A parks department wants seasonal interns to view production scoring metrics in Azure Machine Learning without altering datastores. What should the MLOps lead configure?

Configuring a least-privilege role that allows viewing metrics but denies datastore modification is correct for seasonal parks-department interns because production scoring metrics are observability data, not a license to alter municipal datastores. Interns can learn from metrics dashboards and experiment views while RBAC blocks changes to storage connections, credentials, and registered data paths. That separation reduces accidental or malicious data-path changes during a short summer cohort.

A least-privilege role that allows viewing run metrics but denies datastore modification misses the requirement because run metrics cover experiment training runs, not production scoring metrics for the parks-department workflow. A least-privilege role that allows viewing metrics but denies datastore connection deletion is too narrow because it blocks only deletion of the connection while still permitting other datastore modifications such as credential or path edits. A least-privilege role that allows viewing metrics but denies test datastore modification is scoped to the wrong environment because it protects test datastores while leaving production datastores open to alteration by seasonal interns.

Exam caveat: "viewing production scoring metrics" is not the same as viewing run metrics, "denying datastore modification" is not the same as denying only connection deletion, and protecting production is not the same as protecting only the test datastore. Choose roles that separate read/monitor duties from datastore and resource management, scoped to just the relevant workspace, when the stem calls out interns or temporary staff.

Operational check: assign the least-privilege role to an intern test account, confirm production scoring metrics are visible rather than only run metrics, attempt a datastore edit beyond connection deletion and verify it is denied, confirm the protection applies to production datastores not just test, and remove the role at the end of the seasonal assignment.