[ ABORT TO HUD ]
SEQ. 1
SEQ. 2

RBAC & Identity Management

🔒 Enterprise Security 9 min 80 BASE XP⌨ HANDS-ON LAB

Access Control for AI Workloads

Azure RBAC controls who can do what at both Hub and Project levels:

Key Roles

RoleScopePermissions
OwnerHub / ProjectFull control including RBAC assignments
ContributorHub / ProjectCreate/manage resources, no RBAC
Azure AI UserProjectUse models, run agents (no infrastructure)
ReaderHub / ProjectView-only access

Best Practices

  • Principle of least privilege - Give developers "Azure AI User" at Project scope
  • Use Managed Identity - No API keys in code, auto-rotated credentials
  • Entra ID groups - Manage access via groups, not individual assignments
  • Separate Hub admins from Project users - Infrastructure ≠ Development
🚧 Important: Access is managed through Microsoft Entra ID (formerly Azure AD) and Managed Identities. This eliminates the need for hardcoded API keys and provides enterprise identity management.
⌨ HANDS-ON LABAssign Azure AI Developer Role to Service Principal
⭐ +150 XP

Grant least-privilege 'Azure AI Developer' RBAC role to CI/CD service principal on the Foundry project.

1Assign the Azure AI Developer role using az role assignment create.
lab-sandbox — simulated environment
INFINITY LAB SANDBOX v2.6 — simulated shell
Type the command for the current objective. Helpers: "hint", "solution", "clear".
$
OBJECTIVE 1 / 1 — type "hint" if stuck
FOUNDRY VERIFICATION
QUERY 1 // 1
What role should developers typically have for Foundry projects?
Owner
Contributor
Azure AI User at Project scope
Global Admin