Under Permissions select Azure role assignments

By Sai Kiran Pandrala · Last verified: 2026-05-31 · Source: official Microsoft Learn docs

This page documents Under Permissions select Azure role assignments for engineers working with Azure AI Services. The body is the canonical material from Microsoft Learn; the surrounding context shows where this fits in a real deployment so you can apply it confidently.

Azure RBAC is where most security audits fail in cloud AI projects. I have done about a dozen post-mortems where someone gave Contributor on the entire subscription to a service principal just to make the deploy work. Do not be that person.

Reference content from Microsoft documentation

Azure RBAC for Language Service uses a small set of built-in roles. The ones you actually need: Cognitive Services User (call the API, read but not change resource config), Cognitive Services Language Reader (read project metadata, not call inference), Cognitive Services Language Writer (edit projects), and Cognitive Services Language Owner (delete projects).

For most production architectures: the application's managed identity gets Cognitive Services User on the resource. Engineers get Reader. Data-team labelling accounts get Writer. Only the platform team gets Owner.

Assign-role command I use

az role assignment create `
  --assignee <principal-id> `
  --role "Cognitive Services User" `
  --scope /subscriptions/<sub-id>/resourceGroups/rg-ai-language-prod/providers/Microsoft.CognitiveServices/accounts/lang-prod-01

How to apply this in practice

Always assign at the resource scope, never at the subscription scope. A Contributor at subscription scope is the most common audit finding I see in cloud reviews.

For managed identities, use system-assigned where possible - they live and die with the resource. User-assigned identities make sense when multiple resources share an identity (multi-region web apps, for example).

# Verification
az role assignment list --assignee <principal-id> --output table
az role assignment list --scope /subscriptions/<sub-id>/resourceGroups/rg-ai-language-prod

What this looks like in real production

I have spent the last 3 years shipping Azure AI Language Service projects across 12 client environments, ranging from a 4-developer startup in Bengaluru to a 22,000-seat insurance broker in Mumbai. The shape of the work converges. The vocabulary teams use to describe their problems differs wildly. The technical answer is usually the same.

Last quarter I worked on a project for a mid-sized e-commerce platform processing about 18,000 customer-support tickets per day. The team had built three separate proof-of-concepts using three different Azure AI Language features and could not decide which to ship. We sat in a room for 90 minutes, mapped each PoC to a concrete business outcome, killed two of them, and shipped the third inside three weeks. Total saved engineering time: roughly 8 weeks of two senior engineers. The lesson is not technical; it is about ruthless scoping.

A role-assignment near-miss

An engineer on my team was provisioning a Language resource and granted the application service principal "Contributor" at the subscription scope to make the deploy work in 5 minutes instead of 30. It worked. The application also gained the ability to delete any resource in the subscription, including the production SQL databases that lived there.

The annual security audit caught it 6 weeks later. The remediation was simple - revoke the Contributor, grant Cognitive Services User at the resource scope. The audit finding stayed on the report for the rest of the year. The lesson: 25 minutes of doing it correctly the first time would have prevented 4 hours of audit response. Always assign at the resource scope. Never at the subscription scope.

The cost shape you should plan for

Azure AI Language Service pricing is metered per 1,000 text records on the S0 tier, with separate pricing per feature. For mid-2026 on the centralindia region, a typical bill looks like this: sentiment analysis at roughly ₹83 per 1,000 documents, key phrase extraction at the same rate, custom NER inference at about ₹208 per 1,000, and PII detection at ₹83. Custom model training adds a one-time cost of around ₹420 per hour of training time.

For a team processing 100,000 documents a day across sentiment + key phrases + PII, the monthly bill lands around ₹7.5 lakh. Custom features push that to ₹12-15 lakh depending on retraining cadence. Compare against the all-in cost of building the same capability with open-source models on dedicated GPUs - typically ₹18-25 lakh per month for equivalent throughput - and the managed-service trade-off looks reasonable. Compare against the OpenAI gpt-4o-mini cost for similar tasks - around ₹4-6 lakh per month - and you have to decide whether the latency, governance, and operational characteristics of Azure AI Language are worth the premium.

The runbook every team needs

Every Language Service deployment in production needs four documents in the team wiki, and most teams ship without them. The first is the architecture diagram showing every Azure resource the feature touches - resource group, Language resource, storage account, key vault, app service or function app, monitoring resources. The second is the credentials rotation runbook - which secrets exist, where they are stored, when they expire, who owns each one. The third is the incident response runbook - what to do when the endpoint returns errors, when accuracy degrades, when a deployment regresses. The fourth is the cost model - the per-call cost, the expected monthly volume, the cost variance scenarios.

I have inherited Language Service environments where none of these documents existed. The first 4 weeks of any handover go into rebuilding them from log analysis and Azure portal screenshots. That cost is purely organisational waste. Spend the 6-8 hours writing them up at the time you build the system; recover that time tenfold during the inevitable on-call shifts and audit cycles.

Monitoring that actually catches problems

The default Azure Monitor metrics for a Cognitive Services resource tell you how many requests succeeded or failed and the average latency. That is useful but not enough. The signals that matter for a Language Service deployment are: per-feature request rate, per-feature error rate broken down by HTTP status, per-call confidence-score distribution, per-class prediction-rate trends, and quota-utilisation against the resource's TPM limit.

I instrument every Language Service client with Application Insights custom events that capture the input length, output length, latency, feature kind, model version, and confidence scores. The result is a dashboard that catches three types of problem: traffic shifts (sudden input-length changes signal upstream pipeline bugs), model drift (per-class prediction-rate changes signal data drift), and quota exhaustion (a rate of 429 responses growing means I need to upgrade the SKU before users see failures). The instrumentation takes about 4 hours of engineering. It saves at least one production incident per quarter in my experience.

Where I draw the line on trust

I have shipped Azure AI Language Service features I would not let an automated decision system act on without a human in the loop. Sentiment analysis is one - I treat the result as a signal, not a fact. Custom classification is another - I treat predictions above 0.85 confidence as actionable for non-critical paths but never for irreversible actions like refund approval or account closure. PII detection is the one I trust most for purely-defensive use cases (redact before storage) because false-positives there are usually harmless.

The decision of where the human stays in the loop is the most important architectural choice in any AI-powered system. Get it right and the system handles 95% of cases automatically while humans focus on the 5% that matter. Get it wrong and you ship a system that either drowns humans in approvals or makes too many bad automated decisions. Talk this through with your legal, compliance, and operations teams before you ship - not after.

Things I check before declaring a Language Service feature production-ready

A feature is not production-ready until it passes a short checklist I have refined over the last 3 years of shipping these systems. The checklist is short on purpose - if it gets longer than a single screen, teams stop following it.

• Eval F1 on a held-out, never-seen-by-training test set is above the agreed business threshold. For most projects that threshold is 0.85 macro-F1; for compliance-sensitive use cases it is 0.92 or higher.
• Latency p95 under the agreed user-experience threshold. For interactive features I target sub-1.5 seconds. For async workflows I target sub-10 seconds.
• Error rate during a 1-week soak test under 0.5% with all errors logged and root-caused.
• Rollback path tested end-to-end. The team has executed a rollback at least once in a non-production environment within the last 90 days.
• Monitoring dashboard live in App Insights or Azure Monitor with the agreed thresholds and alert recipients.
• Runbook documented in the team wiki with the four standard sections - architecture, credentials, incident response, cost.
• Owner identified and documented. Every Language Service resource has exactly one named human owner, not a team alias.

If any of those is missing, the feature ships to staging only - never to production. I have shipped features that flunked one or two of these and regretted it within a quarter every time.

How I think about the build-vs-buy question

Azure AI Language Service is a managed-service answer to a class of problems that you could solve with open-source models on your own GPUs. The trade-off is real money against engineering effort. For a team with 2-3 senior ML engineers and ongoing model-ops capacity, building on Hugging Face Transformers with a fine-tuned distilbert-multilingual or XLM-R model costs roughly ₹4-6 lakh per month in GPU + storage + ops time, against ₹12-15 lakh per month for the equivalent Azure managed service.

The savings disappear once you account for on-call rotations, model drift detection, evaluation pipelines, A/B testing infrastructure, and the engineering time to maintain all of that. For teams with 4 or fewer ML engineers I almost always recommend the managed service. For teams with 20+ engineers and a mature ML platform, the open-source path wins on cost. Most teams I work with are in the 4-20 range where the right answer is to start with the managed service and revisit at the 12-month mark with real cost and performance data.

What the next 12 months look like

Microsoft has shipped Language Service updates roughly every 6-8 weeks throughout 2025 and 2026. The pattern I expect to continue: more languages added for the existing features, slow but steady extension of features to more regions, gradual deprecation of legacy LUIS-style surfaces, deeper integration with Microsoft Foundry as the workspace concept matures. The deprecation timelines have been generous - 12-month notice on the LUIS-to-CLU migration, similar for the older Text Analytics endpoints - but they do happen.

The skill that compounds over time is not memorising the current API surface. It is building the engineering muscle to evaluate, deploy, monitor, and replace AI components in production without disrupting the products built on top. The specific Language Service endpoints will change. The discipline of treating them as replaceable infrastructure pieces will not.

Caveats and what to double-check

• Role assignments can take 5-10 minutes to propagate. If your app gets a 403 right after a deploy, wait before re-deploying.
• Cross-tenant assignments need the target SP to be invited as a guest first. The role assignment fails silently otherwise.
• RBAC at the data-plane (project-level) is more restrictive than RBAC at the control-plane. Make sure you assign the right type of role for the operation you intend.
• Removing the Owner role from yourself is a common mistake that requires a Subscription Owner to unwind. Always assign yourself Owner via a group, not directly.

Related work in your environment

• Build an Entra security group for each role on each resource. Assign roles to the group; manage membership in the group. This scales.
• Set up Privileged Identity Management (PIM) for Owner-level roles. Just-in-time elevation prevents permanent-Owner accounts.
• Audit role assignments quarterly. The Azure activity log shows every role grant and revocation - export it to your SIEM.
• Document the RBAC matrix for every Language resource. Who can call inference, who can edit projects, who can delete. The matrix changes; the doc keeps it visible.

FAQ

Related fixes

Related guides worth a look while you sort this one out:

• Update role and rotate your subscription keys
• Assign the Cognitive Services User role to Azure Translator resource
• Basic service definition schema for a web role
• Basic service definition schema for a worker role
• Verify Azure Container Instance Service role assignments
• Validate identity permissions and role assignments