A developer must grant a data science team read and write access to datasets in Azure Machine Learning but must not allow them to create or delete compute clusters. Which built-in Azure RBAC role assignment is most appropriate at the Azure Machine Learning workspace level?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because the 'AzureML Data Scientist' built-in role grants permissions to perform most actions within an Azure Machine Learning workspace, including creating and running experiments, accessing datasets, and submitting jobs, while excluding management operations like creating or deleting compute infrastructure. This follows the least-privilege principle for data scientists.
Full explanation below image
Full Explanation
A is correct because the 'AzureML Data Scientist' built-in role grants permissions to perform most actions within an Azure Machine Learning workspace, including creating and running experiments, accessing datasets, and submitting jobs, while excluding management operations like creating or deleting compute infrastructure. This follows the least-privilege principle for data scientists. B is wrong because the Contributor role grants full management access including creating and deleting compute clusters, which violates least privilege. C is wrong because 'AzureML Compute Operator' is focused on starting and stopping existing compute resources, not data access. D is wrong because Reader is read-only and prevents writing datasets or submitting experiments.