Azure AI + machine learning built-in role

Cognitive Services Custom Vision Reader

For a supported existing Custom Vision workload, views projects without creating or updating them. Resource reads are control-plane Actions and project reads and the documented prediction-query operation are DataActions. Custom Vision is supported for existing customers only until its retirement on 2028-09-25; service calls fail after that date.

Control-plane actions (1)

• Microsoft.CognitiveServices/*/read

Data-plane actions (2)

• Microsoft.CognitiveServices/accounts/CustomVision/*/read
• Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/query/action

Excluded actions (1)

• Microsoft.CognitiveServices/accounts/CustomVision/projects/export/read

Assignable scopes (1)

• /

Practical scope

For an existing workload or migration only, assign on the Custom Vision training resource that contains the projects the reviewer inspects. Parent assignments are inherited by every Custom Vision resource in the selected scope.

Common use cases (2)

• Review an existing project, training assets, model results, and prediction images without changing them during migration planning.
• Validate the source project and replacement results before migration cutover and Custom Vision decommissioning.

Prerequisites (2)

• The supported existing Custom Vision training resource and project must already exist and be included in the migration inventory.
• The reviewer must be approved to view the project's training and prediction content.

Best practices (4)

• Microsoft directs customers to make a transition plan by 2026-09-25 and complete migration before retirement.
• Do not start a net-new Custom Vision workload; evaluate Azure Machine Learning AutoML, Foundry models, or Azure Content Understanding (preview) as documented alternatives.
• Use Reader for reviewers and auditors instead of Labeler, Trainer, Deployment, or Contributor.
• Review inherited parent assignments because Azure RBAC permissions are additive.

Security considerations (3)

• Read access can expose project configuration, training content, model information, and prediction images.
• The role cannot create or modify the project, but another additive assignment can expand effective access.
• A broad parent scope or migration export can expose content from every inherited Custom Vision project.

Assignment guidance

For a supported existing workload or migration only, assign Custom Vision Reader on the training resource to reviewers who inspect source projects or validate transition results. Do not start a net-new Custom Vision workload; evaluate Azure Machine Learning AutoML, Foundry models, or Azure Content Understanding (preview) as documented alternatives.

Related roles (2)

• Cognitive Services Custom Vision Labeler: Adds training-image and tag changes to project visibility.
• Cognitive Services Custom Vision Deployment: Adds model publishing, unpublishing, and export authority.

Editorial sources (6)

• Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role - Azure RBAC | Microsoft Learn →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC | Microsoft Learn →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC | Microsoft Learn →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Azure role-based access control - Custom Vision - Foundry Tools | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Migrate from Custom Vision Service - Foundry Tools | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →