// roles/azure · ai-machine-learning

Cognitive Services QnA Maker EditorAzure built-in role

Let's you create, edit, import and export a KB. You cannot publish or delete a KB.

Role ID	`f4cc2bf9-21be-47a1-bdf1-5c5804381025`
Category	Ai-machine-learning
Actions	3
Data actions	39

Before you assign it

It reaches the data, not just the resource. It has 39 data actions, such as reading blobs, secrets or messages.

What it can do

Permission	What it allows
`Microsoft.CognitiveServices/*/read`	Any read operation on anything under Microsoft.CognitiveServices
`Microsoft.Authorization/roleAssignments/read`	Get information about a role assignment.
`Microsoft.Authorization/roleDefinitions/read`	Get information about a role definition.

Data actions

Permission	What it allows
`Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/read`	Gets List of Knowledgebases or details of a specific knowledgebase.
`Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/download/read`	Download the knowledgebase.
`Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/create/write`	Asynchronous operation to create a new knowledgebase.
`Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/write`	Asynchronous operation to modify a knowledgebase or Replace knowledgebase contents.
`Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/generateanswer/action`	GenerateAnswer call to query the knowledgebase.
`Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/train/action`	Train call to add suggestions to the knowledgebase.
`Microsoft.CognitiveServices/accounts/QnAMaker/alterations/read`	Download alterations from runtime.
`Microsoft.CognitiveServices/accounts/QnAMaker/alterations/write`	Replace alterations data.
`Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/read`	Gets endpoint keys for an endpoint
`Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/refreshkeys/action`	Re-generates an endpoint key.
`Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/read`	Gets endpoint settings for an endpoint
`Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/write`	Update endpoint settings for an endpoint.
`Microsoft.CognitiveServices/accounts/QnAMaker/operations/read`	Gets details of a specific long running operation.
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/read`	Gets List of Knowledgebases or details of a specific knowledgebase.
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/download/read`	Download the knowledgebase.
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/create/write`	Asynchronous operation to create a new knowledgebase.
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/write`	Asynchronous operation to modify a knowledgebase or Replace knowledgebase contents.
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/generateanswer/action`	GenerateAnswer call to query the knowledgebase.
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/train/action`	Train call to add suggestions to the knowledgebase.
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/read`	Download alterations from runtime.
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/write`	Replace alterations data.
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/read`	Gets endpoint keys for an endpoint
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/refreshkeys/action`	Re-generates an endpoint key.
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/read`	Gets endpoint settings for an endpoint
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/write`	Update endpoint settings for an endpoint.
`Microsoft.CognitiveServices/accounts/QnAMaker.v2/operations/read`	Gets details of a specific long running operation.
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/read`	Gets List of Knowledgebases or details of a specific knowledgebase.
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/download/read`	Download the knowledgebase.
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/create/write`	Asynchronous operation to create a new knowledgebase.
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/write`	Asynchronous operation to modify a knowledgebase or Replace knowledgebase contents.
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/generateanswer/action`	GenerateAnswer call to query the knowledgebase.
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/train/action`	Train call to add suggestions to the knowledgebase.
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/read`	Download alterations from runtime.
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/write`	Replace alterations data.
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/read`	Gets endpoint keys for an endpoint
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/refreshkeys/action`	Re-generates an endpoint key.
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/read`	Gets endpoint settings for an endpoint
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/write`	Update endpoint settings for an endpoint.
`Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/operations/read`	Gets details of a specific long running operation.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Cognitive Services QnA Maker Editor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Cognitive Services QnA Maker Editor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'f4cc2bf9-21be-47a1-bdf1-5c5804381025')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f4cc2bf9-21be-47a1-bdf1-5c5804381025')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "f4cc2bf9-21be-47a1-bdf1-5c5804381025"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other ai-machine-learning roles

AzureML Metrics Writer (preview) · 1 permission
Cognitive Services Data Reader · 1 permission
Cognitive Services Immersive Reader User · 1 permission
Cognitive Services Usages Reader · 1 permission
Search Index Data Reader · 1 permission
AzureML Compute Operator · 2 permissions
AzureML Registry User · 2 permissions
Cognitive Services Custom Vision Contributor · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles