Azure AI + machine learning built-in role
AzureML Compute Operator
Creates, manages, deletes, and accesses Azure Machine Learning managed compute resources, including compute instances and notebook virtual machines. The role grants compute control-plane Actions and no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: e503ece1-11d0-4e8e-8e2c-7a6c3bf38815
Control-plane actions (2)
Microsoft.MachineLearningServices/workspaces/computes/*Microsoft.MachineLearningServices/workspaces/notebooks/vm/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the Azure Machine Learning workspace whose compute the operator manages. A resource-group or subscription assignment is inherited by every workspace below that scope and expands compute administration accordingly.
Common use cases (2)
- Create, start, stop, restart, update, and delete managed compute for an Azure Machine Learning workspace.
- Combine with AzureML Data Scientist when a user needs self-service compute creation as well as experiments, jobs, models, and other workspace assets.
Prerequisites (2)
- The Azure Machine Learning workspace must exist and the compute design, quota, network, and identity requirements must be approved.
- Assign Managed Identity Operator separately when the compute cluster uses a user-assigned managed identity.
Best practices (3)
- Assign at workspace scope and separate compute administration from data-science duties unless the same user needs both.
- Use Microsoft Entra groups to manage compute operators and review membership instead of accumulating direct user assignments.
- Use a custom role when the operator needs only start, stop, or restart rather than the complete compute lifecycle.
Security considerations (3)
- Compute creation and deletion affect cost, capacity, network reachability, and workload availability.
- A compute instance is a single-owner managed cloud workstation with integrated notebook and development applications; creating, assigning, accessing, or deleting that workstation has user-environment consequences even though this role has no DataActions.
- The role has no DataActions, but compute can access workspace or external data through the assigned user, managed identity, and separate resource permissions.
Assignment guidance
Assign AzureML Compute Operator on the workspace to the small set of principals that manage its compute lifecycle. Add AzureML Data Scientist separately for experiment and asset work, and use a custom role for a start/stop-only operations boundary.
Related roles (2)
- AzureML Data Scientist: Microsoft documents combining these roles when a data scientist needs self-service compute creation.
- Managed Identity Operator: Required separately when assigning a user-assigned managed identity to an Azure Machine Learning compute cluster.
Common questions
When should I assign the AzureML Compute Operator Azure role?
Assign AzureML Compute Operator when you need to: Create, start, stop, restart, update, and delete managed compute for an Azure Machine Learning workspace.; and Combine with AzureML Data Scientist when a user needs self-service compute creation as well as experiments, jobs, models, and other workspace assets.. Practical scope: Assign on the Azure Machine Learning workspace whose compute the operator manages. A resource-group or subscription assignment is inherited by every workspace below that scope and expands compute administration accordingly.
What permissions does the AzureML Compute Operator Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.MachineLearningServices/workspaces/computes/*; and Microsoft.MachineLearningServices/workspaces/notebooks/vm/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the AzureML Compute Operator Azure role?
Key considerations when assigning AzureML Compute Operator: Compute creation and deletion affect cost, capacity, network reachability, and workload availability.; A compute instance is a single-owner managed cloud workstation with integrated notebook and development applications; creating, assigning, accessing, or deleting that workstation has user-environment consequences even though this role has no DataActions.; and The role has no DataActions, but compute can access workspace or external data through the assigned user, managed identity, and separate resource permissions.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Manage roles in your workspace - Azure Machine Learning | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- What is an Azure Machine Learning compute instance? - Azure Machine Learning | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.