azure-aml-schedule-write
Principal can create or update job schedules that periodically trigger pipeline or training jobs on AML compute.
match (effective permission)
{
"action": "Microsoft.MachineLearningServices/workspaces/schedules/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Scheduler |
| source | <principal> |
| target | <AML job schedule> |
| permissions | Microsoft.MachineLearningServices/workspaces/schedules/write |
Narrative
{principal.name} can create or update AML job schedules (schedules/write) that repeatedly trigger training or pipeline jobs on compute as its managed identity.
Raw rule rules/explicit/azure-machinelearning.yaml
id: azure-aml-schedule-write
emits: CanSchedule
applies_to:
- azure
description: Principal can create or update job schedules that periodically trigger pipeline or training
jobs on AML compute.
match_effective_permission:
action: Microsoft.MachineLearningServices/workspaces/schedules/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Scheduler
source: <principal>
target: <AML job schedule>
permissions:
- Microsoft.MachineLearningServices/workspaces/schedules/write
api_source: role assignment evaluation
evidence_field: roleAssignments.properties.roleDefinitionId
note: Creates a cron/recurrence schedule that triggers a pipeline or command job; persistence + trigger
creation for repeated code execution as the compute MI.
false_positive_note: CanSchedule here is persistence / trigger creation only; onward CanExecuteAs still
requires the referenced compute to have a running (or auto-scalable) cluster and a MI. If the target
compute has no MI, scheduling provides code execution but not identity escalation.
narrative: '{principal.name} can create or update AML job schedules (schedules/write) that repeatedly
trigger training or pipeline jobs on compute as its managed identity.'