Azure AI + machine learning built-in role

Cognitive Services Custom Vision Deployment

For a supported existing Custom Vision workload, publishes, unpublishes, and exports models and can view projects without changing project definitions, training images, or tags. Resource reads are control-plane Actions; model deployment and inference operations are DataActions. Custom Vision is supported for existing customers only until its retirement on 2028-09-25; service calls fail after that date.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 5c4089e1-6d96-4d2f-b296-c1bc7137275f

Control-plane actions (1)

Data-plane actions (7)

Excluded actions (1)

Assignable scopes (1)

Practical scope

For an existing workload or migration only, assign on the Custom Vision training resource that contains the models the deployer releases or exports. A parent assignment is inherited by all Custom Vision resources below it and broadens deployment authority.

Common use cases (2)

Prerequisites (2)

Best practices (4)

Security considerations (3)

Assignment guidance

For a supported existing workload or migration only, assign Custom Vision Deployment on the training resource to the release identity responsible for publishing, unpublishing, exporting, or migration validation. Do not start a net-new Custom Vision workload; evaluate Azure Machine Learning AutoML, Foundry models, or Azure Content Understanding (preview) as documented alternatives.

Related roles (2)

Common questions

When should I assign the Cognitive Services Custom Vision Deployment Azure role?

Assign Cognitive Services Custom Vision Deployment when you need to: Maintain a supported existing deployment by publishing or unpublishing an approved iteration without granting project authoring.; and Export a trained model and validate prediction behavior as part of a controlled migration workflow.. Practical scope: For an existing workload or migration only, assign on the Custom Vision training resource that contains the models the deployer releases or exports. A parent assignment is inherited by all Custom Vision resources below it and broadens deployment authority.

What permissions does the Cognitive Services Custom Vision Deployment Azure role grant?

The role definition grants 8 combined control-plane and data-plane actions. Representative operations include: Microsoft.CognitiveServices/*/read; Microsoft.CognitiveServices/accounts/CustomVision/*/read; Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/*; Microsoft.CognitiveServices/accounts/CustomVision/projects/iterations/publish/*; Microsoft.CognitiveServices/accounts/CustomVision/projects/iterations/export/*; and Microsoft.CognitiveServices/accounts/CustomVision/projects/quicktest/*. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Cognitive Services Custom Vision Deployment Azure role?

Key considerations when assigning Cognitive Services Custom Vision Deployment: Publishing changes which model version serves prediction requests, while unpublishing can interrupt a production endpoint.; Model export can move trained artifacts outside the managed Custom Vision service boundary.; and Retirement makes continuity dependent on completing and validating the replacement before 2028-09-25.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (6)

Official Microsoft Learn documentation →