Azure AI + machine learning built-in role

AzureML Compute Operator

Creates, manages, deletes, and accesses Azure Machine Learning managed compute resources, including compute instances and notebook virtual machines. The role grants compute control-plane Actions and no DataActions.

Control-plane actions (2)

• Microsoft.MachineLearningServices/workspaces/computes/*
• Microsoft.MachineLearningServices/workspaces/notebooks/vm/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the Azure Machine Learning workspace whose compute the operator manages. A resource-group or subscription assignment is inherited by every workspace below that scope and expands compute administration accordingly.

Common use cases (2)

• Create, start, stop, restart, update, and delete managed compute for an Azure Machine Learning workspace.
• Combine with AzureML Data Scientist when a user needs self-service compute creation as well as experiments, jobs, models, and other workspace assets.

Prerequisites (2)

• The Azure Machine Learning workspace must exist and the compute design, quota, network, and identity requirements must be approved.
• Assign Managed Identity Operator separately when the compute cluster uses a user-assigned managed identity.

Best practices (3)

• Assign at workspace scope and separate compute administration from data-science duties unless the same user needs both.
• Use Microsoft Entra groups to manage compute operators and review membership instead of accumulating direct user assignments.
• Use a custom role when the operator needs only start, stop, or restart rather than the complete compute lifecycle.

Security considerations (3)

• Compute creation and deletion affect cost, capacity, network reachability, and workload availability.
• A compute instance is a single-owner managed cloud workstation with integrated notebook and development applications; creating, assigning, accessing, or deleting that workstation has user-environment consequences even though this role has no DataActions.
• The role has no DataActions, but compute can access workspace or external data through the assigned user, managed identity, and separate resource permissions.

Assignment guidance

Assign AzureML Compute Operator on the workspace to the small set of principals that manage its compute lifecycle. Add AzureML Data Scientist separately for experiment and asset work, and use a custom role for a start/stop-only operations boundary.

Related roles (2)

• AzureML Data Scientist: Microsoft documents combining these roles when a data scientist needs self-service compute creation.
• Managed Identity Operator: Required separately when assigning a user-assigned managed identity to an Azure Machine Learning compute cluster.

Editorial sources (6)

• Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role - Azure RBAC | Microsoft Learn →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC | Microsoft Learn →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC | Microsoft Learn →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Manage roles in your workspace - Azure Machine Learning | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• What is an Azure Machine Learning compute instance? - Azure Machine Learning | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →