Azure AI + machine learning built-in role
Cognitive Services Custom Vision Contributor
For a supported existing Custom Vision workload, provides full project access, including viewing, creating, editing, and deleting projects. Resource reads are control-plane Actions; project operations are Custom Vision DataActions. Custom Vision is supported for existing customers only until its retirement on 2028-09-25; service calls fail after that date.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: c1ff6cc2-c111-46fe-8896-e0ef812ad9f3
Control-plane actions (1)
Microsoft.CognitiveServices/*/read
Data-plane actions (1)
Microsoft.CognitiveServices/accounts/CustomVision/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
For an existing workload or migration only, assign on the specific Custom Vision training resource that contains the projects the contributor manages. Resource-group, subscription, or management-group assignments are inherited by every Custom Vision resource below that scope.
Common use cases (2)
- Maintain an existing Custom Vision project, training images, tags, models, and project lifecycle while its replacement is implemented.
- Export and validate project data or models as part of a controlled migration to a documented alternative.
Prerequisites (2)
- An existing supported Custom Vision training resource and a Microsoft Entra user, group, service principal, or managed identity are required.
- Confirm that project creation and deletion are required rather than the narrower Trainer, Labeler, Deployment, or Reader role.
Best practices (4)
- Microsoft directs customers to make a transition plan by 2026-09-25 and complete migration before retirement.
- Do not start a net-new Custom Vision workload; evaluate Azure Machine Learning AutoML, Foundry models, or Azure Content Understanding (preview) as documented alternatives.
- Use Trainer for model authors who should not create or delete projects, and use the dedicated Labeler, Deployment, or Reader role for narrower duties.
- Assign directly on the Custom Vision training resource instead of a parent scope.
Security considerations (3)
- The role can create, modify, or delete projects and all project data-plane content, including training assets and models.
- A parent-scope assignment grants full project authority across every inherited Custom Vision resource.
- Retirement does not revoke an existing assignment before 2028-09-25, so stale broad access must still be removed during migration and decommissioning.
Assignment guidance
For a supported existing workload or migration only, assign Custom Vision Contributor on the training resource to project owners who require project creation and deletion. Select a narrower Custom Vision role for other migration participants. Do not start a net-new Custom Vision workload; evaluate Azure Machine Learning AutoML, Foundry models, or Azure Content Understanding (preview) as documented alternatives.
Related roles (3)
- Cognitive Services Custom Vision Trainer: Full project authoring and model training without project creation or deletion.
- Cognitive Services Custom Vision Labeler: Restricts changes to training images and tags.
- Cognitive Services Custom Vision Deployment: Restricts changes to publishing, unpublishing, and exporting models.
Common questions
When should I assign the Cognitive Services Custom Vision Contributor Azure role?
Assign Cognitive Services Custom Vision Contributor when you need to: Maintain an existing Custom Vision project, training images, tags, models, and project lifecycle while its replacement is implemented.; and Export and validate project data or models as part of a controlled migration to a documented alternative.. Practical scope: For an existing workload or migration only, assign on the specific Custom Vision training resource that contains the projects the contributor manages. Resource-group, subscription, or management-group assignments are inherited by every Custom Vision resource below that scope.
What permissions does the Cognitive Services Custom Vision Contributor Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.CognitiveServices/*/read; and Microsoft.CognitiveServices/accounts/CustomVision/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Cognitive Services Custom Vision Contributor Azure role?
Key considerations when assigning Cognitive Services Custom Vision Contributor: The role can create, modify, or delete projects and all project data-plane content, including training assets and models.; A parent-scope assignment grants full project authority across every inherited Custom Vision resource.; and Retirement does not revoke an existing assignment before 2028-09-25, so stale broad access must still be removed during migration and decommissioning.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure role-based access control - Custom Vision - Foundry Tools | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Migrate from Custom Vision Service - Foundry Tools | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.