Access Control for AI Workloads
Azure RBAC controls who can do what at both Hub and Project levels:
Key Roles
| Role | Scope | Permissions |
|---|
| Owner | Hub / Project | Full control including RBAC assignments |
| Contributor | Hub / Project | Create/manage resources, no RBAC |
| Azure AI User | Project | Use models, run agents (no infrastructure) |
| Reader | Hub / Project | View-only access |
Best Practices
- Principle of least privilege — Give developers "Azure AI User" at Project scope
- Use Managed Identity — No API keys in code, auto-rotated credentials
- Entra ID groups — Manage access via groups, not individual assignments
- Separate Hub admins from Project users — Infrastructure ≠ Development
🚧 Important: Access is managed through Microsoft Entra ID (formerly Azure AD) and Managed Identities. This eliminates the need for hardcoded API keys and provides enterprise-grade identity management.