Microsoft Foundry — assign roles to the service principal¶

AI assets in Microsoft Foundry (agents, projects, model deployments, and related resources) are created under a Foundry resource. Projects and their assets live inside that resource. The Trust3 collector authenticates as the service principal created by your Entra app registration (using TRUST3_AZURE_CLIENT_ID, TRUST3_AZURE_CLIENT_SECRET, and TRUST3_AZURE_TENANT_ID) and must be granted Azure RBAC before it can discover those assets and, when monitoring is enabled, read agent telemetry.

For Entra app registration and client secret setup, see Microsoft Copilot Studio Prerequisites.

Resource hierarchy¶

1
2
3
4
5
6

Subscription
 └── Resource group
      └── Foundry resource          ← top-level Foundry boundary
           └── Foundry project(s)   ← where agents and workloads are organized
                ├── Assets           ← agents, deployments, connections, etc.
                └── Application Insights (connected)  ← traces / monitoring telemetry

Assign inventory roles at the Foundry resource scope so the collector can see assets across all projects in that resource. For monitoring, connect Application Insights on each Foundry project and grant Monitoring Reader on that Application Insights resource.

Required roles¶

Inventory¶

Grant the app’s service principal both roles on the Foundry resource:

Monitoring (Application Insights)¶

Required when Foundry monitoring / trace collection is enabled. Foundry stores agent traces in the Application Insights resource connected to each project. The collector needs read access to that telemetry.

Assign inventory roles in the Azure portal¶

You need permission to create role assignments (for example Owner or User Access Administrator) on the Foundry resource.

1. Open the Azure Portal.
2. Navigate to your Foundry resource (the parent resource that contains the projects whose assets Trust3 should collect).
3. Go to Access control (IAM).
4. Select Add → Add role assignment.
5. On the Role tab, search for and select Azure AI Developer and Foundry User.
6. On the Members tab:
7. Assign access to: User, group, or service principal
   • Select + Select members, search for your app registration name (for example Trust3-Integration), and select it.
8. Select Review + assign.
9. Repeat steps 4–7 for the other role so the service principal has both Azure AI Developer and Foundry User.

Connect Application Insights to each Foundry project¶

For monitoring, each Foundry project whose agents you want to monitor must have an Application Insights resource connected. Connect (or create) Application Insights once per project; agents in that project then send traces to the connected resource.

1. Sign in to Microsoft Foundry.
2. Open the Foundry project you want to monitor.
3. In the left navigation, select Agents.
4. At the top, select Traces.
5. Select Connect to create or connect an Application Insights resource:
6. To use an existing resource, select it and then select Connect.
   • To create a new resource, select Create new and complete the wizard.

Repeat for each Foundry project that Trust3 should monitor. Multiple projects may share one Application Insights resource, or each project may use its own—grant Monitoring Reader on every Application Insights resource that is connected to a monitored project.

Assign Monitoring Reader on Application Insights¶

Grant the Entra app’s service principal the Monitoring Reader role on the Application Insights resource connected to each monitored Foundry project.

You need permission to create role assignments (for example Owner or User Access Administrator) on the Application Insights resource.

1. Open the Azure Portal.
2. Navigate to the Application Insights resource connected to the Foundry project (from the project’s Traces connection, or from Connected resources in project details).
3. Go to Access control (IAM).
4. Select Add → Add role assignment.
5. On the Role tab, search for and select Monitoring Reader.
6. On the Members tab:
7. Assign access to: User, group, or service principal
   • Select + Select members, search for your app registration name (for example Trust3-Integration), and select it.
8. Select Review + assign.
9. Repeat for each Application Insights resource connected to a Foundry project that Trust3 monitors.

Verify access¶

After role assignment, allow 5–10 minutes for propagation, then confirm:

• On the Foundry resource, the service principal appears under Access control (IAM) → Role assignments with Azure AI Developer and Foundry User.
• For monitoring: each target project shows Application Insights connected under Agents → Traces, and the service principal has Monitoring Reader under Access control (IAM) → Role assignments on that Application Insights resource.

Read more:

• Role-based access control for Microsoft Foundry
• Authentication and authorization in Microsoft Foundry
• Quickstart: Set up Microsoft Foundry resources
• Set up tracing in Microsoft Foundry
• Monitoring Reader role