azureblog.co.uk
← cd ~/roles
// roles/azure · databases

Semantic Reranker UserAzure built-in role

Execute semantic reranking operations against registered inference accounts. This role should be assigned to users who need to run semantic reranking workloads but do not need to manage the accounts themselves.

Role ID6c74a7c5-4a87-40f9-bb03-61e49aecbc78
CategoryDatabases
Actions1 (minus 2 NotActions)
Data actions1

Before you assign it

  • It reaches the data, not just the resource. It has 1 data action, such as reading blobs, secrets or messages.

What it can do

PermissionWhat it allows
Microsoft.InferenceService/inferenceAccounts/readReads an inference service.

Can't do

These are taken away from the actions above.

PermissionWhat it allows
Microsoft.InferenceService/inferenceAccounts/writeCreates or updates an inference service.
Microsoft.InferenceService/inferenceAccounts/deleteDeletes an inference service.

Data actions

PermissionWhat it allows
Microsoft.InferenceService/inferenceAccounts/invoke/semanticReranker/actionInvokes the semantic reranker on an inference account.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Semantic Reranker User" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Semantic Reranker User" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '6c74a7c5-4a87-40f9-bb03-61e49aecbc78')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6c74a7c5-4a87-40f9-bb03-61e49aecbc78')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "6c74a7c5-4a87-40f9-bb03-61e49aecbc78"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other databases roles

Find the smallest role for a task →

Sources