AI-300 Practice Question 42: Workspace Identity Azure AI Administrator
Microsoft Machine Learning Operations Engineer Associate (AI-300) · Test 5 · question 2 of 10
A security review of an Azure Machine Learning workspace that was created in August 2024 finds that the workspace's system-assigned managed identity holds the Contributor role on the resource group. Workspaces created since November 2024 do not have this. The team wants the identity to follow the current least-privilege default without deleting or recreating the workspace. What should they do?
Show answer and explanation
Answer:
The documentation states: *"Before 2024-11-19, the system-assigned managed identity you create for the workspace automatically gets the Contributor role for the resource group that contains the workspace. Workspaces created after this date assign the system-assigned managed identity to the Azure AI Administrator role. This role is more narrowly scoped to the minimum permissions needed for the managed identity to perform its tasks."* For older workspaces, the documentation advises to *"convert workspaces created before 11/19/2024 to use the Azure AI Administrator role"* by using the REST API, the Azure CLI (az ml workspace update --name myworkspace --allow-roleassignment-on-rg true) or the Python SDK (allow_roleassignment_on_rg), so no recreation is needed (option D).
- A is wrong because recreating the workspace is not necessary. AzureML provides an in-place conversion, and a rebuild would lose the workspace's assets and history. - B is wrong because Owner is a broader role than Contributor, so it moves in the opposite direction from least privilege. - C is wrong because the identity needs the minimum permissions required to do its work. Removing them all would break workspace operations rather than narrow them.
Reference: Manage roles in your workspace - Azure Machine Learning