Question

You manage an Azure Machine Learning workspace shared by a data science team. A new contractor must be able to create and run training jobs, register models, and read datastores in this workspace, but must NOT be allowed to delete the workspace, modify its networking configuration, or change role assignments. You want to follow the principle of least privilege while minimizing custom configuration effort. What should you do?

Accepted Answer

Assign the contractor the built-in AzureML Data Scientist role scoped to the workspace.

Answer

Assign the contractor the Contributor role scoped to the workspace.

Answer

Assign the contractor the Owner role scoped to the resource group containing the workspace.

Answer

Assign the contractor the Reader role scoped to the workspace and add them to the workspace's system-assigned managed identity.