// roles/azure · ai-machine-learning

Azure AI AdministratorAzure built-in role

A Built-In Role that has all control plane permissions to work with Azure AI and its dependencies.

Role ID	`b78c5d69-af96-48a3-bf8d-a8b4d589de94`
Category	Ai-machine-learning
Actions	39
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.CognitiveServices/*`	Every operation under Microsoft.CognitiveServices
`Microsoft.ContainerRegistry/registries/*`	Every operation under Microsoft.ContainerRegistry/registries
`Microsoft.DocumentDb/databaseAccounts/*`	Every operation under Microsoft.DocumentDb/databaseAccounts
`Microsoft.Features/features/read`	Gets the features of a subscription.
`Microsoft.Features/providers/features/read`	Gets the feature of a subscription in a given resource provider.
`Microsoft.Features/providers/features/register/action`	Registers the feature for a subscription in a given resource provider.
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Insights/components/*`	Every operation under Microsoft.Insights/components
`Microsoft.Insights/diagnosticSettings/*`	Every operation under Microsoft.Insights/diagnosticSettings
`Microsoft.Insights/generateLiveToken/read`	Live Metrics get token
`Microsoft.Insights/logDefinitions/read`	Read log definitions
`Microsoft.Insights/metricAlerts/*`	Every operation under Microsoft.Insights/metricAlerts
`Microsoft.Insights/metricdefinitions/read`	Read metric definitions
`Microsoft.Insights/metrics/read`	Read metrics
`Microsoft.Insights/scheduledqueryrules/*`	Every operation under Microsoft.Insights/scheduledqueryrules
`Microsoft.Insights/topology/read`	Read Topology
`Microsoft.Insights/transactions/read`	Read Transactions
`Microsoft.Insights/webtests/*`	Every operation under Microsoft.Insights/webtests
`Microsoft.KeyVault/*`	Every operation under Microsoft.KeyVault
`Microsoft.MachineLearningServices/workspaces/*`	Every operation under Microsoft.MachineLearningServices/workspaces
`Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action`	Joins resource such as storage account or SQL database to a subnet. Not alertable.
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/deployments/operations/read`	Gets or lists deployment operations.
`Microsoft.Resources/subscriptions/operationresults/read`	Get the subscription operation results.
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/*`	Every operation under Microsoft.Resources/subscriptions/resourcegroups/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Resources/subscriptions/resourceGroups/write`	Creates or updates a resource group.
`Microsoft.Storage/storageAccounts/*`	Every operation under Microsoft.Storage/storageAccounts
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.Search/searchServices/write`	Creates or updates the search service.
`Microsoft.Search/searchServices/read`	Reads the search service.
`Microsoft.Search/searchServices/delete`	Deletes the search service.
`Microsoft.Search/searchServices/indexes/*`	Every operation under Microsoft.Search/searchServices/indexes
`Microsoft.Search/searchServices/listAdminKeys/action`	Reads the admin keys.
`Microsoft.Search/searchServices/privateEndpointConnections/*`	Every operation under Microsoft.Search/searchServices/privateEndpointConnections
`Microsoft.DataFactory/factories/*`	Every operation under Microsoft.DataFactory/factories

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure AI Administrator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure AI Administrator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'b78c5d69-af96-48a3-bf8d-a8b4d589de94')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b78c5d69-af96-48a3-bf8d-a8b4d589de94')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "b78c5d69-af96-48a3-bf8d-a8b4d589de94"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other ai-machine-learning roles

AzureML Metrics Writer (preview) · 1 permission
Cognitive Services Data Reader · 1 permission
Cognitive Services Immersive Reader User · 1 permission
Cognitive Services Usages Reader · 1 permission
Search Index Data Reader · 1 permission
AzureML Compute Operator · 2 permissions
AzureML Registry User · 2 permissions
Cognitive Services Custom Vision Contributor · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles