Azure AI + machine learning built-in role
AzureML Data Scientist
Works with experiments, jobs, pipelines, models, endpoints, data assets, environments, and other assets inside an Azure Machine Learning workspace while excluding creation or deletion of compute and modification of the workspace itself. Its published permissions are control-plane Actions with no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: f6c7c914-8db3-469d-8ca1-694a8f32e121
Control-plane actions (4)
Microsoft.MachineLearningServices/workspaces/*/readMicrosoft.MachineLearningServices/workspaces/*/actionMicrosoft.MachineLearningServices/workspaces/*/deleteMicrosoft.MachineLearningServices/workspaces/*/write
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (10)
Microsoft.MachineLearningServices/workspaces/deleteMicrosoft.MachineLearningServices/workspaces/writeMicrosoft.MachineLearningServices/workspaces/computes/*/writeMicrosoft.MachineLearningServices/workspaces/computes/*/deleteMicrosoft.MachineLearningServices/workspaces/computes/listKeys/actionMicrosoft.MachineLearningServices/workspaces/listKeys/actionMicrosoft.MachineLearningServices/workspaces/hubs/writeMicrosoft.MachineLearningServices/workspaces/hubs/deleteMicrosoft.MachineLearningServices/workspaces/featurestores/writeMicrosoft.MachineLearningServices/workspaces/featurestores/delete
Assignable scopes (1)
/
Practical scope
Assign on the individual Azure Machine Learning workspace used by the data scientist. Parent-scope assignments are inherited by multiple workspaces and broaden access to their assets, jobs, models, and endpoints.
Common use cases (2)
- Submit training jobs, manage experiments and assets, publish pipelines, and deploy approved models within an existing workspace.
- Perform the documented Azure Machine Learning data-science workflow while leaving workspace and compute lifecycle administration with separate operators.
Prerequisites (2)
- The workspace and required compute must already exist, or the principal must also receive AzureML Compute Operator when self-service compute is approved.
- Grant separate roles for storage data, container registries, Kubernetes, managed identities, virtual networks, and other connected resources used by the workflow.
Best practices (3)
- Assign at workspace scope through a Microsoft Entra group and add AzureML Compute Operator only for users who create or delete compute.
- Use a custom role when production endpoint deployment, datastore changes, or other broad workspace operations must be excluded.
- Review additive assignments because an Action granted by another role can override an exclusion in this role.
Security considerations (3)
- The role can create, change, and delete many workspace assets and can deploy or invoke endpoints, affecting model integrity, service availability, and cost.
- It excludes compute creation and workspace modification but can still use existing compute and access data exposed through workspace datastores and separately granted resource roles.
- Azure RBAC is additive, so broader inherited roles can restore operations excluded by this definition.
Assignment guidance
Assign AzureML Data Scientist on the individual workspace to users who build and operate machine-learning assets but do not administer the workspace or compute lifecycle. Add Compute Operator or external-resource roles only for the specific additional workflow requirements.
Related roles (2)
- AzureML Compute Operator: Microsoft documents combining it with Data Scientist when self-service compute creation is required.
- Reader: The read-only workspace alternative for principals that only list and inspect assets.
Common questions
When should I assign the AzureML Data Scientist Azure role?
Assign AzureML Data Scientist when you need to: Submit training jobs, manage experiments and assets, publish pipelines, and deploy approved models within an existing workspace.; and Perform the documented Azure Machine Learning data-science workflow while leaving workspace and compute lifecycle administration with separate operators.. Practical scope: Assign on the individual Azure Machine Learning workspace used by the data scientist. Parent-scope assignments are inherited by multiple workspaces and broaden access to their assets, jobs, models, and endpoints.
What permissions does the AzureML Data Scientist Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.MachineLearningServices/workspaces/*/read; Microsoft.MachineLearningServices/workspaces/*/action; Microsoft.MachineLearningServices/workspaces/*/delete; and Microsoft.MachineLearningServices/workspaces/*/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the AzureML Data Scientist Azure role?
Key considerations when assigning AzureML Data Scientist: The role can create, change, and delete many workspace assets and can deploy or invoke endpoints, affecting model integrity, service availability, and cost.; It excludes compute creation and workspace modification but can still use existing compute and access data exposed through workspace datastores and separately granted resource roles.; and Azure RBAC is additive, so broader inherited roles can restore operations excluded by this definition.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Manage roles in your workspace - Azure Machine Learning | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.