ML studio Roles/Permissions issue

Question

I am a network admin and know very little about Machine Learning

We setup a private ML studio workspace for our user who is assigned the Owner role to the resource group the workspace uses.

First we had issue with creating compute and user had to be assigned some network join permissions at the Vnet, as he could not even get a list of subnets. I could not find any ML role at the Vnet level that needs to be assigned.

After assigning those permissions, user can create compute but not able to click terminal as all the applications are greyed out. That may be because compute is not assigned to me.

I created a test compute myself. and even added a dns entry pointing to compute instance as we have custom dns, terminal still does not open.

What all permissions that we need to assign user and at what resource so they can use ML studio without our intervention.

Thanks

Answer 1

Hello @R.T

Thanks for reaching out to us, I understand you are building your compute within your VNET for your team. There are two roles related to VNET you may want to add, could you please take a look and have a try? Please let me know if below roles are still not working and we can discuss the next step.

To deploy your compute resources inside a VNet, you need to explicitly have permissions for the following actions:

• Microsoft.Network/virtualNetworks/*/read on the VNet resources.
• Microsoft.Network/virtualNetworks/subnets/join/action on the subnet resource. For more information on Azure RBAC with networking, see the Networking built-in roles.

Since you ask all relative permissions, I want to share some common Common scenarios for roles/permissions management like below screenshot-

https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?tabs=labeler#common-scenarios

And also some examples of custom role for different scenarios like below screenshot-

https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?tabs=labeler#example-custom-roles

Please let me know if you need further help.

Regards,

Yutong

-Please kindly accept the answer if you feel helpful to support the community, thanks a lot.