AI-103 Practice Question 32: Published Agent Identity
Microsoft Azure AI Apps and Agents Developer Associate (AI-103) · Test 4 · question 2 of 10
A prompt agent works correctly in the agents playground, where it reads reference documents from a storage account through a configured tool. The team saves it as a version and publishes it as an agent application with a stable endpoint. Calls to the published endpoint now fail: the model responds, but the document tool returns an authorization error that never occurred during testing.
What is the most likely cause and fix?
Show answer and explanation
Answer:
This is called out as its own warning in the agent development lifecycle: "Permissions assigned to the project identity don't automatically transfer to the published agent. After publishing, reassign the necessary privileges to the agent application's identity." It appears again in the list of common pitfalls; publishing can require permission updates, and you should recheck resource access for the published identity afterwards and remove anything it no longer needs.
- B is wrong because agent versions are immutable by design; rolling back changes the configuration you run, not which identity the published application authenticates as. - C is wrong because the published agent runs under the agent application's identity, not the publisher's. Granting a human a broader role changes nothing at the endpoint. - D is wrong because tools must be successfully configured *before* you can save a version at all. Saving again reruns that check but never creates the missing role assignment on the storage account.