Microsoft Foundry Generative AI Chat App Practice Question 7: Foundry User Role Access
Microsoft Applied Skills: Develop a Generative AI Chat App Using the Microsoft Foundry SDK · Test 1 · question 7 of 10
A new developer joins the team, runs az login with the correct tenant, and runs the chat app. DefaultAzureCredential acquires a token, but every call to the project endpoint fails with an authorization error. Teammates running identical code succeed. The new developer currently holds only Reader on the Foundry resource. Applying least privilege, what should you do?
Show answer and explanation
Answer:
Acquiring a token proves authentication worked; the failure is authorization. The documented guidance is to hold the Azure RBAC role required for your task at the narrowest scope, and Foundry User on the Foundry project is the role for "day-to-day development." When onboarding teammates, the instruction is to assign them Foundry User because "this role provides the minimum permissions needed to build and test AI applications." Note that these roles were recently renamed, Foundry User was previously Azure AI User, so older material may show the old name.
- A is wrong because swapping to a key hides the problem rather than fixing access, and it works against the Entra ID authentication the project is set up for. Keys also can't be scoped per developer, so they undercut least privilege. - B is wrong because Foundry Account Owner is the elevated role for creating projects and managing account-level resources, and assigning it at subscription scope is far more privilege than a developer calling an existing project needs. - D is wrong because Cognitive Services Contributor is the role called for when you need to create and manage model deployments. The developer only needs to call an existing deployment, so it grants more than the task requires.
Reference: Create a project - Microsoft Foundry