AI-103: Developing AI Apps and Agents on Azure

By Microsoft · Question Mode

QuestionQ45

VerifiedPlan and manage an Azure AI solution

You have a Microsoft Foundry project that contains a model deployment, and an application calls that deployment by using the Azure OpenAI v1 API together with DefaultAzureCredential.

Developers at your company receive HTTP 403 errors when they send inference requests, even after they run az login.

You need to ensure that the developers can perform model inference, and the solution must follow the principle of least privilege.

Which role-based access control (RBAC) role should you assign to the developers?

Explanation

Cognitive Services OpenAI User is the built-in RBAC role that grants the data-plane permission required to perform inference calls (such as chat completions) against an Azure OpenAI/Foundry model deployment when authenticating with Microsoft Entra ID, for example via DefaultAzureCredential; it grants no control-plane management rights, which satisfies least privilege. Cognitive Services User grants access to other Cognitive Services data actions but not Azure OpenAI inference, Contributor grants broad resource-management permissions far beyond what is needed, and Cognitive Services Data Reader only allows reading metadata/configuration rather than invoking inference — none of these three resolve the 403 with a least-privilege assignment as directly as Cognitive Services OpenAI User.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!