Azure AI + machine learning built-in role
Azure AI Inference Deployment Operator
Creates and manages Azure Resource Manager deployments and autoscale settings needed for classic Foundry project deployments within a resource group. It has control-plane Actions only and no model-inference or other DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 3afb7f49-54cb-416e-8c09-6dc049efa503
Control-plane actions (3)
Microsoft.Authorization/*/readMicrosoft.Resources/deployments/*Microsoft.Insights/AutoscaleSettings/write
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Microsoft assigns this role for classic project members at the resource group used for deployments. A resource-group assignment is inherited by deployment and autoscale resources in that group; a subscription assignment would allow deployment operations across all inherited resource groups.
Common use cases (2)
- Allow a classic Foundry project member to create the Azure Resource Manager deployments required by a project.
- Manage the autoscale setting associated with an approved inference deployment without granting project data-plane access through this role itself.
Prerequisites (2)
- An existing classic Foundry hub and project must use the target resource group for its deployment resources.
- The principal needs its separate project role, such as Azure AI Developer, for the workspace and AI service operations involved in the deployment.
Best practices (3)
- Keep the role on the project deployment resource group and avoid subscription scope.
- Treat this as a companion deployment role rather than assigning it in place of the project's developer or reader role.
- Remove the assignment when project membership or deployment responsibility ends.
Security considerations (3)
- Resource Manager deployment authority can create, update, or delete resources described by a template when the principal has the underlying resource permissions.
- Autoscale changes can affect inference availability and cost.
- The role has no DataActions and does not authorize model invocation by itself.
Assignment guidance
Use the classic Foundry project access workflow that assigns Inference Deployment Operator on the project deployment resource group. Pair it with the appropriate project role and avoid granting it independently or at subscription scope.
Related roles (2)
- Azure AI Developer: The documented project development role paired with this resource-group deployment authority in classic Foundry.
- Reader: Classic project access also assigns Reader on the parent hub while this role covers deployment operations in the resource group.
Common questions
When should I assign the Azure AI Inference Deployment Operator Azure role?
Assign Azure AI Inference Deployment Operator when you need to: Allow a classic Foundry project member to create the Azure Resource Manager deployments required by a project.; and Manage the autoscale setting associated with an approved inference deployment without granting project data-plane access through this role itself.. Practical scope: Microsoft assigns this role for classic project members at the resource group used for deployments. A resource-group assignment is inherited by deployment and autoscale resources in that group; a subscription assignment would allow deployment operations across all inherited resource groups.
What permissions does the Azure AI Inference Deployment Operator Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Resources/deployments/*; and Microsoft.Insights/AutoscaleSettings/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure AI Inference Deployment Operator Azure role?
Key considerations when assigning Azure AI Inference Deployment Operator: Resource Manager deployment authority can create, update, or delete resources described by a template when the principal has the underlying resource permissions.; Autoscale changes can affect inference availability and cost.; and The role has no DataActions and does not authorize model invocation by itself.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Role-based access control for Microsoft Foundry (Hubs and Projects) (classic) - Microsoft Foundry (classic) portal | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.