Azure AI + machine learning built-in role
Cognitive Services Custom Vision Reader
For a supported existing Custom Vision workload, views projects without creating or updating them. Resource reads are control-plane Actions and project reads and the documented prediction-query operation are DataActions. Custom Vision is supported for existing customers only until its retirement on 2028-09-25; service calls fail after that date.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 93586559-c37d-4a6b-ba08-b9f0940c2d73
Control-plane actions (1)
Microsoft.CognitiveServices/*/read
Data-plane actions (2)
Microsoft.CognitiveServices/accounts/CustomVision/*/readMicrosoft.CognitiveServices/accounts/CustomVision/projects/predictions/query/action
Excluded actions (1)
Microsoft.CognitiveServices/accounts/CustomVision/projects/export/read
Assignable scopes (1)
/
Practical scope
For an existing workload or migration only, assign on the Custom Vision training resource that contains the projects the reviewer inspects. Parent assignments are inherited by every Custom Vision resource in the selected scope.
Common use cases (2)
- Review an existing project, training assets, model results, and prediction images without changing them during migration planning.
- Validate the source project and replacement results before migration cutover and Custom Vision decommissioning.
Prerequisites (2)
- The supported existing Custom Vision training resource and project must already exist and be included in the migration inventory.
- The reviewer must be approved to view the project's training and prediction content.
Best practices (4)
- Microsoft directs customers to make a transition plan by 2026-09-25 and complete migration before retirement.
- Do not start a net-new Custom Vision workload; evaluate Azure Machine Learning AutoML, Foundry models, or Azure Content Understanding (preview) as documented alternatives.
- Use Reader for reviewers and auditors instead of Labeler, Trainer, Deployment, or Contributor.
- Review inherited parent assignments because Azure RBAC permissions are additive.
Security considerations (3)
- Read access can expose project configuration, training content, model information, and prediction images.
- The role cannot create or modify the project, but another additive assignment can expand effective access.
- A broad parent scope or migration export can expose content from every inherited Custom Vision project.
Assignment guidance
For a supported existing workload or migration only, assign Custom Vision Reader on the training resource to reviewers who inspect source projects or validate transition results. Do not start a net-new Custom Vision workload; evaluate Azure Machine Learning AutoML, Foundry models, or Azure Content Understanding (preview) as documented alternatives.
Related roles (2)
- Cognitive Services Custom Vision Labeler: Adds training-image and tag changes to project visibility.
- Cognitive Services Custom Vision Deployment: Adds model publishing, unpublishing, and export authority.
Common questions
When should I assign the Cognitive Services Custom Vision Reader Azure role?
Assign Cognitive Services Custom Vision Reader when you need to: Review an existing project, training assets, model results, and prediction images without changing them during migration planning.; and Validate the source project and replacement results before migration cutover and Custom Vision decommissioning.. Practical scope: For an existing workload or migration only, assign on the Custom Vision training resource that contains the projects the reviewer inspects. Parent assignments are inherited by every Custom Vision resource in the selected scope.
What permissions does the Cognitive Services Custom Vision Reader Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.CognitiveServices/*/read; Microsoft.CognitiveServices/accounts/CustomVision/*/read; and Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/query/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Cognitive Services Custom Vision Reader Azure role?
Key considerations when assigning Cognitive Services Custom Vision Reader: Read access can expose project configuration, training content, model information, and prediction images.; The role cannot create or modify the project, but another additive assignment can expand effective access.; and A broad parent scope or migration export can expose content from every inherited Custom Vision project.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure role-based access control - Custom Vision - Foundry Tools | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Migrate from Custom Vision Service - Foundry Tools | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.