Skip to main content

RBAC & Identity Management — Enterprise Security

[ ABORT TO HUD ]
SEQ. 1
SEQ. 2

RBAC & Identity Management

🔒 Enterprise Security 9 min 80 BASE XP⌨ HANDS-ON LAB

Access Control for AI Workloads

Azure RBAC controls who can do what at both Hub and Project levels:

Key Roles

RoleScopePermissions
OwnerHub / ProjectFull control including RBAC assignments
ContributorHub / ProjectCreate/manage resources, no RBAC
Foundry User (formerly Azure AI User)ProjectLeast-privilege developer role: use models, build/run agents & evaluations (no infra admin)
Foundry Project ManagerAccount / ProjectCreate and manage child Foundry projects under a Foundry resource
Cognitive Services OpenAI UserResource (Data Plane)Keyless inference on Azure OpenAI deployments without control-plane management rights
Azure AI DeveloperHub / ML WorkspaceLegacy developer role for classic Hub-based (Microsoft.MachineLearningServices) projects
ReaderHub / ProjectView-only access

Best Practices

  • Principle of least privilege - Assign developers Foundry User (formerly Azure AI User) at Project scope, or Cognitive Services OpenAI User for inference-only workloads
  • Use Managed Identity - No API keys in code, auto-rotated credentials
  • Entra ID groups - Manage access via groups, not individual assignments
  • Separate Hub admins from Project users - Infrastructure ≠ Development
🚧 Important: Access is managed through Microsoft Entra ID (formerly Azure AD) and Managed Identities. This eliminates the need for hardcoded API keys and provides enterprise identity management.
⌨ HANDS-ON LABAssign Azure AI Developer Role to Service Principal
⭐ +150 XP

Grant least-privilege 'Azure AI Developer' RBAC role to CI/CD service principal on the Foundry project.

1Assign the Azure AI Developer role using az role assignment create.
lab-sandbox — simulated environment
INFINITY LAB SANDBOX v2.6 — simulated shell
Type the command for the current objective. Helpers: "hint", "solution", "clear".
$
OBJECTIVE 1 / 1 — type "hint" if stuck
FOUNDRY VERIFICATION
QUERY 1 // 1
What role should developers typically have for Foundry projects?
Owner
Contributor
Foundry User (Azure AI User) at Project scope
Global Admin