A developer's local Python app uses DefaultAzureCredential to connect to a Foundry…

How it works

The Foundry SDK prerequisites include a quick self-check: confirm that your local credential can request a Foundry access token, without displaying the token, by running az account get-access-token --resource https://ai.azure.com. If it works, you see the token expiration time.

The next step comes straight from the docs: if it fails, run az login with an identity that has the required Foundry role, then repeat the check. The troubleshooting section says the same for DefaultAzureCredential failed to retrieve a token: verify the CLI is authenticated, then confirm you have at least the Foundry User role on the project.

For day-to-day development, the role you need is Foundry User on the Foundry project, at the narrowest scope.

The other options, and when you'd use them

• A Cognitive Services role: Except for Cognitive Services Usages Reader, Microsoft says not to assign roles that start with Cognitive Services for Foundry. They don't apply to Foundry scenarios.
• Permanent Foundry Account Owner at the resource group: That assignment is only for when you need to create a Foundry resource. You activate it just in time through PIM and deactivate it after provisioning. Day-to-day developers don't need it.
• Foundry User for the project's managed identity: The check that failed is your local credential's token request. Fixing it means signing in with an identity that has the role, not granting the project's identity something.

Exam tip

Local token check fails = az login with an identity that holds Foundry User, then re-run az account get-access-token --resource https://ai.azure.com.

References

• Get started with Microsoft Foundry SDKs and endpoints - Microsoft Foundry
• Role-based access control for Microsoft Foundry