Azure AI + machine learning built-in role

Cognitive Services Custom Vision Contributor

For a supported existing Custom Vision workload, provides full project access, including viewing, creating, editing, and deleting projects. Resource reads are control-plane Actions; project operations are Custom Vision DataActions. Custom Vision is supported for existing customers only until its retirement on 2028-09-25; service calls fail after that date.

Control-plane actions (1)

• Microsoft.CognitiveServices/*/read

Data-plane actions (1)

• Microsoft.CognitiveServices/accounts/CustomVision/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

For an existing workload or migration only, assign on the specific Custom Vision training resource that contains the projects the contributor manages. Resource-group, subscription, or management-group assignments are inherited by every Custom Vision resource below that scope.

Common use cases (2)

• Maintain an existing Custom Vision project, training images, tags, models, and project lifecycle while its replacement is implemented.
• Export and validate project data or models as part of a controlled migration to a documented alternative.

Prerequisites (2)

• An existing supported Custom Vision training resource and a Microsoft Entra user, group, service principal, or managed identity are required.
• Confirm that project creation and deletion are required rather than the narrower Trainer, Labeler, Deployment, or Reader role.

Best practices (4)

• Microsoft directs customers to make a transition plan by 2026-09-25 and complete migration before retirement.
• Do not start a net-new Custom Vision workload; evaluate Azure Machine Learning AutoML, Foundry models, or Azure Content Understanding (preview) as documented alternatives.
• Use Trainer for model authors who should not create or delete projects, and use the dedicated Labeler, Deployment, or Reader role for narrower duties.
• Assign directly on the Custom Vision training resource instead of a parent scope.

Security considerations (3)

• The role can create, modify, or delete projects and all project data-plane content, including training assets and models.
• A parent-scope assignment grants full project authority across every inherited Custom Vision resource.
• Retirement does not revoke an existing assignment before 2028-09-25, so stale broad access must still be removed during migration and decommissioning.

Assignment guidance

For a supported existing workload or migration only, assign Custom Vision Contributor on the training resource to project owners who require project creation and deletion. Select a narrower Custom Vision role for other migration participants. Do not start a net-new Custom Vision workload; evaluate Azure Machine Learning AutoML, Foundry models, or Azure Content Understanding (preview) as documented alternatives.

Related roles (3)

• Cognitive Services Custom Vision Trainer: Full project authoring and model training without project creation or deletion.
• Cognitive Services Custom Vision Labeler: Restricts changes to training images and tags.
• Cognitive Services Custom Vision Deployment: Restricts changes to publishing, unpublishing, and exporting models.

Editorial sources (6)

• Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role - Azure RBAC | Microsoft Learn →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC | Microsoft Learn →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC | Microsoft Learn →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Azure role-based access control - Custom Vision - Foundry Tools | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Migrate from Custom Vision Service - Foundry Tools | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →