[ ABORT TO HUD ]
SEQ. 1
SEQ. 2

RBAC & Identity Management

🔒 Enterprise Security 9 min 80 BASE XP

Access Control for AI Workloads

Azure RBAC controls who can do what at both Hub and Project levels:

Key Roles

RoleScopePermissions
OwnerHub / ProjectFull control including RBAC assignments
ContributorHub / ProjectCreate/manage resources, no RBAC
Azure AI UserProjectUse models, run agents (no infrastructure)
ReaderHub / ProjectView-only access

Best Practices

  • Principle of least privilege - Give developers "Azure AI User" at Project scope
  • Use Managed Identity - No API keys in code, auto-rotated credentials
  • Entra ID groups - Manage access via groups, not individual assignments
  • Separate Hub admins from Project users - Infrastructure ≠ Development
🚧 Important: Access is managed through Microsoft Entra ID (formerly Azure AD) and Managed Identities. This eliminates the need for hardcoded API keys and provides enterprise identity management.
FOUNDRY VERIFICATION
QUERY 1 // 1
What role should developers typically have for Foundry projects?
Owner
Contributor
Azure AI User at Project scope
Global Admin