RBAC & Identity Management — Enterprise Security
[ ABORT TO HUD ]
SEQ. 1
SEQ. 2
RBAC & Identity Management
Access Control for AI Workloads
Azure RBAC controls who can do what at both Hub and Project levels:
Key Roles
| Role | Scope | Permissions |
|---|---|---|
| Owner | Hub / Project | Full control including RBAC assignments |
| Contributor | Hub / Project | Create/manage resources, no RBAC |
Foundry User (formerly Azure AI User) | Project | Least-privilege developer role: use models, build/run agents & evaluations (no infra admin) |
| Foundry Project Manager | Account / Project | Create and manage child Foundry projects under a Foundry resource |
| Cognitive Services OpenAI User | Resource (Data Plane) | Keyless inference on Azure OpenAI deployments without control-plane management rights |
| Azure AI Developer | Hub / ML Workspace | Legacy developer role for classic Hub-based (Microsoft.MachineLearningServices) projects |
| Reader | Hub / Project | View-only access |
Best Practices
- Principle of least privilege - Assign developers Foundry User (formerly
Azure AI User) at Project scope, or Cognitive Services OpenAI User for inference-only workloads - Use Managed Identity - No API keys in code, auto-rotated credentials
- Entra ID groups - Manage access via groups, not individual assignments
- Separate Hub admins from Project users - Infrastructure ≠ Development
🚧 Important: Access is managed through Microsoft Entra ID (formerly Azure AD) and Managed Identities. This eliminates the need for hardcoded API keys and provides enterprise identity management.
⌨ HANDS-ON LABAssign Azure AI Developer Role to Service Principal
⭐ +150 XPGrant least-privilege 'Azure AI Developer' RBAC role to CI/CD service principal on the Foundry project.
1Assign the Azure AI Developer role using az role assignment create.
OBJECTIVE 1 / 1 — type "hint" if stuck
FOUNDRY VERIFICATION
QUERY 1 // 1
What role should developers typically have for Foundry projects?
Owner
Contributor
Foundry User (Azure AI User) at Project scope
Global Admin