AI-300 Practice Question 17: Agent Consumer Role
Microsoft Machine Learning Operations Engineer Associate (AI-300) · Test 2 · question 7 of 10
A Microsoft Foundry project hosts an agent that a line-of-business web application calls at runtime. The web app has its own managed identity. It only ever invokes the agent's endpoint: it never creates or edits agents, model deployments, connections, or role assignments. Which built-in role should you assign to the web app's managed identity?
Show answer and explanation
Answer:
Foundry Agent Consumer "grants access to interact with agent endpoints in a Foundry project" and is documented as the "least-privilege access role for principals that only need to interact with agents", an exact description of this web app (option A).
- B is wrong because Foundry User is the least-privilege role for a different audience: developers building and testing agents. It additionally grants reader access to the project and the Foundry resource plus the project's data actions, which is more than a caller needs. - C is wrong because Foundry Project Manager adds management actions on projects and the ability to conditionally assign the Foundry User role to others. A runtime caller that hands out role assignments is a privilege-escalation path, not least privilege. - D is wrong because Foundry Owner grants full access to manage projects and resources and is described as a highly privileged self-serve role. Assigning it to an application identity is the opposite of what the scenario asks for.