// roles/azure · ai-machine-learning

Azure AI Enterprise Network Connection ApproverAzure built-in role

Can approve private endpoint connections to Azure AI common dependency resources

Role ID	`b556d68e-0be0-4f35-a333-ad7ee1ce17ea`
Category	Ai-machine-learning
Actions	90
Data actions	0

What it can do

Permission	What it allows
`Microsoft.ApiManagement/service/privateEndpointConnections/read`	Get Private Endpoint Connections
`Microsoft.ApiManagement/service/privateEndpointConnections/write`	Approve Or Reject Private Endpoint Connections
`Microsoft.ApiManagement/service/privateLinkResources/read`	Get Private Link Group resources
`Microsoft.ApiManagement/service/read`	Read metadata for an API Management Service instance
`Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action`	Auto Approves a Private Endpoint Connection
`Microsoft.ContainerRegistry/registries/privateEndpointConnections/read`	Gets the properties of private endpoint connection or list all the private endpoint connections for the specified container registry
`Microsoft.ContainerRegistry/registries/privateEndpointConnections/write`	Approves/Rejects the private endpoint connection
`Microsoft.Cache/redis/read`	View the Redis Cache's settings and configuration in the management portal
`Microsoft.Cache/redis/privateEndpointConnections/read`	Read a private endpoint connection
`Microsoft.Cache/redis/privateEndpointConnections/write`	Write a private endpoint connection
`Microsoft.Cache/redis/privateLinkResources/read`	Read 'groupId' of redis subresource that a private link can be connected to
`Microsoft.Cache/redis/privateEndpointConnectionsApproval/action`	Approve Private Endpoint Connections
`Microsoft.Cache/redisEnterprise/read`	View the Redis Enterprise cache's settings and configuration in the management portal
`Microsoft.Cache/redisEnterprise/privateEndpointConnections/read`	Read a private endpoint connection
`Microsoft.Cache/redisEnterprise/privateEndpointConnections/write`	Write a private endpoint connection
`Microsoft.Cache/redisEnterprise/privateLinkResources/read`	Read 'groupId' of redis subresource that a private link can be connected to
`Microsoft.Cache/redisEnterprise/privateEndpointConnectionsApproval/action`	Approve Private Endpoint Connections
`Microsoft.CognitiveServices/accounts/read`	Reads API accounts.
`Microsoft.CognitiveServices/accounts/privateEndpointConnections/read`	Reads private endpoint connections.
`Microsoft.CognitiveServices/accounts/privateEndpointConnections/write`	Writes a private endpoint connections.
`Microsoft.CognitiveServices/accounts/privateLinkResources/read`	Reads private link resources for an account.
`Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnectionsApproval/action`	Determines if the user is allowed to approve a private endpoint connection
`Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read`	Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection.
`Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/write`	Approves or rejects an existing private endpoint connection
`Microsoft.DBforPostgreSQL/flexibleServers/privateLinkResources/read`	Return a list containing private link resource or gets the specified private link resource.
`Microsoft.DBforPostgreSQL/flexibleServers/read`	Return the list of servers or gets the properties for the specified server.
`Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnectionsApproval/action`	Determines if user is allowed to approve a private endpoint connection for PostgreSQL SGv2
`Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/read`	Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection
`Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/write`	Approves or rejects an existing private endpoint connection
`Microsoft.DBforPostgreSQL/serverGroupsv2/privateLinkResources/read`	Get the private link resources for the corresponding PostgreSQL SGv2
`Microsoft.DBforMySQL/flexibleServers/privateEndpointConnectionsApproval/action`	Determines if user is allowed to approve a private endpoint connection
`Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/read`	Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection.
`Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/write`	Approves or rejects an existing private endpoint connection
`Microsoft.DBforMySQL/flexibleServers/privateLinkResources/read`
`Microsoft.DBforMySQL/flexibleServers/read`	Returns the list of servers or gets the properties for the specified server.
`Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionsApproval/action`	Manage a private endpoint connection of Database Account
`Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/operationResults/read`	Read Status of privateEndpointConnections asynchronous operation
`Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/read`	Read a private endpoint connection or list all the private endpoint connections of a Database Account
`Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write`	Create or update a private endpoint connection of a Database Account
`Microsoft.DocumentDB/databaseAccounts/privateLinkResources/read`	Read a private link resource or list all the private link resources of a Database Account
`Microsoft.DocumentDB/databaseAccounts/read`	Reads a database account.
`Microsoft.KeyVault/vaults/privateEndpointConnectionsApproval/action`	Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider
`Microsoft.KeyVault/vaults/privateEndpointConnections/read`	View the state of a connection to a Private Endpoint resource of Microsoft.Network provider
`Microsoft.KeyVault/vaults/privateEndpointConnections/write`	Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider
`Microsoft.KeyVault/vaults/privateLinkResources/read`	Get the available private link resources for the specified instance of Key Vault
`Microsoft.KeyVault/vaults/read`	View the properties of a key vault
`Microsoft.MachineLearningServices/registries/privateEndpointConnectionsApproval/action`	Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider
`Microsoft.MachineLearningServices/registries/privateEndpointConnections/read`	View the state of a connection to a Private Endpoint resource of Microsoft.Network provider
`Microsoft.MachineLearningServices/registries/privateEndpointConnections/write`	Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider
`Microsoft.MachineLearningServices/registries/privateLinkResources/read`	Gets the available private link resources for the specified instance of the Machine Learning Services registry(ies)
`Microsoft.MachineLearningServices/registries/read`	Gets the Machine Learning Services registry(ies)
`Microsoft.MachineLearningServices/workspaces/privateEndpointConnectionsApproval/action`	Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider
`Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read`	View the state of a connection to a Private Endpoint resource of Microsoft.Network provider
`Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write`	Change the state of a connection to a Private Endpoint resource of Microsoft.Network provider
`Microsoft.MachineLearningServices/workspaces/privateLinkResources/read`	Gets the available private link resources for the specified instance of the Machine Learning Services Workspace(s)
`Microsoft.MachineLearningServices/workspaces/read`	Gets the Machine Learning Services Workspace(s)
`Microsoft.Storage/storageAccounts/privateEndpointConnections/read`	List Private Endpoint Connections
`Microsoft.Storage/storageAccounts/privateEndpointConnections/write`	Put Private Endpoint Connection
`Microsoft.Storage/storageAccounts/privateLinkResources/read`	Get StorageAccount groupids
`Microsoft.Storage/storageAccounts/read`	Returns the list of storage accounts or gets the properties for the specified storage account.
`Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action`	Approve Private Endpoint Connections
`Microsoft.Sql/servers/privateEndpointConnectionsApproval/action`	Determines if user is allowed to approve a private endpoint connection
`Microsoft.Sql/servers/privateEndpointConnections/read`	Returns the list of private endpoint connections or gets the properties for the specified private endpoint connection.
`Microsoft.Sql/servers/privateEndpointConnections/write`	Approves or rejects an existing private endpoint connection
`Microsoft.Sql/servers/privateLinkResources/read`	Get the private link resources for the corresponding sql server
`Microsoft.Sql/servers/read`	Return the list of servers or gets the properties for the specified server.
`Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action`	Approve Private Endpoint Connection
`Microsoft.EventHub/namespaces/privateEndpointConnections/read`	Get Private Endpoint Connection
`Microsoft.EventHub/namespaces/privateEndpointConnections/write`	Create or Update Private Endpoint Connection
`Microsoft.EventHub/namespaces/privateLinkResources/read`	Gets the resource types that support private endpoint connections
`Microsoft.EventHub/namespaces/read`	Get the list of Namespace Resource Description
`Microsoft.Search/searchServices/privateEndpointConnectionsApproval/action`	Approve Private Endpoint Connection
`Microsoft.Search/searchServices/privateEndpointConnections/read`	Returns the list of private endpoint connections or gets the properties for the specified private endpoint connections
`Microsoft.Search/searchServices/privateEndpointConnections/write`	Creates a private endpoint connections with the specified parameters or updates the properties or tags for the specified private endpoint connections
`Microsoft.Search/searchServices/sharedPrivateLinkResources/read`	Returns the list of shared private link resources or gets the properties for the specified shared private link resource
`Microsoft.Search/searchServices/read`	Reads the search service.
`Microsoft.Insights/privatelinkscopes/privateEndpointConnectionsApproval/action`	Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider
`Microsoft.Insights/privatelinkscopes/privateEndpointConnections/read`	Read a private endpoint connection
`Microsoft.Insights/privatelinkscopes/privateEndpointConnections/write`	Create or update a private endpoint connection
`Microsoft.Insights/privatelinkscopes/privateEndpointConnections/operationResults/read`

Showing 80 of 90.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure AI Enterprise Network Connection Approver" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure AI Enterprise Network Connection Approver" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'b556d68e-0be0-4f35-a333-ad7ee1ce17ea')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b556d68e-0be0-4f35-a333-ad7ee1ce17ea')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "b556d68e-0be0-4f35-a333-ad7ee1ce17ea"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other ai-machine-learning roles

AzureML Metrics Writer (preview) · 1 permission
Cognitive Services Data Reader · 1 permission
Cognitive Services Immersive Reader User · 1 permission
Cognitive Services Usages Reader · 1 permission
Search Index Data Reader · 1 permission
AzureML Compute Operator · 2 permissions
AzureML Registry User · 2 permissions
Cognitive Services Custom Vision Contributor · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles