feat: implement deployer-based role assignments in main.bicep and role.bicep

[UtkarshMishra-Microsoft]

Purpose

Added use of deployer() function
to capture the identity of the user running the deployment.

Introduced variables deployerInfo, deployingUserPrincipalId, and enableUserRoleAssignment in main.bicep.

Extended role.bicep to assign roles to the deployer on Azure OpenAI (Cognitive Services) accounts — covering both newly created and existing resources.

Updated Cosmos DB role assignments to include both the container app’s system-assigned MI and the deployer identity.

Added a configurable parameter principalType (User, ServicePrincipal, Group, etc.) instead of hard-coded ServicePrincipal.

Added outputs (deployerInfo, userRoleAssignmentStatus) for visibility of assigned roles and deployment status.

Why These Changes

Automation: Removes the need for manual az role assignment steps after deployment.

Flexibility: Works for different identity types (User, ServicePrincipal, Group).

Consistency: Ensures deployer gets the required access for both new and existing OpenAI/Cosmos DB resources.

Transparency: Clear outputs confirm who received access and whether assignment logic executed.

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information