azureblog.co.uk
← cd ~/roles
// roles/azure · ai-machine-learning

Cognitive Services Custom Vision LabelerAzure built-in role

View, edit training images and create, add, remove, or delete the image tags. Labelers can view the project but can't update anything other than training images and tags.

Role ID88424f51-ebe7-446f-bc41-7fa16989e96c
CategoryAi-machine-learning
Actions1
Data actions6

Before you assign it

  • It reaches the data, not just the resource. It has 6 data actions, such as reading blobs, secrets or messages.

What it can do

PermissionWhat it allows
Microsoft.CognitiveServices/*/readAny read operation on anything under Microsoft.CognitiveServices

Data actions

PermissionWhat it allows
Microsoft.CognitiveServices/accounts/CustomVision/*/readAny read operation on anything under Microsoft.CognitiveServices/accounts/CustomVision
Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/query/actionGet images that were sent to your prediction endpoint.
Microsoft.CognitiveServices/accounts/CustomVision/projects/images/*Every operation under Microsoft.CognitiveServices/accounts/CustomVision/projects/images
Microsoft.CognitiveServices/accounts/CustomVision/projects/tags/*Every operation under Microsoft.CognitiveServices/accounts/CustomVision/projects/tags
Microsoft.CognitiveServices/accounts/CustomVision/projects/images/suggested/*Every operation under Microsoft.CognitiveServices/accounts/CustomVision/projects/images/suggested
Microsoft.CognitiveServices/accounts/CustomVision/projects/tagsandregions/suggestions/actionThis API will get suggested tags and regions for an array/batch of untagged images along with confidences for the tags. It returns an empty array if no tags are found.

Data actions it can't do

PermissionWhat it allows
Microsoft.CognitiveServices/accounts/CustomVision/projects/export/readExports a project.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Cognitive Services Custom Vision Labeler" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Cognitive Services Custom Vision Labeler" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '88424f51-ebe7-446f-bc41-7fa16989e96c')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '88424f51-ebe7-446f-bc41-7fa16989e96c')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "88424f51-ebe7-446f-bc41-7fa16989e96c"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other ai-machine-learning roles

Find the smallest role for a task →

Sources