Azure AI + machine learning built-in role
Cognitive Services OpenAI Contributor
Uses deployed Azure OpenAI models and manages model deployments, fine-tuning, training data, stored completions, and responsible-AI policies. Resource and deployment management are control-plane Actions, while inference and OpenAI project operations are DataActions; it cannot create the Azure OpenAI resource or view and regenerate its keys.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: a001fd3d-188f-4b5d-821b-7da978bf7442
Control-plane actions (11)
Microsoft.CognitiveServices/*/readMicrosoft.CognitiveServices/accounts/deployments/writeMicrosoft.CognitiveServices/accounts/deployments/deleteMicrosoft.CognitiveServices/accounts/raiPolicies/readMicrosoft.CognitiveServices/accounts/raiPolicies/writeMicrosoft.CognitiveServices/accounts/raiPolicies/deleteMicrosoft.CognitiveServices/accounts/commitmentplans/readMicrosoft.CognitiveServices/accounts/commitmentplans/writeMicrosoft.CognitiveServices/accounts/commitmentplans/deleteMicrosoft.Authorization/roleAssignments/readMicrosoft.Authorization/roleDefinitions/read
Data-plane actions (1)
Microsoft.CognitiveServices/accounts/OpenAI/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Azure OpenAI resource where the principal develops and deploys models. A resource-group, subscription, or management-group assignment is inherited by every Azure OpenAI resource below that scope.
Common use cases (2)
- Create or edit model deployments, fine-tune models, upload training data, and test or invoke deployed models with Microsoft Entra authentication.
- Manage Azure OpenAI project features such as Assistants, stored completions, and approved data connections without creating the underlying Azure resource or managing its keys.
Prerequisites (2)
- The Azure OpenAI resource must already exist and the principal must use a Microsoft Entra identity for portal and API access.
- Assign Cognitive Services Usages Reader separately at subscription scope when quota visibility is required, and grant each connected storage or search resource its own required role.
Best practices (3)
- Use Cognitive Services OpenAI User for inference-only callers and reserve Contributor for model deployment and fine-tuning responsibilities.
- Assign directly on the Azure OpenAI resource and keep resource creation and key management with a separate Cognitive Services administrator.
- Review model deployments, fine-tuning data, stored completions, and connected-resource permissions when the assignment changes.
Security considerations (3)
- The role can deploy and remove models, fine-tune with uploaded data, invoke models, and access stored completion capabilities, affecting output behavior, data exposure, capacity, and cost.
- It cannot view or regenerate resource keys, but its DataActions authorize Microsoft Entra-based inference and project operations.
- A parent-scope assignment grants these capabilities across multiple inherited Azure OpenAI resources.
Assignment guidance
Assign Cognitive Services OpenAI Contributor on the specific Azure OpenAI resource to model developers who deploy, fine-tune, and test models. Give runtime callers OpenAI User, add Usages Reader only for quota, and keep resource and key administration separate.
Related roles (3)
- Cognitive Services OpenAI User: Narrower role for viewing deployments and invoking already deployed models without deployment or fine-tuning changes.
- Cognitive Services Contributor: Adds Azure AI resource creation, broad control-plane administration, and key management.
- Cognitive Services Usages Reader: Subscription-scoped companion role for viewing quota allocations.
Common questions
When should I assign the Cognitive Services OpenAI Contributor Azure role?
Assign Cognitive Services OpenAI Contributor when you need to: Create or edit model deployments, fine-tune models, upload training data, and test or invoke deployed models with Microsoft Entra authentication.; and Manage Azure OpenAI project features such as Assistants, stored completions, and approved data connections without creating the underlying Azure resource or managing its keys.. Practical scope: Assign on the individual Azure OpenAI resource where the principal develops and deploys models. A resource-group, subscription, or management-group assignment is inherited by every Azure OpenAI resource below that scope.
What permissions does the Cognitive Services OpenAI Contributor Azure role grant?
The role definition grants 12 combined control-plane and data-plane actions. Representative operations include: Microsoft.CognitiveServices/*/read; Microsoft.CognitiveServices/accounts/deployments/write; Microsoft.CognitiveServices/accounts/deployments/delete; Microsoft.CognitiveServices/accounts/raiPolicies/read; Microsoft.CognitiveServices/accounts/raiPolicies/write; and Microsoft.CognitiveServices/accounts/raiPolicies/delete. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Cognitive Services OpenAI Contributor Azure role?
Key considerations when assigning Cognitive Services OpenAI Contributor: The role can deploy and remove models, fine-tune with uploaded data, invoke models, and access stored completion capabilities, affecting output behavior, data exposure, capacity, and cost.; It cannot view or regenerate resource keys, but its DataActions authorize Microsoft Entra-based inference and project operations.; and A parent-scope assignment grants these capabilities across multiple inherited Azure OpenAI resources.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Role-based access control for Azure OpenAI (classic) - Microsoft Foundry (classic) portal | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.