AI-300 Practice Question 41: Data Scientist Role Entra Group
Microsoft Machine Learning Operations Engineer Associate (AI-300) · Test 5 · question 1 of 10
Fifteen data scientists must run experiments, submit training jobs to existing compute, and register models in a shared Azure Machine Learning workspace. They must not be able to create or delete compute resources, and they must not be able to modify the workspace itself. The team lead wants to add and remove team members without needing the Owner role on the workspace. Which approach meets these requirements?
Show answer and explanation
Answer:
The built-in AzureML Data Scientist role *"can perform all actions within an Azure Machine Learning workspace, except for creating or deleting compute resources and modifying the workspace itself,"* which matches the requirement. The documentation also describes using Microsoft Entra security groups: *"team or project leaders can manage user access to workspace as security group owners, without needing Owner role on the workspace resource directly,"* and the group owner *"isn't required to be group member, or have direct RBAC role on the workspace."* Assigning the role to the group gives the lead membership control without extra workspace rights (option B).
- A is wrong because the Contributor role can *"create or attach a compute cluster"* and manage most assets, so it grants more than the requirement allows. - C is wrong because Reader has *"read-only actions in the workspace"*, so the data scientists could not submit jobs, and making the lead an Owner grants far more than needed. - D is wrong because AzureML Compute Operator is for creating, managing, deleting and accessing compute, which is the opposite of what the data scientists may do, and it does not allow running experiments.
Reference: Manage roles in your workspace - Azure Machine Learning