Access to Azure subscription for users

Question

Access to Azure subscription for users

RT-7199 421

We have an active subscription. For few of the users we activated owner role for the machine learning resource group.
But when they login to the portal/ML environment and try to switch directory and subscription, they don't see our production subscription and hence the workspace, although directory is correct. User had created a trial subscription on its own before and he only has visibility to that.

I checked with a test account and after login to ML studio I see this, which I believe is the same reason user does not see the subscription.

How can I safely give user subscription access only for ML resource group

Answer 1

Carlos Solís Salazar 11,606

Hi @RT-7199

Thank you for asking this question on the **Microsoft Q&A Platform. **

The role will depend on the activity that the user performs, for example, to create a new workspace you will require the role owner or contributor at the Resource group-level. (If you receive a failure when trying to create a workspace for the first time, make sure that your role allows Microsoft.MachineLearningServices/register/action. This action allows you to register the Azure Machine Learning resource provider with your Azure subscription.)

You can get more information about RBAC for Azure Machine Learning workspace here

Hope this helps!

----------

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.
NOTE: To answer you as quickly as possible, please mention me in your reply.

RT-7199 421 Reputation points

2022-10-28T18:05:00.407+00:00

@Carlos Solís Salazar Creating workspace or what role to assign for resource group is not the issue.

We created Azure ML environment and gave this user Owner role over that resource group in which workspace was created, So they can test in production environment without needing our support and has management approval for it.
Issue is when he logs into portal / studio he is not able to see the workspace we created for him, because he can't see the subscription under his account.

How can we make that happen, we don't want him assigned as owner to the subscription.

Difference in my view which I click switch account vs a test account(replicates the user scenario)
Switch Directory for me

Switch Directory for user

Carlos Solís Salazar 11,606

You won't need to use any default RBAC (Owner/Contributor) at the subscription level.

Please make a double-check the RBAC in the workspace that you create.

In the worst-case scenario, yo can use custom roles at the subscription level.

For Example,

This is a custom role for a Workspace Admin (At subscription level):

   {  
        "Name": "Workspace Admin Custom",  
        "IsCustom": true,  
        "Description": "Can perform all operations except quota management and upgrades",  
        "Actions": [  
            "Microsoft.MachineLearningServices/workspaces/*/read",  
            "Microsoft.MachineLearningServices/workspaces/*/action",  
            "Microsoft.MachineLearningServices/workspaces/*/write",  
            "Microsoft.MachineLearningServices/workspaces/*/delete",  
            "Microsoft.Authorization/roleAssignments/*"  
        ],  
        "NotActions": [  
            "Microsoft.MachineLearningServices/workspaces/write"  
        ],  
        "AssignableScopes": [  
            "/subscriptions/<subscription_id>"  
        ]  
    }

Source: https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?tabs=labeler#workspace-admin

Hope this helps!

RT-7199 421 Reputation points

2022-11-01T19:07:09.877+00:00

@Carlos Solís Salazar Thank you
I imagined user would still be able to see the subscription in the list even though role is not activated, which is not the case. After activating in PIM we are able to see it.

Access to Azure subscription for users

0 additional answers

Activity