Microsoft Exam DP-100 Topic 3 Question 7 Discussion

The following custom role can do everything in the workspace except for the following actions:

It can't create or update a compute resource.

It can't delete a compute resource.

It can't add, delete, or alter role assignments.

It can't delete the workspace.

To create a custom role, first construct a role definition JSON file that specifies the permission and scope for the role. The following example defines a custom role named 'Data Scientist Custom' scoped at a specific workspace level:

data_scientist_custom_role.json :

{

'Name': 'Data Scientist Custom',

'IsCustom': true,

'Description': 'Can run experiment but can't create or delete compute.',

'Actions': ['*'],

'NotActions': [

'Microsoft.MachineLearningServices/workspaces/*/delete',

'Microsoft.MachineLearningServices/workspaces/write',

'Microsoft.MachineLearningServices/workspaces/computes/*/write',

'Microsoft.MachineLearningServices/workspaces/computes/*/delete',

'Microsoft.Authorization/*/write'

],

'AssignableScopes': [

'/subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/Microsoft.MachineLearningServices/workspaces/<workspace_name>'

]

}

https://docs.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles