Which JSON code segment should you use?

You create an Azure Machine Learning workspace.

You must create a custom role named DataScientist that meets the following requirements:

✑ Role members must not be able to delete the workspace.

✑ Role members must not be able to create, update, or delete compute resource in the workspace.

✑ Role members must not be able to add new users to the workspace.

You need to create a JSON file for the DataScientist role in the Azure Machine Learning workspace.

The custom role must enforce the restrictions specified by the IT Operations team.

Which JSON code segment should you use?

A)

B)

C)

D)

A . Option A
B . Option B
C . Option C
D . Option D

View Answer

Answer: A

Explanation:

The following custom role can do everything in the workspace except for the following actions:

✑ It can’t create or update a compute resource.

✑ It can’t delete a compute resource.

✑ It can’t add, delete, or alter role assignments.

✑ It can’t delete the workspace.

To create a custom role, first construct a role definition JSON file that specifies the permission and scope for the role.

The following example defines a custom role named "Data Scientist Custom" scoped at a specific workspace level:

data_scientist_custom_role.json :

{

"Name": "Data Scientist Custom",

"IsCustom": true,

"Description": "Can run experiment

but can’t create or delete compute.",

"Actions": ["*"],

"NotActions": [

"Microsoft.MachineLearningServices/workspaces/*/delete",

"Microsoft.MachineLearningServices/workspaces/write",

"Microsoft.MachineLearningServices/workspaces/computes/*/write",

"Microsoft.MachineLearningServices/workspaces/computes/*/delete",

"Microsoft.Authorization/*/write"

],

"AssignableScopes": [

"/subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/Microsoft.MachineLearningServices/workspaces/<workspace_name>"

]

}

Reference: https://docs.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles