Azure AI + machine learning built-in role
AzureML Registry User
Reads an Azure Machine Learning registry and creates, updates, and deletes assets within it. Its permissions are registry control-plane Actions and contain no DataActions; it cannot create or delete the registry resource itself.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 1823dd4f-9b8c-4ab6-ab4e-7397a3684615
Control-plane actions (2)
Microsoft.MachineLearningServices/registries/readMicrosoft.MachineLearningServices/registries/assets/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Azure Machine Learning registry shared by the data scientist or team. A resource-group or subscription assignment is inherited by every registry below the selected scope.
Common use cases (2)
- Publish, update, retrieve, and delete models, components, and environments in a shared Azure Machine Learning registry.
- Consume registry assets from approved workspaces without granting registry resource creation or deletion.
Prerequisites (2)
- An Azure Machine Learning registry must already exist, and the principal must be responsible for its shared assets.
- Grant workspace and connected storage or registry permissions separately when the workflow copies assets between a workspace and the registry.
Best practices (3)
- Assign directly on the registry and use Contributor or Owner only for principals that create or delete registry resources.
- Separate registries by lifecycle or trust boundary when teams should not modify each other's shared assets.
- Review asset deletion authority and use a custom role when the principal only consumes or publishes a narrower asset type.
Security considerations (3)
- The role can overwrite or delete shared registry assets used by multiple workspaces and deployment pipelines.
- It cannot create or delete the registry resource and has no DataActions, but registry assets can influence downstream training and deployment behavior.
- A parent-scope assignment grants asset modification across every inherited registry.
Assignment guidance
Assign AzureML Registry User on the specific registry to data scientists or automation that manage shared registry assets. Use a custom read-oriented role for consumers that should not write or delete assets, and reserve Contributor or Owner for registry-resource administration.
Related roles (2)
- Contributor: Microsoft documents Contributor as the broader role for administrators who must create or delete the registry resource.
- Owner: Adds registry-resource administration and role-assignment authority beyond registry asset management.
Common questions
When should I assign the AzureML Registry User Azure role?
Assign AzureML Registry User when you need to: Publish, update, retrieve, and delete models, components, and environments in a shared Azure Machine Learning registry.; and Consume registry assets from approved workspaces without granting registry resource creation or deletion.. Practical scope: Assign on the individual Azure Machine Learning registry shared by the data scientist or team. A resource-group or subscription assignment is inherited by every registry below the selected scope.
What permissions does the AzureML Registry User Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.MachineLearningServices/registries/read; and Microsoft.MachineLearningServices/registries/assets/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the AzureML Registry User Azure role?
Key considerations when assigning AzureML Registry User: The role can overwrite or delete shared registry assets used by multiple workspaces and deployment pipelines.; It cannot create or delete the registry resource and has no DataActions, but registry assets can influence downstream training and deployment behavior.; and A parent-scope assignment grants asset modification across every inherited registry.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Manage roles in your workspace - Azure Machine Learning | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.