Azure AI + machine learning built-in role

Cognitive Services OpenAI User

Views an Azure OpenAI resource, available models, and existing deployments and makes inference calls with Microsoft Entra authentication. The current role matrix documents Chat, Completions, and DALL-E (preview) playground use against already deployed models; the canonical definition contains the complete DataAction inventory.

Control-plane actions (3)

• Microsoft.CognitiveServices/*/read
• Microsoft.Authorization/roleAssignments/read
• Microsoft.Authorization/roleDefinitions/read

Data-plane actions (16)

• Microsoft.CognitiveServices/accounts/OpenAI/*/read
• Microsoft.CognitiveServices/accounts/OpenAI/engines/completions/action
• Microsoft.CognitiveServices/accounts/OpenAI/engines/search/action
• Microsoft.CognitiveServices/accounts/OpenAI/engines/generate/action
• Microsoft.CognitiveServices/accounts/OpenAI/deployments/audio/action
• Microsoft.CognitiveServices/accounts/OpenAI/deployments/search/action
• Microsoft.CognitiveServices/accounts/OpenAI/deployments/completions/action
• Microsoft.CognitiveServices/accounts/OpenAI/deployments/chat/completions/action
• Microsoft.CognitiveServices/accounts/OpenAI/deployments/realtime/action
• Microsoft.CognitiveServices/accounts/OpenAI/deployments/extensions/chat/completions/action
• Microsoft.CognitiveServices/accounts/OpenAI/deployments/embeddings/action
• Microsoft.CognitiveServices/accounts/OpenAI/images/generations/action
• Microsoft.CognitiveServices/accounts/OpenAI/video/generations/*/action
• Microsoft.CognitiveServices/accounts/OpenAI/video/generations/*/delete
• Microsoft.CognitiveServices/accounts/OpenAI/assistants/*
• Microsoft.CognitiveServices/accounts/OpenAI/responses/*

Excluded actions (1)

• Microsoft.CognitiveServices/accounts/OpenAI/stored-completions/read

Assignable scopes (1)

• /

Practical scope

Assign on the individual Azure OpenAI resource used by the application or person. Parent-scope assignments are inherited by all Azure OpenAI resources below the selected scope.

Common use cases (2)

• Call an existing Azure OpenAI deployment for chat or completion inference with Microsoft Entra authentication.
• Use the documented Chat, Completions, or DALL-E (preview) playground against a model an administrator already deployed.

Prerequisites (2)

• The Azure OpenAI resource and model deployment must already exist.
• Use a Microsoft Entra user, service principal, or managed identity and grant connected data-source permissions separately when the application uses external search or storage.

Best practices (3)

• Use this role for the documented inference and playground boundary instead of OpenAI Contributor when the principal does not deploy or fine-tune models.
• Assign on the individual resource and use separate identities for development, testing, and production callers.
• Add Cognitive Services Usages Reader only when the principal must view subscription quota.

Security considerations (3)

• Documented inference and playground access can submit prompts or images, receive model outputs, and incur usage while processing application data.
• The role cannot create resources, manage deployments, fine-tune models, retrieve keys, or read stored completions through the excluded operation.
• A parent-scope assignment permits inference against deployments on every inherited Azure OpenAI resource.

Assignment guidance

Assign Cognitive Services OpenAI User directly on the Azure OpenAI resource to the runtime identity or user that invokes existing deployments. Elevate to OpenAI Contributor only for deployment and fine-tuning work and grant quota and connected-resource access separately.

Related roles (2)

• Cognitive Services OpenAI Contributor: Adds model deployment, fine-tuning, training-data, and stored-completion capabilities.
• Cognitive Services Usages Reader: Adds subscription quota visibility without changing model or inference permissions.

Editorial sources (5)

• Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role - Azure RBAC | Microsoft Learn →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC | Microsoft Learn →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC | Microsoft Learn →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Role-based access control for Azure OpenAI (classic) - Microsoft Foundry (classic) portal | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →