// roles/azure · ai-machine-learning

Azure AI DeveloperAzure built-in role

Can perform all actions within an Azure Machine Learning workspace besides managing the workspace itself. For Foundry project access, use the Foundry User or Foundry Owner roles instead.

Role ID	`64702f94-c441-49e6-a78b-ef80e0188fee`
Category	Ai-machine-learning
Actions	7 (minus 10 NotActions)
Data actions	4

Before you assign it

It reaches the data, not just the resource. It has 4 data actions, such as reading blobs, secrets or messages.

What it can do

Permission	What it allows
`Microsoft.MachineLearningServices/workspaces/*/read`	Any read operation on anything under Microsoft.MachineLearningServices/workspaces
`Microsoft.MachineLearningServices/workspaces/*/action`	Any action on anything under Microsoft.MachineLearningServices/workspaces
`Microsoft.MachineLearningServices/workspaces/*/delete`	Any delete operation on anything under Microsoft.MachineLearningServices/workspaces
`Microsoft.MachineLearningServices/workspaces/*/write`	Any write operation on anything under Microsoft.MachineLearningServices/workspaces
`Microsoft.MachineLearningServices/locations/*/read`	Any read operation on anything under Microsoft.MachineLearningServices/locations
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments

Can't do

These are taken away from the actions above.

Permission	What it allows
`Microsoft.MachineLearningServices/workspaces/delete`	Deletes the Machine Learning Services Workspace(s)
`Microsoft.MachineLearningServices/workspaces/write`	Creates or updates a Machine Learning Services Workspace(s)
`Microsoft.MachineLearningServices/workspaces/listKeys/action`	List secrets for a Machine Learning Services Workspace
`Microsoft.MachineLearningServices/workspaces/hubs/write`	Creates or updates a Machine Learning Services Hub Workspace(s)
`Microsoft.MachineLearningServices/workspaces/hubs/delete`	Deletes the Machine Learning Services Hub Workspace(s)
`Microsoft.MachineLearningServices/workspaces/featurestores/write`	Creates or Updates the Machine Learning Services FeatureStore(s)
`Microsoft.MachineLearningServices/workspaces/featurestores/delete`	Deletes the Machine Learning Services FeatureStore(s)
`Microsoft.MachineLearningServices/workspaces/evaluations/results/labels/read`	Reads evaluation results' label from a Machine Learning Services Workspace
`Microsoft.MachineLearningServices/workspaces/evaluations/results/reasonings/read`	Reads evaluation results' reasoning from a Machine Learning Services Workspace
`Microsoft.MachineLearningServices/workspaces/simulations/results/images/read`	Reads image simulation results from a Machine Learning Services Workspace

Data actions

Permission	What it allows
`Microsoft.CognitiveServices/accounts/OpenAI/*`	Every operation under Microsoft.CognitiveServices/accounts/OpenAI
`Microsoft.CognitiveServices/accounts/SpeechServices/*`	Every operation under Microsoft.CognitiveServices/accounts/SpeechServices
`Microsoft.CognitiveServices/accounts/ContentSafety/*`	Every operation under Microsoft.CognitiveServices/accounts/ContentSafety
`Microsoft.CognitiveServices/accounts/MaaS/*`	Every operation under Microsoft.CognitiveServices/accounts/MaaS

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure AI Developer" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure AI Developer" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '64702f94-c441-49e6-a78b-ef80e0188fee')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "64702f94-c441-49e6-a78b-ef80e0188fee"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other ai-machine-learning roles

AzureML Metrics Writer (preview) · 1 permission
Cognitive Services Data Reader · 1 permission
Cognitive Services Immersive Reader User · 1 permission
Cognitive Services Usages Reader · 1 permission
Search Index Data Reader · 1 permission
AzureML Compute Operator · 2 permissions
AzureML Registry User · 2 permissions
Cognitive Services Custom Vision Contributor · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles