Azure AI + machine learning built-in role
Cognitive Services OpenAI User
Views an Azure OpenAI resource, available models, and existing deployments and makes inference calls with Microsoft Entra authentication. The current role matrix documents Chat, Completions, and DALL-E (preview) playground use against already deployed models; the canonical definition contains the complete DataAction inventory.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 5e0bd9bd-7b93-4f28-af87-19fc36ad61bd
Control-plane actions (3)
Microsoft.CognitiveServices/*/readMicrosoft.Authorization/roleAssignments/readMicrosoft.Authorization/roleDefinitions/read
Data-plane actions (16)
Microsoft.CognitiveServices/accounts/OpenAI/*/readMicrosoft.CognitiveServices/accounts/OpenAI/engines/completions/actionMicrosoft.CognitiveServices/accounts/OpenAI/engines/search/actionMicrosoft.CognitiveServices/accounts/OpenAI/engines/generate/actionMicrosoft.CognitiveServices/accounts/OpenAI/deployments/audio/actionMicrosoft.CognitiveServices/accounts/OpenAI/deployments/search/actionMicrosoft.CognitiveServices/accounts/OpenAI/deployments/completions/actionMicrosoft.CognitiveServices/accounts/OpenAI/deployments/chat/completions/actionMicrosoft.CognitiveServices/accounts/OpenAI/deployments/realtime/actionMicrosoft.CognitiveServices/accounts/OpenAI/deployments/extensions/chat/completions/actionMicrosoft.CognitiveServices/accounts/OpenAI/deployments/embeddings/actionMicrosoft.CognitiveServices/accounts/OpenAI/images/generations/actionMicrosoft.CognitiveServices/accounts/OpenAI/video/generations/*/actionMicrosoft.CognitiveServices/accounts/OpenAI/video/generations/*/deleteMicrosoft.CognitiveServices/accounts/OpenAI/assistants/*Microsoft.CognitiveServices/accounts/OpenAI/responses/*
Excluded actions (1)
Microsoft.CognitiveServices/accounts/OpenAI/stored-completions/read
Assignable scopes (1)
/
Practical scope
Assign on the individual Azure OpenAI resource used by the application or person. Parent-scope assignments are inherited by all Azure OpenAI resources below the selected scope.
Common use cases (2)
- Call an existing Azure OpenAI deployment for chat or completion inference with Microsoft Entra authentication.
- Use the documented Chat, Completions, or DALL-E (preview) playground against a model an administrator already deployed.
Prerequisites (2)
- The Azure OpenAI resource and model deployment must already exist.
- Use a Microsoft Entra user, service principal, or managed identity and grant connected data-source permissions separately when the application uses external search or storage.
Best practices (3)
- Use this role for the documented inference and playground boundary instead of OpenAI Contributor when the principal does not deploy or fine-tune models.
- Assign on the individual resource and use separate identities for development, testing, and production callers.
- Add Cognitive Services Usages Reader only when the principal must view subscription quota.
Security considerations (3)
- Documented inference and playground access can submit prompts or images, receive model outputs, and incur usage while processing application data.
- The role cannot create resources, manage deployments, fine-tune models, retrieve keys, or read stored completions through the excluded operation.
- A parent-scope assignment permits inference against deployments on every inherited Azure OpenAI resource.
Assignment guidance
Assign Cognitive Services OpenAI User directly on the Azure OpenAI resource to the runtime identity or user that invokes existing deployments. Elevate to OpenAI Contributor only for deployment and fine-tuning work and grant quota and connected-resource access separately.
Related roles (2)
- Cognitive Services OpenAI Contributor: Adds model deployment, fine-tuning, training-data, and stored-completion capabilities.
- Cognitive Services Usages Reader: Adds subscription quota visibility without changing model or inference permissions.
Common questions
When should I assign the Cognitive Services OpenAI User Azure role?
Assign Cognitive Services OpenAI User when you need to: Call an existing Azure OpenAI deployment for chat or completion inference with Microsoft Entra authentication.; and Use the documented Chat, Completions, or DALL-E (preview) playground against a model an administrator already deployed.. Practical scope: Assign on the individual Azure OpenAI resource used by the application or person. Parent-scope assignments are inherited by all Azure OpenAI resources below the selected scope.
What permissions does the Cognitive Services OpenAI User Azure role grant?
The role definition grants 19 combined control-plane and data-plane actions. Representative operations include: Microsoft.CognitiveServices/*/read; Microsoft.Authorization/roleAssignments/read; Microsoft.Authorization/roleDefinitions/read; Microsoft.CognitiveServices/accounts/OpenAI/*/read; Microsoft.CognitiveServices/accounts/OpenAI/engines/completions/action; and Microsoft.CognitiveServices/accounts/OpenAI/engines/search/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Cognitive Services OpenAI User Azure role?
Key considerations when assigning Cognitive Services OpenAI User: Documented inference and playground access can submit prompts or images, receive model outputs, and incur usage while processing application data.; The role cannot create resources, manage deployments, fine-tune models, retrieve keys, or read stored completions through the excluded operation.; and A parent-scope assignment permits inference against deployments on every inherited Azure OpenAI resource.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Role-based access control for Azure OpenAI (classic) - Microsoft Foundry (classic) portal | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.