Implement generative AI and agentic solutions 2.1 Build generative applications by using Foundry
You're setting up a new Foundry project.
Study guide skill: Configure an application to connect to a Foundry project
Question B6-019
You're setting up a new Foundry project. Developers will build and test agents, and the project's agents need to call models and tools by using the project's managed identity. Which two role assignments are the documented minimum to get started? (Choose two.)
Select 2 answers.
Answer: C, D
The minimum assignments are Foundry User on the Foundry resource for your user principal and for the project's managed identity; Foundry User is the least-privilege role for developers building and testing agents. The Azure AI Developer role is scoped to Azure Machine Learning workspaces and Foundry hubs, and roles that start with Cognitive Services don't apply to Foundry scenarios except Cognitive Services Usages Reader. Foundry Account Owner is a management role for creating projects and account-level resources.
Deep dive
How it works
Microsoft's RBAC page for Foundry has a section called Minimum role assignments to get started. It lists two assignments, so that both your user principal and the project's managed identity can reach Foundry features:
- Foundry User on your Foundry resource, assigned to your user principal.
- Foundry User on your Foundry resource, assigned to your project's managed identity.
Foundry User is described as the least-privilege access role for developers building and testing agents.
The roles were recently renamed. Foundry User, Foundry Owner, Foundry Account Owner and Foundry Project Manager used to be Azure AI User, Azure AI Owner, Azure AI Account Owner and Azure AI Project Manager.
The other options, and when you'd use them
- Foundry Account Owner for every developer: It grants full access to manage projects and resources. That's a management role, far beyond the minimum.
- Azure AI Developer on the project: Despite the name, this role is scoped to Azure Machine Learning workspaces and Foundry hubs, not to Foundry projects. Microsoft says not to use it for Foundry work.
- Cognitive Services OpenAI Contributor: Roles starting with Cognitive Services are for accessing AI Services resources directly and don't apply to Foundry scenarios. The one exception is Cognitive Services Usages Reader, for quota visibility.
Exam tip
Foundry minimum = Foundry User on the resource for you and for the project's managed identity. Not Azure AI Developer, and not Cognitive Services roles.
References
Last reviewed: