Azure AI + machine learning built-in role

AzureML Data Scientist

Works with experiments, jobs, pipelines, models, endpoints, data assets, environments, and other assets inside an Azure Machine Learning workspace while excluding creation or deletion of compute and modification of the workspace itself. Its published permissions are control-plane Actions with no DataActions.

Control-plane actions (4)

• Microsoft.MachineLearningServices/workspaces/*/read
• Microsoft.MachineLearningServices/workspaces/*/action
• Microsoft.MachineLearningServices/workspaces/*/delete
• Microsoft.MachineLearningServices/workspaces/*/write

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (10)

• Microsoft.MachineLearningServices/workspaces/delete
• Microsoft.MachineLearningServices/workspaces/write
• Microsoft.MachineLearningServices/workspaces/computes/*/write
• Microsoft.MachineLearningServices/workspaces/computes/*/delete
• Microsoft.MachineLearningServices/workspaces/computes/listKeys/action
• Microsoft.MachineLearningServices/workspaces/listKeys/action
• Microsoft.MachineLearningServices/workspaces/hubs/write
• Microsoft.MachineLearningServices/workspaces/hubs/delete
• Microsoft.MachineLearningServices/workspaces/featurestores/write
• Microsoft.MachineLearningServices/workspaces/featurestores/delete

Assignable scopes (1)

• /

Practical scope

Assign on the individual Azure Machine Learning workspace used by the data scientist. Parent-scope assignments are inherited by multiple workspaces and broaden access to their assets, jobs, models, and endpoints.

Common use cases (2)

• Submit training jobs, manage experiments and assets, publish pipelines, and deploy approved models within an existing workspace.
• Perform the documented Azure Machine Learning data-science workflow while leaving workspace and compute lifecycle administration with separate operators.

Prerequisites (2)

• The workspace and required compute must already exist, or the principal must also receive AzureML Compute Operator when self-service compute is approved.
• Grant separate roles for storage data, container registries, Kubernetes, managed identities, virtual networks, and other connected resources used by the workflow.

Best practices (3)

• Assign at workspace scope through a Microsoft Entra group and add AzureML Compute Operator only for users who create or delete compute.
• Use a custom role when production endpoint deployment, datastore changes, or other broad workspace operations must be excluded.
• Review additive assignments because an Action granted by another role can override an exclusion in this role.

Security considerations (3)

• The role can create, change, and delete many workspace assets and can deploy or invoke endpoints, affecting model integrity, service availability, and cost.
• It excludes compute creation and workspace modification but can still use existing compute and access data exposed through workspace datastores and separately granted resource roles.
• Azure RBAC is additive, so broader inherited roles can restore operations excluded by this definition.

Assignment guidance

Assign AzureML Data Scientist on the individual workspace to users who build and operate machine-learning assets but do not administer the workspace or compute lifecycle. Add Compute Operator or external-resource roles only for the specific additional workflow requirements.

Related roles (2)

• AzureML Compute Operator: Microsoft documents combining it with Data Scientist when self-service compute creation is required.
• Reader: The read-only workspace alternative for principals that only list and inspect assets.

Editorial sources (5)

• Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role - Azure RBAC | Microsoft Learn →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC | Microsoft Learn →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC | Microsoft Learn →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Manage roles in your workspace - Azure Machine Learning | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →