Skip to content

Microsoft Foundry — assign roles to the service principal

AI assets in Microsoft Foundry (agents, projects, model deployments, and related resources) are created under a Foundry resource. Projects and their assets live inside that resource. The Trust3 collector authenticates as the service principal created by your Entra app registration (using AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID) and must be granted Azure RBAC on the Foundry resource before it can discover those assets.

For Entra app registration and client secret setup, see Azure Prerequisites.

Resource hierarchy

Text Only
1
2
3
4
5
Subscription
 └── Resource group
      └── Foundry resource          ← top-level Foundry boundary
           └── Foundry project(s)   ← where agents and workloads are organized
                └── Assets           ← agents, deployments, connections, etc.

Assign roles at the Foundry resource scope so the collector can see assets across all projects in that resource.

Required roles

Grant the app’s service principal both roles on the Foundry resource:

Role Scope Purpose
Azure AI Developer Foundry resource Data-plane and management access for AI development workloads in Foundry.
Foundry User Foundry resource Reader access to the Foundry resource and projects, plus data-plane read actions needed to list and inspect project assets.

Role rename

Microsoft recently renamed Foundry RBAC roles. Foundry User was previously Azure AI User. You may still see the old name in the portal during the rollout. The role definition ID is unchanged.

Assign roles in the Azure portal

You need permission to create role assignments (for example Owner or User Access Administrator) on the Foundry resource.

  1. Open the Azure Portal.
  2. Navigate to your Foundry resource (the parent resource that contains the projects whose assets Trust3 should collect).
  3. Go to Access control (IAM).
  4. Click Add → Add role assignment.
  5. On the Role tab, search for and select Azure AI Developer or Foundry User.
  6. On the Members tab:
    • Assign access to: User, group, or service principal
    • Click + Select members, search for your app registration name (for example Trust3-Integration), and select it.
  7. Click Review + assign.
  8. Repeat steps 4–7 for the other role so the service principal has both Azure AI Developer and Foundry User.

Verify access

After role assignment, allow 5–10 minutes for propagation, then confirm the service principal appears under Access control (IAM) → Role assignments on the Foundry resource with Azure AI Developer and Foundry User.

Read more: