azureblog.co.uk
← cd ~/roles
// roles/azure · ai-machine-learning

Cognitive Services Face RecognizerAzure built-in role

Lets you perform detect, verify, identify, group, and find similar operations on Face API. This role does not allow create or delete operations, which makes it well suited for endpoints that only need inferencing capabilities, following 'least privilege' best practices.

Role ID9894cab4-e18a-44aa-828b-cb588cd6f2d7
CategoryAi-machine-learning
Actions0
Data actions12

Before you assign it

  • It reaches the data, not just the resource. It has 12 data actions, such as reading blobs, secrets or messages.

What it can do

No control-plane actions.

Data actions

PermissionWhat it allows
Microsoft.CognitiveServices/accounts/Face/detect/actionDetect human faces in an image, return face rectangles, and optionally with faceIds, landmarks, and attributes.
Microsoft.CognitiveServices/accounts/Face/verify/actionVerify whether two faces belong to a same person or whether one face belongs to a person.
Microsoft.CognitiveServices/accounts/Face/identify/action1-to-many identification to find the closest matches of the specific query person face from a person group or large person group.
Microsoft.CognitiveServices/accounts/Face/group/actionDivide candidate faces into groups based on face similarity.
Microsoft.CognitiveServices/accounts/Face/findsimilars/actionGiven query face's faceId, to search the similar-looking faces from a faceId array, a face list or a large face list. faceId
Microsoft.CognitiveServices/accounts/Face/detectliveness/multimodal/action
Microsoft.CognitiveServices/accounts/Face/detectliveness/singlemodal/actionPerforms liveness detection on a target face in a sequence of images of the same modality (e.g. color or infrared), and returns the liveness classification of the target face as either ‘real face’, ‘spoof face’, or ‘uncertain’ if a classification cannot be made with the given inputs.
Microsoft.CognitiveServices/accounts/Face/detectlivenesswithverify/singlemodal/actionDetects liveness of a target face in a sequence of images of the same stream type (e.g. color) and then compares with VerifyImage to return confidence score for identity scenarios.
Microsoft.CognitiveServices/accounts/Face/*/sessions/actionEvery operation matching Microsoft.CognitiveServices/accounts/Face/*/sessions/action
Microsoft.CognitiveServices/accounts/Face/*/sessions/deleteEvery operation matching Microsoft.CognitiveServices/accounts/Face/*/sessions/delete
Microsoft.CognitiveServices/accounts/Face/*/sessions/readEvery operation matching Microsoft.CognitiveServices/accounts/Face/*/sessions/read
Microsoft.CognitiveServices/accounts/Face/*/sessions/audit/readEvery operation matching Microsoft.CognitiveServices/accounts/Face/*/sessions/audit/read

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Cognitive Services Face Recognizer" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Cognitive Services Face Recognizer" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '9894cab4-e18a-44aa-828b-cb588cd6f2d7')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "9894cab4-e18a-44aa-828b-cb588cd6f2d7"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other ai-machine-learning roles

Find the smallest role for a task →

Sources