Merge pull request #3379 from fosteramanda/quickstart-permissions-fix

prmerger-automator[bot] · web-flow · commit 4bbe6378c7e2 · 2025-03-11T19:55:54.000Z
Quickstart permissions fix
diff --git a/articles/ai-services/agents/how-to/virtual-networks.md b/articles/ai-services/agents/how-to/virtual-networks.md
@@ -39,7 +39,10 @@ Azure AI Agent Service offers a standard agent configuration with private networ
 3. Ensure that the individual deploying the template has the [Azure AI Developer role](/azure/ai-studio/concepts/rbac-ai-studio) assigned at the resource group level where the template is being deployed.
 4. Additionally, to deploy the template, you need to have the preset [Role Based Access Administrator](/azure/role-based-access-control/built-in-roles/privileged#role-based-access-control-administrator) role at the subscription level.
     * The **Owner** role at the subscription level satisfies this requirement.
-    * The specific admin role that is needed is `Microsoft.Authorization/roleAssignments/write` 
+    * The specific admin role that is needed is `Microsoft.Authorization/roleAssignments/write`
+5. Ensure that each team member who wants to use the Agent Playground or SDK to create or edit agents has been assigned the built-in **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) for the project.
+    * Note: assign these roles after the template has been deployed
+    * The minimum set of permissions required is: **agents/*/read**, **agents/*/action**, **agents/*/delete**  
 5. Install [the Azure CLI and the machine learning extension](/azure/machine-learning/how-to-configure-cli). If you have the CLI already installed, make sure it's updated to the latest version.
 6. Register providers. The following providers must be registered:
     * `Microsoft.KeyVault`
@@ -286,4 +289,4 @@ with project_client:
 
 ## Next steps
 
-Once you've provisioned your agent, you can add tools such as [Grounding with Bing Search](./tools/bing-grounding.md) to enhance their capabilities.
+Once you've provisioned your agent, you can add tools such as [Grounding with Bing Search](./tools/bing-grounding.md) to enhance their capabilities.
diff --git a/articles/ai-services/agents/includes/quickstart-csharp.md b/articles/ai-services/agents/includes/quickstart-csharp.md
@@ -13,7 +13,13 @@ ms.date: 01/15/2025
 
 * An Azure subscription - [Create one for free](https://azure.microsoft.com/free/cognitive-services).
 * [The latest version of .NET](https://dotnet.microsoft.com/en-us/download)
-* Make sure you have the **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) assigned at the appropriate level.
+* Ensure that the individual deploying the template has the **Azure AI Developer** role assigned at the resource group level where the template is being deployed.
+* Additionally, to deploy the template, you need to have the preset **Role Based Access Administrator** role at the subscription level.
+   * The **Owner** role at the subscription level satisfies this requirement.
+   * The specific admin role that is needed is `Microsoft.Authorization/roleAssignments/write`
+* Ensure that each team member who wants to use the Agent Playground or SDK to create or edit agents has been assigned the built-in **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) for the project.
+    * Note: assign these roles after the template has been deployed
+    * The minimum set of permissions required is: **agents/*/read**, **agents/*/action**, **agents/*/delete**  
 * Install [the Azure CLI and the machine learning extension](/azure/machine-learning/how-to-configure-cli). If you have the CLI already installed, make sure it's updated to the latest version.
 
 [!INCLUDE [bicep-setup](bicep-setup.md)]
@@ -146,4 +152,4 @@ public class Sample_Agent
         }
     }
 }
-```
+```
diff --git a/articles/ai-services/agents/includes/quickstart-javascript.md b/articles/ai-services/agents/includes/quickstart-javascript.md
@@ -15,7 +15,13 @@ ms.custom: devx-track-js
 
 * An Azure subscription - [Create one for free](https://azure.microsoft.com/free/cognitive-services).
 * [Node.js LTS](https://nodejs.org/)
-* Make sure you have the **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) assigned at the appropriate level.
+* Ensure that the individual deploying the template has the **Azure AI Developer** role assigned at the resource group level where the template is being deployed.
+* Additionally, to deploy the template, you need to have the preset **Role Based Access Administrator** role at the subscription level.
+   * The **Owner** role at the subscription level satisfies this requirement.
+   * The specific admin role that is needed is `Microsoft.Authorization/roleAssignments/write`
+* Ensure that each team member who wants to use the Agent Playground or Agent SDK to create or edit agents has been assigned the built-in **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) for the project.
+    * Note: assign these roles after the template has been deployed
+    * The minimum set of permissions required is: **agents/*/read**, **agents/*/action**, **agents/*/delete**  
 * Install [the Azure CLI and the machine learning extension](/azure/machine-learning/how-to-configure-cli). If you have the CLI already installed, make sure it's updated to the latest version.
 
 [!INCLUDE [bicep-setup](bicep-setup.md)]
@@ -183,4 +189,4 @@ main().catch((err) => {
 });
 ```
 
-Run the code using `node index.js` and observe.
+Run the code using `node index.js` and observe.
diff --git a/articles/ai-services/agents/includes/quickstart-python-openai.md b/articles/ai-services/agents/includes/quickstart-python-openai.md
@@ -14,6 +14,10 @@ ms.date: 11/13/2024
 
 * An Azure subscription - [Create one for free](https://azure.microsoft.com/free/cognitive-services).
 * [Python 3.8 or later](https://www.python.org/)
+* Ensure that the individual deploying the template has the **Azure AI Developer** role assigned at the resource group level where the template is being deployed.
+* Additionally, to deploy the template, you need to have the preset **Role Based Access Administrator** role at the subscription level.
+   * The **Owner** role at the subscription level satisfies this requirement.
+   * The specific admin role that is needed is `Microsoft.Authorization/roleAssignments/write`
 * Make sure you have the **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) assigned at the appropriate level.
 * You need the **Cognitive Services OpenAI User** role assigned to use the Azure AI Services resource.
 * Install [the Azure CLI and the machine learning extension](/azure/machine-learning/how-to-configure-cli). If you have the CLI already installed, make sure it's updated to the latest version.
diff --git a/articles/ai-services/agents/includes/quickstart-python.md b/articles/ai-services/agents/includes/quickstart-python.md
@@ -14,7 +14,13 @@ ms.date: 11/13/2024
 
 * An Azure subscription - [Create one for free](https://azure.microsoft.com/free/cognitive-services).
 * [Python 3.8 or later](https://www.python.org/)
-* Make sure you have the **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) assigned at the appropriate level.
+* Ensure that the individual deploying the template has the **Azure AI Developer** role assigned at the resource group level where the template is being deployed.
+* Additionally, to deploy the template, you need to have the preset **Role Based Access Administrator** role at the subscription level.
+   * The **Owner** role at the subscription level satisfies this requirement.
+   * The specific admin role that is needed is `Microsoft.Authorization/roleAssignments/write`
+* Ensure that each team member who wants to use the Agent Playground or SDK to create or edit agents has been assigned the built-in **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) for the project.
+    * Note: assign these roles after the template has been deployed
+    * The minimum set of permissions required is: `agents/*/read`, `agents/*/action`, `agents/*/delete`
 * Install [the Azure CLI and the machine learning extension](/azure/machine-learning/how-to-configure-cli). If you have the CLI already installed, make sure it's updated to the latest version.
 
 [!INCLUDE [bicep-setup](bicep-setup.md)]
diff --git a/articles/ai-services/agents/includes/quickstart-rest.md b/articles/ai-services/agents/includes/quickstart-rest.md
@@ -11,7 +11,12 @@ ms.date: 02/15/2025
 ## Prerequisites
 
 * An Azure subscription - [Create one for free](https://azure.microsoft.com/free/cognitive-services).
-* Make sure you have the **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) assigned at the appropriate level.
+* Ensure that each team member who wants to use the Agent Playground or SDK to create or edit agents has been assigned the built-in **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) for the project.
+    * Note: assign these roles after the template has been deployed
+    * The minimum set of permissions required is: **agents/*/read**, **agents/*/action**, **agents/*/delete** 
+* Ensure that each team member who wants to use the Agent Playground or Agent SDK to create or edit agents has been assigned the built-in **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) for the project.
+    * Note: assign these roles after the template has been deployed
+    * The minimum set of permissions required is: **agents/*/read**, **agents/*/action**, **agents/*/delete**  
 * You need the **Cognitive Services OpenAI User** role assigned to use the Azure AI Services resource.
 * Install [the Azure CLI and the machine learning extension](/azure/machine-learning/how-to-configure-cli). If you have the CLI already installed, make sure it's updated to the latest version.
 
@@ -117,4 +122,4 @@ curl $AZURE_AI_AGENTS_ENDPOINT/threads/thread_abc123/runs/run_abc123?api-version
 ```console
 curl $AZURE_AI_AGENTS_ENDPOINT/threads/thread_abc123/messages?api-version=2024-12-01-preview \
   -H "Authorization: Bearer $AZURE_AI_AGENTS_TOKEN"
-```
+```
diff --git a/articles/ai-services/agents/includes/quickstart-typescript.md b/articles/ai-services/agents/includes/quickstart-typescript.md
@@ -16,6 +16,9 @@ ms.custom: devx-track-ts
 * An Azure subscription - [Create one for free](https://azure.microsoft.com/free/cognitive-services).
 * [Node.js LTS](https://nodejs.org/)
 * [TypeScript 5.x](https://www.typescriptlang.org/)
+* Ensure that each team member who wants to use the Agent Playground or SDK to create or edit agents has been assigned the built-in **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) for the project.
+    * Note: assign these roles after the template has been deployed
+    * The minimum set of permissions required is: **agents/*/read**, **agents/*/action**, **agents/*/delete** 
 * Make sure you have the **Azure AI Developer** [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) assigned at the appropriate level.
 * Install [the Azure CLI and the machine learning extension](/azure/machine-learning/how-to-configure-cli). If you have the CLI already installed, make sure it's updated to the latest version.
 

Original file line number	Diff line number	Diff line change
`@@ -13,7 +13,13 @@ ms.date: 01/15/2025`
`13`	`13`
`14`	`14`	`* An Azure subscription - [Create one for free](https://azure.microsoft.com/free/cognitive-services).`
`15`	`15`	`* [The latest version of .NET](https://dotnet.microsoft.com/en-us/download)`
`16`		`-* Make sure you have the Azure AI Developer [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) assigned at the appropriate level.`
	`16`	`+* Ensure that the individual deploying the template has the Azure AI Developer role assigned at the resource group level where the template is being deployed.`
	`17`	`+* Additionally, to deploy the template, you need to have the preset Role Based Access Administrator role at the subscription level.`
	`18`	`+ * The Owner role at the subscription level satisfies this requirement.`
	`19`	+ * The specific admin role that is needed is `Microsoft.Authorization/roleAssignments/write`
	`20`	`+* Ensure that each team member who wants to use the Agent Playground or SDK to create or edit agents has been assigned the built-in Azure AI Developer [RBAC role](../../../ai-studio/concepts/rbac-ai-studio.md) for the project.`
	`21`	`+ * Note: assign these roles after the template has been deployed`
	`22`	`+ * The minimum set of permissions required is: *agents//read, agents//action, agents//delete**`
`17`	`23`	`* Install [the Azure CLI and the machine learning extension](/azure/machine-learning/how-to-configure-cli). If you have the CLI already installed, make sure it's updated to the latest version.`
`18`	`24`
`19`	`25`	`[!INCLUDE [bicep-setup](bicep-setup.md)]`
`@@ -146,4 +152,4 @@ public class Sample_Agent`
`146`	`152`	`}`
`147`	`153`	`}`
`148`	`154`	`}`
`149`		-```
	`155`	+```