/read | Read Status of privateEndpointConnections asynchronous operation |
346
−> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/read | Read a private endpoint connection or list all the private endpoint connections of a Database Account |
347
−> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/write | Create or update a private endpoint connection of a Database Account |
348
−> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateLinkResources/read | Read a private link resource or list all the private link resources of a Database Account |
349
−> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/read | Reads a database account. |
350
−> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |
351
−> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |
352
−> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |
353
−> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/privateLinkResources/read | Get the available private link resources for the specified instance of Key Vault |
354
−> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/read | View the properties of a key vault |
355
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |
356
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |
357
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |
358
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/privateLinkResources/read | Gets the available private link resources for the specified instance of the Machine Learning Services registry(ies) |
359
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/read | Gets the Machine Learning Services registry(ies) |
360
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |
361
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnections/read | View the state of a connection to a Private Endpoint resource of Microsoft.Network provider |
362
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateEndpointConnections/write | Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider |
363
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/privateLinkResources/read | Gets the available private link resources for the specified instance of the Machine Learning Services Workspace(s) |
364
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/read | Gets the Machine Learning Services Workspace(s) |
365
−> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateEndpointConnections/read | Get Private Endpoint Connection |
366
−> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateEndpointConnections/write | Put Private Endpoint Connection |
367
−> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/privateLinkResources/read | Get StorageAccount groupids |
368
−> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/read | Returns the list of storage accounts or gets the properties for the specified storage account. |
369
−> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/PrivateEndpointConnectionsApproval/action | Approve Private Endpoint Connections |
370
−> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnectionsApproval/action | Determines if user is allowed to approve a private endpoint connection |
371
−> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection. |
372
−> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateEndpointConnections/write | Approves or rejects an existing private endpoint connection |
373
−> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/privateLinkResources/read | Get the private link resources for the corresponding sql server |
374
−> | [Microsoft.Sql](../permissions/databases.md#microsoftsql)/servers/read | Return the list of servers or gets the properties for the specified server. |
375
−> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connection |
376
−> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateEndpointConnections/read | Get Private Endpoint Connection |
377
−> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateEndpointConnections/write | Create or Update Private Endpoint Connection |
378
−> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/privateLinkResources/read | Gets the resource types that support private endpoint connections |
379
−> | [Microsoft.EventHub](../permissions/integration.md#microsofteventhub)/namespaces/read | Get the list of Namespace Resource Description |
380
−> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connection |
381
−> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnections/read | Returns the list of private endpoint connections or gets the properties for the specified private endpoint connections |
382
−> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/privateEndpointConnections/write | Creates a private endpoint connections with the specified parameters or updates the properties or tags for the specified private endpoint connections |
383
−> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/sharedPrivateLinkResources/read | Returns the list of shared private link resources or gets the properties for the specified shared private link resource |
384
−> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/read | Reads the search service. |
385
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateEndpointConnectionsApproval/action | Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider |
386
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateEndpointConnections/read | Read a private endpoint connection |
387
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateEndpointConnections/write | Create or update a private endpoint connection |
388
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/privateLinkResources/read | Read a private link resource |
389
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/privatelinkscopes/read | Read a private link scope |
390
−> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/privateEndpointConnectionsApproval/action | Approve or reject PrivateEndpoint connection on PrivateLinkService |
391
−> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/privateEndpointConnections/read | Gets an private endpoint connection definition. |
392
−> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/privateEndpointConnections/write | Creates a new private endpoint connection, or updates an existing private endpoint connection. |
393
−> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateLinkServices/read | Gets an private link service resource. |
394
−> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/privateEndpointConnections/read | Gets Application Gateway PrivateEndpoint Connections |
395
−> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/privateEndpointConnections/write | Updates Application Gateway PrivateEndpoint Connection |
396
−> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/privateLinkResources/read | Gets ApplicationGateway PrivateLink Resources |
397
−> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationGateways/read | Gets an application gateway |
398
−> | **NotActions** | |
399
−> | *none* | |
400
−> | **DataActions** | |
401
−> | *none* | |
402
−> | **NotDataActions** | |
403
−> | *none* | |
404
−
405
−```json
406
−{
407
− "assignableScopes": [
408
− "/"
409
− ],
410
− "description": "Can approve private endpoint connections to Azure AI common dependency resources",
411
− "id": "/providers/Microsoft.Authorization/roleDefinitions/b556d68e-0be0-4f35-a333-ad7ee1ce17ea",
412
− "name": "b556d68e-0be0-4f35-a333-ad7ee1ce17ea",
413
− "permissions": [
414
− {
415
− "actions": [
416
− "Microsoft.ApiManagement/service/privateEndpointConnections/read",
417
− "Microsoft.ApiManagement/service/privateEndpointConnections/write",
418
− "Microsoft.ApiManagement/service/privateLinkResources/read",
419
− "Microsoft.ApiManagement/service/read",
420
− "Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",
421
− "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
422
− "Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",
423
− "Microsoft.Cache/redis/read",
424
− "Microsoft.Cache/redis/privateEndpointConnections/read",
425
− "Microsoft.Cache/redis/privateEndpointConnections/write",
426
− "Microsoft.Cache/redis/privateLinkResources/read",
427
− "Microsoft.Cache/redis/privateEndpointConnectionsApproval/action",
428
− "Microsoft.Cache/redisEnterprise/read",
429
− "Microsoft.Cache/redisEnterprise/privateEndpointConnections/read",
430
− "Microsoft.Cache/redisEnterprise/privateEndpointConnections/write",
431
− "Microsoft.Cache/redisEnterprise/privateLinkResources/read",
432
− "Microsoft.Cache/redisEnterprise/privateEndpointConnectionsApproval/action",
433
− "Microsoft.CognitiveServices/accounts/read",
434
− "Microsoft.CognitiveServices/accounts/privateEndpointConnections/read",
435
− "Microsoft.CognitiveServices/accounts/privateEndpointConnections/write",
436
− "Microsoft.CognitiveServices/accounts/privateLinkResources/read",
437
− "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnectionsApproval/action",
438
− "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read",
439
− "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/write",
440
− "Microsoft.DBforPostgreSQL/flexibleServers/privateLinkResources/read",
441
− "Microsoft.DBforPostgreSQL/flexibleServers/read",
442
− "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnectionsApproval/action",
443
− "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/read",
444
− "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/write",
445
− "Microsoft.DBforPostgreSQL/serverGroupsv2/privateLinkResources/read",
446
− "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnectionsApproval/action",
447
− "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/read",
448
− "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/write",
449
− "Microsoft.DBforMySQL/flexibleServers/privateLinkResources/read",
450
− "Microsoft.DBforMySQL/flexibleServers/read",
451
− "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionsApproval/action",
452
− "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/operationResults/read",
453
− "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/read",
454
− "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write",
455
− "Microsoft.DocumentDB/databaseAccounts/privateLinkResources/read",
456
− "Microsoft.DocumentDB/databaseAccounts/read",
457
− "Microsoft.KeyVault/vaults/privateEndpointConnectionsApproval/action",
458
− "Microsoft.KeyVault/vaults/privateEndpointConnections/read",
459
− "Microsoft.KeyVault/vaults/privateEndpointConnections/write",
460
− "Microsoft.KeyVault/vaults/privateLinkResources/read",
461
− "Microsoft.KeyVault/vaults/read",
462
− "Microsoft.MachineLearningServices/registries/privateEndpointConnectionsApproval/action",
463
− "Microsoft.MachineLearningServices/registries/privateEndpointConnections/read",
464
− "Microsoft.MachineLearningServices/registries/privateEndpointConnections/write",
465
− "Microsoft.MachineLearningServices/registries/privateLinkResources/read",
466
− "Microsoft.MachineLearningServices/registries/read",
467
− "Microsoft.MachineLearningServices/workspaces/privateEndpointConnectionsApproval/action",
468
− "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read",
469
− "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write",
470
− "Microsoft.MachineLearningServices/workspaces/privateLinkResources/read",
471
− "Microsoft.MachineLearningServices/workspaces/read",
472
− "Microsoft.Storage/storageAccounts/privateEndpointConnections/read",
473
− "Microsoft.Storage/storageAccounts/privateEndpointConnections/write",
474
− "Microsoft.Storage/storageAccounts/privateLinkResources/read",
475
− "Microsoft.Storage/storageAccounts/read",
476
− "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
477
− "Microsoft.Sql/servers/privateEndpointConnectionsApproval/action",
478
− "Microsoft.Sql/servers/privateEndpointConnections/read",
479
− "Microsoft.Sql/servers/privateEndpointConnections/write",
480
− "Microsoft.Sql/servers/privateLinkResources/read",
481
− "Microsoft.Sql/servers/read",
482
− "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",
483
− "Microsoft.EventHub/namespaces/privateEndpointConnections/read",
484
− "Microsoft.EventHub/namespaces/privateEndpointConnections/write",
485
− "Microsoft.EventHub/namespaces/privateLinkResources/read",
486
− "Microsoft.EventHub/namespaces/read",
487
− "Microsoft.Search/searchServices/privateEndpointConnectionsApproval/action",
488
− "Microsoft.Search/searchServices/privateEndpointConnections/read",
489
− "Microsoft.Search/searchServices/privateEndpointConnections/write",
490
− "Microsoft.Search/searchServices/sharedPrivateLinkResources/read",
491
− "Microsoft.Search/searchServices/read",
492
− "Microsoft.Insights/privatelinkscopes/privateEndpointConnectionsApproval/action",
493
− "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/read",
494
− "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/write",
495
− "Microsoft.Insights/privatelinkscopes/privateLinkResources/read",
496
− "Microsoft.Insights/privatelinkscopes/read",
497
− "Microsoft.Network/privateLinkServices/privateEndpointConnectionsApproval/action",
498
− "Microsoft.Network/privateLinkServices/privateEndpointConnections/read",
499
− "Microsoft.Network/privateLinkServices/privateEndpointConnections/write",
500
− "Microsoft.Network/privateLinkServices/read",
501
− "Microsoft.Network/applicationGateways/privateEndpointConnections/read",
502
− "Microsoft.Network/applicationGateways/privateEndpointConnections/write",
503
− "Microsoft.Network/applicationGateways/privateLinkResources/read",
504
− "Microsoft.Network/applicationGateways/read"
505
− ],
506
− "notActions": [],
507
− "dataActions": [],
508
− "notDataActions": []
509
− }
510
− ],
511
− "roleName": "Azure AI Enterprise Network Connection Approver",
512
− "roleType": "BuiltInRole",
513
− "type": "Microsoft.Authorization/roleDefinitions"
514
−}
515
−```
516
−
517
−## Azure AI Inference Deployment Operator
518
−
519
−Can perform all actions required to create a resource deployment within a resource group.
520
−
521
−[Learn more](/azure/ai-foundry/concepts/hub-rbac-azure-ai-foundry)
522
−
523
−> [!div class="mx-tableFixed"]
524
−> | Actions | Description |
525
−> | --- | --- |
526
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
527
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
528
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AutoscaleSettings/write | Create or update an autoscale setting |
529
−> | **NotActions** | |
530
−> | *none* | |
531
−> | **DataActions** | |
532
−> | *none* | |
533
−> | **NotDataActions** | |
534
−> | *none* | |
535
−
536
−```json
537
−{
538
− "assignableScopes": [
539
− "/"
540
− ],
541
− "description": "Can perform all actions required to create a resource deployment within a resource group.",
542
− "id": "/providers/Microsoft.Authorization/roleDefinitions/3afb7f49-54cb-416e-8c09-6dc049efa503",
543
− "name": "3afb7f49-54cb-416e-8c09-6dc049efa503",
544
− "permissions": [
545
− {
546
− "actions": [
547
− "Microsoft.Authorization/*/read",
548
− "Microsoft.Resources/deployments/*",
549
− "Microsoft.Insights/AutoscaleSettings/write"
550
− ],
551
− "notActions": [],
552
− "dataActions": [],
553
− "notDataActions": []
554
− }
555
− ],
556
− "roleName": "Azure AI Inference Deployment Operator",
557
− "roleType": "BuiltInRole",
558
− "type": "Microsoft.Authorization/roleDefinitions"
559
−}
560
−```
561
−
562
−## Foundry Owner
563
−
564
−Grants full to manage AI project and accounts. Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project. Applies for new Foundry resources.
565
−
566
−[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)
567
−
568
−> [!div class="mx-tableFixed"]
569
−> | Actions | Description |
570
−> | --- | --- |
571
−> | [Microsoft.AlertsManagement](../permissions/monitor.md#microsoftalertsmanagement)/actionRules/* | |
572
−> | [Microsoft.AlertsManagement](../permissions/monitor.md#microsoftalertsmanagement)/alerts/* | |
573
−> | [Microsoft.AlertsManagement](../permissions/monitor.md#microsoftalertsmanagement)/issues/* | |
574
−> | [Microsoft.AlertsManagement](../permissions/monitor.md#microsoftalertsmanagement)/prometheusRuleGroups/* | |
575
−> | [Microsoft.AlertsManagement](../permissions/monitor.md#microsoftalertsmanagement)/smartDetectorAlertRules/* | |
576
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
577
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
578
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/activityLogAlerts/* | |
579
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricalerts/* | |
580
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/scheduledqueryrules/* | |
581
−> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
582
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
583
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
584
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
585
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
586
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |
587
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
588
−> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
589
−> | **NotActions** | |
590
−> | *none* | |
591
−> | **DataActions** | |
592
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
593
−> | **NotDataActions** | |
594
−> | *none* | |
595
−
596
−```json
597
−{
598
− "assignableScopes": [
599
− "/"
600
− ],
601
− "description": "Grants full to manage AI project and accounts. Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project.",
602
− "id": "/providers/Microsoft.Authorization/roleDefinitions/c883944f-8b7b-4483-af10-35834be79c4a",
603
− "name": "c883944f-8b7b-4483-af10-35834be79c4a",
604
− "permissions": [
605
− {
606
− "actions": [
607
− "Microsoft.AlertsManagement/actionRules/*",
608
− "Microsoft.AlertsManagement/alerts/*",
609
− "Microsoft.AlertsManagement/issues/*",
610
− "Microsoft.AlertsManagement/prometheusRuleGroups/*",
611
− "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
612
− "Microsoft.Authorization/*/read",
613
− "Microsoft.CognitiveServices/*",
614
− "Microsoft.Insights/activityLogAlerts/*",
615
− "Microsoft.Insights/metricalerts/*",
616
− "Microsoft.Insights/scheduledqueryrules/*",
617
− "Microsoft.ResourceHealth/availabilityStatuses/read",
618
− "Microsoft.Resources/deployments/*",
619
− "Microsoft.Resources/deployments/operations/read",
620
− "Microsoft.Resources/subscriptions/operationresults/read",
621
− "Microsoft.Resources/subscriptions/read",
622
− "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
623
− "Microsoft.Resources/subscriptions/resourceGroups/read",
624
− "Microsoft.Support/*"
625
− ],
626
− "notActions": [],
627
− "dataActions": [
628
− "Microsoft.CognitiveServices/*"
629
− ],
630
− "notDataActions": []
631
− }
632
− ],
633
− "roleName": "Foundry Owner",
634
− "roleType": "BuiltInRole",
635
− "type": "Microsoft.Authorization/roleDefinitions"
636
−}
637
−```
638
−
639
−## Foundry Project Manager
640
−
641
−Lets you perform developer actions and management actions on Foundry Projects. Includes an ABAC condition to constrain role assignments. Allows for making role assignments, but limited to Foundry User role. Applies for new Foundry resources.
642
−
643
−[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)
644
−
645
−> [!div class="mx-tableFixed"]
646
−> | Actions | Description |
647
−> | --- | --- |
648
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
649
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
650
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/*/read | |
651
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/projects/* | |
652
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/locations/*/read | |
653
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
654
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
655
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
656
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
657
−> | **NotActions** | |
658
−> | *none* | |
659
−> | **DataActions** | |
660
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
661
−> | **NotDataActions** | |
662
−> | *none* | |
663
−> | **Condition** | |
664
−> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) | Add or remove role assignments for the following roles:<br/>Foundry User |
665
−
666
−```json
667
−{
668
− "assignableScopes": [
669
− "/"
670
− ],
671
− "description": "Lets you perform developer actions and management actions on Azure AI Foundry Projects. Allows for making role assignments, but limited to Cognitive Service User role.",
672
− "id": "/providers/Microsoft.Authorization/roleDefinitions/eadc314b-1a2d-4efa-be10-5d325db5065e",
673
− "name": "eadc314b-1a2d-4efa-be10-5d325db5065e",
674
− "permissions": [
675
− {
676
− "actions": [
677
− "Microsoft.Authorization/roleAssignments/write",
678
− "Microsoft.Authorization/roleAssignments/delete",
679
− "Microsoft.CognitiveServices/accounts/*/read",
680
− "Microsoft.CognitiveServices/accounts/projects/*",
681
− "Microsoft.CognitiveServices/locations/*/read",
682
− "Microsoft.Authorization/*/read",
683
− "Microsoft.Insights/alertRules/*",
684
− "Microsoft.Resources/deployments/*",
685
− "Microsoft.Resources/subscriptions/resourceGroups/read"
686
− ],
687
− "notActions": [],
688
− "dataActions": [
689
− "Microsoft.CognitiveServices/*"
690
− ],
691
− "notDataActions": [],
692
− "conditionVersion": "2.0",
693
− "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d}))"
694
− }
695
− ],
696
− "roleName": "Foundry Project Manager",
697
− "roleType": "BuiltInRole",
698
− "type": "Microsoft.Authorization/roleDefinitions"
699
−}
700
−```
701
−
702
−## Foundry User
703
−
704
−Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project.
705
−
706
−[Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)
707
−
708
−> [!div class="mx-tableFixed"]
709
−> | Actions | Description |
710
−> | --- | --- |
711
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
712
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |
713
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/listkeys/action | List keys |
714
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/read | Read a classic metric alert |
715
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/read | Read a resource diagnostic setting |
716
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logDefinitions/read | Read log definitions |
717
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricdefinitions/read | Read metric definitions |
718
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |
719
−> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
720
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
721
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
722
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
723
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
724
−> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
725
−> | **NotActions** | |
726
−> | *none* | |
727
−> | **DataActions** | |
728
−> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
729
−> | **NotDataActions** | |
730
−> | *none* | |
731
−
732
−```json
733
−{
734
− "assignableScopes": [
735
− "/"
736
− ],
737
− "description": "Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project.",
738
− "id": "/providers/Microsoft.Authorization/roleDefinitions/53ca6127-db72-4b80-b1b0-d745d6d5456d",
739
− "name": "53ca6127-db72-4b80-b1b0-d745d6d5456d",
740
− "permissions": [
741
− {
742
− "actions": [
743
− "Microsoft.Authorization/*/read",
744
− "Microsoft.CognitiveServices/*/read",
745
− "Microsoft.CognitiveServices/accounts/listkeys/action",
746
− "Microsoft.Insights/alertRules/read",
747
− "Microsoft.Insights/diagnosticSettings/read",
748
− "Microsoft.Insights/logDefinitions/read",
749
− "Microsoft.Insights/metricdefinitions/read",
750
− "Microsoft.Insights/metrics/read",
751
− "Microsoft.ResourceHealth/availabilityStatuses/read",
752
− "Microsoft.Resources/deployments/*",
753
− "Microsoft.Resources/subscriptions/operationresults/read",
754
− "Microsoft.Resources/subscriptions/read",
755
− "Microsoft.Resources/subscriptions/resourceGroups/read",
756
− "Microsoft.Support/*"
757
− ],
758
− "notActions": [],
759
− "dataActions": [
760
− "Microsoft.CognitiveServices/*"
761
− ],
762
− "notDataActions": []
763
− }
764
− ],
765
− "roleName": "Foundry User",
766
− "roleType": "BuiltInRole",
767
− "type": "Microsoft.Authorization/roleDefinitions"
768
−}
769
−```
770
−
771
−## AzureML Compute Operator
772
−
773
−Can access and perform CRUD operations on Machine Learning Services managed compute resources (including Notebook VMs).
774
−
775
−[Learn more](/azure/machine-learning/how-to-assign-roles)
776
−
777
−> [!div class="mx-tableFixed"]
778
−> | Actions | Description |
779
−> | --- | --- |
780
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/computes/* | |
781
−> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/notebooks/vm/* | |
782
−> | **NotActions** | |
783
−> | *none* | |
784
−> | **DataActions** | |
785
−> | *none* | |
786
−> | **NotDataActions** | |
787
−> | *none* | |
788
−
789
−```json
790
−{
791
− "assignableScopes": [
792
− "/"
793
− ],
794
− "description": "Can access and perform CRUD operations on Machine Learning Services managed compute resources (including Notebook VMs).",
795
− "id": "/providers/Microsoft.Authorization/roleDefinitions/e503ece1-11d0-4e8e-8e2c-7a6c3bf38815",
796
− "name": "e503ece1-11d0-4e8e-8e2c-7a6c3bf38815",
797
− "permissions": [
798
− {
799
− "actions": [
800
− "Microsoft.MachineLearningServices/workspaces/computes/*",
801
− "Microsoft.MachineLearningServices/workspaces/notebooks/vm/*"
802
− ],
803
− "notActions": [],
804
− "dataActions": [],
805
− "notDataActions": []
806
− }
807
− ],
808
− "roleName": "AzureML Compute Operator",
809
− "roleType": "BuiltInRole",
810
− "type": "Microsoft.Authorization/roleDefinitions"
811
−}
812
−```
813
−
814
−## AzureML Data Scientist
This commit changed more lines than are kept here; the rest is on GitHub.
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 08:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.