Skip to content

Commit ee218cc

Browse files
TaojunshenTaojunshen
authored
Merge pull request #6284 from MicrosoftDocs/repo_sync_working_branch
Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/azure-ai-docs (branch main)
2 parents 4b40d8b + ede1387 commit ee218cc

File tree

1 file changed

+16
-13
lines changed

1 file changed

+16
-13
lines changed

‎articles/ai-foundry/concepts/rbac-azure-ai-foundry.md

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -53,14 +53,14 @@ In addition to these built-in role assignments, there are the Azure Privileged a
5353

5454
Use the following table to help understand what privileges are given to each new built-in role, including the Azure Privileged Administrator roles:
5555

56-
| Built-in role | Create Foundry projects | Create Foundry accounts | Build and develop in a project (data actions) | Complete role-assignments | Reader access to projects and accounts |
57-
|--------------------------|-------------------------|--------------------------|-----------------------------------------------|---------------------------------------------------|-----------------------------------------|
58-
| **Azure AI User** | | | ✔ | | ✔ |
59-
| **Azure AI Project Manager** | ✔ | | ✔ | ✔ (only assign Azure AI User role) | ✔ |
60-
| **Azure AI Account Owner** | ✔ | ✔ | | ✔ (only assign Azure AI User role) | ✔ |
61-
| **Owner** | ✔ | ✔ | | ✔ (assign any role to any user) | ✔ |
62-
| **Contributor** | ✔ | ✔ | | | ✔ |
63-
| **Reader** | | | | | ✔ |
56+
| Built-in role | Create Foundry projects | Create Foundry accounts | Build and develop in a project (data actions) | Complete role-assignments | Reader access to projects and accounts | Manage models |
57+
|--------------------------|-------------------------|--------------------------|-----------------------------------------------|---------------------------------------------------|-----------------------------------------|-----------------------------------------|
58+
| **Azure AI User** | | | ✔ | | ✔ | |
59+
| **Azure AI Project Manager** | ✔ | | ✔ | ✔ (only assign Azure AI User role) | ✔ | |
60+
| **Azure AI Account Owner** | ✔ | ✔ | | ✔ (only assign Azure AI User role) | ✔ | ✔ |
61+
| **Owner** | ✔ | ✔ | | ✔ (assign any role to any user) | ✔ | ✔ |
62+
| **Contributor** | ✔ | ✔ | | | ✔ | ✔ |
63+
| **Reader** | | | | | ✔ | |
6464

6565

6666
## Default roles for the project
@@ -203,10 +203,13 @@ The following table is an example of how to set up role-based access control for
203203

204204
| Persona | Role | Purpose |
205205
|--------------------------|------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
206-
| IT admin | Subscription Owner | The IT admin can ensure the hub is set up to their enterprise standards. They can assign managers the **Azure AI Account Owner** role on the resource if they want to enable managers to make new Foundry accounts. They can assign managers the Azure AI Project Manager role on the resource to allow for project creation within an account. |
207-
| Managers | Azure AI Account Owner on Foundry resource | Managers can manage the hub, audit compute resources, audit connections, and create shared connections. They can't begin building within the projects, but can assign the Azure AI User role to themselves and others to start building. |
206+
| IT admin | Subscription Owner | The IT admin can ensure the foundry is set up to their enterprise standards. They can assign managers the **Azure AI Account Owner** role on the resource if they want to enable managers to make new Foundry accounts. They can assign managers the Azure AI Project Manager role on the resource to allow for project creation within an account. |
207+
| Managers | Azure AI Account Owner on Foundry resource | Managers can manage the foundry, deploy models, audit compute resources, audit connections, and create shared connections. They can't begin building within the projects, but can assign the Azure AI User role to themselves and others to start building. |
208208
| Team lead/Lead developer | Azure AI Project Manager on Foundry resource | Lead developers can create projects for their team and start building in the projects. After project creation, project owners can invite other members and assign the Azure AI User role. |
209-
| Team members/developers | Azure AI User on Foundry resource | Developers can build and deploy AI models within a project and build Agents. |
209+
| Team members/developers | Azure AI User on Foundry resource | Developers can build agents within a project. |
210+
211+
> [!IMPORTANT]
212+
> Users with the Contributor role can deploy models in Azure AI Foundry.
210213
211214
## Access to resources created outside of AI Foundry
212215

@@ -215,12 +218,12 @@ When you create a Foundry resource, the built-in role-based access control permi
215218
- The resource you're trying to use has permissions set up to allow you to access it.
216219
- Your Foundry account resource is allowed to access it.
217220

218-
For example, if you're trying to consume a new Blob storage, you need to ensure that the Foundry account resource's managed identity is added to the Blob Storage Reader role for the Blob. If you're trying to use a new Azure AI Search source, you might need to add the hub to the Azure AI Search's role assignments.
221+
For example, if you're trying to consume a new Blob storage, you need to ensure that the Foundry account resource's managed identity is added to the Blob Storage Reader role for the Blob. If you're trying to use a new Azure AI Search source, you might need to add the foundry to the Azure AI Search's role assignments.
219222

220223

221224
## Manage access with roles
222225

223-
If you're an owner of a Foundry account resource, you can add and remove roles for Azure AI Foundry. From the **Home** page in [Azure AI Foundry](https://ai.azure.com/?cid=learnDocs), select your Foundry resource. Then select **Users** to add and remove users for the hub. You can also manage permissions from the [Azure portal](https://portal.azure.com) under **Access Control (IAM)** or through the Azure CLI.
226+
If you're an owner of a Foundry account resource, you can add and remove roles for Azure AI Foundry. From the **Home** page in [Azure AI Foundry](https://ai.azure.com/?cid=learnDocs), select your Foundry resource. Then select **Users** to add and remove users for the foundry. You can also manage permissions from the [Azure portal](https://portal.azure.com) under **Access Control (IAM)** or through the Azure CLI.
224227

225228
For example, the following command assigns Azure AI User role to `[email protected]` for resource group `this-rg` in the subscription with an ID of `00000000-0000-0000-0000-000000000000`:
226229

0 commit comments

Comments
 (0)