AI-103 Practice Question 42: Developer Role for Project
Microsoft Azure AI Apps and Agents Developer Associate (AI-103) · Test 5 · question 2 of 10
A retailer's platform team has already created a Foundry project and deployed the models it uses. A new developer joins to build and test prompt agents inside that project, nothing else. Security wants the narrowest built-in Azure role assigned to the developer's own account, not subscription Contributor.
Which role should the developer be assigned?
Show answer and explanation
Answer:
Foundry User is documented as the "least-privilege access role for developers building and testing agents": it grants reader access to the project and resource plus the data actions needed to build in the project, without granting project creation, role assignment, or model management rights.
- A is wrong despite the name. Microsoft's own guidance is explicit: "don't use the Azure AI Developer role for Foundry work. Despite the name, this role is scoped to Azure Machine Learning workspaces and Foundry hubs, not to Foundry projects or Foundry hosted agents." - C is wrong because Foundry Project Manager is broader than this developer needs; it can publish agents and conditionally assign the Foundry User role to other people. This developer only builds and tests; they don't manage the project. - D is wrong because Microsoft says not to assign roles that start with Cognitive Services for Foundry scenarios; those roles target Azure AI Services resources directly and don't map to Foundry project permissions.