Skip to content

Update role assignment from 'Azure AI User' to 'Foundry User' #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
juliennyambal wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update role assignment from 'Azure AI User' to 'Foundry User' #42

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/04-automated-evaluation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -395,12 +395,12 @@ The evaluation script integrates with GitHub Actions to automatically run evalua

Save the `appId`, `tenant`, and `password` values from the output — you will use them in the next steps.

Assign the **Azure AI User** role so the service principal can call the Foundry project API:
Assign the **Foundry User** role so the service principal can call the Foundry project API:

```powershell
az role assignment create `
--assignee "<appId>" `
--role "Azure AI User" `
--role "Foundry User" `
--scope "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<ai-account-name>"
```

Expand Down Expand Up @@ -665,7 +665,7 @@ Create `experiments/automated/model_comparison.md` with:

**Resolution**:
- Run `az login` to refresh Azure credentials
- Verify the service principal has the **Azure AI User** role at the CognitiveServices account scope — this role has `Microsoft.CognitiveServices/*` wildcard data actions required for `AIServices/agents/write`. `Azure AI Developer` alone is **not sufficient**
- Verify the service principal has the **Foundry User** role at the CognitiveServices account scope — this role has `Microsoft.CognitiveServices/*` wildcard data actions required for `AIServices/agents/write`. `Azure AI Developer` alone is **not sufficient**
- Check `AZURE_AI_PROJECT_ENDPOINT` in `.env` file is correct and includes `/api/projects/<project>`

### OIDC login fails on PR workflows (`AADSTS700213`)
Expand Down