Skip to content

Fix developer RBAC pre-flight gaps: auto-assign AI User, add role-write check, detect ABAC registries #7763

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
trangevi merged 7 commits into from
Apr 17, 2026
Merged

Fix developer RBAC pre-flight gaps: auto-assign AI User, add role-write check, detect ABAC registries #7763

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
aa8c86d
fix: update RBAC role constants and checks for Azure AI User and ACR …
therealjohn Apr 16, 2026
9c15131
fix: add ABAC to project terms in cspell configuration
therealjohn Apr 16, 2026
79ea99d
fix: standardize ACR role constant naming and update related tests
therealjohn Apr 16, 2026
e248ec4
fix: enhance ACR role checks and add support for resource ID resoluti…
therealjohn Apr 17, 2026
f710795
Pr comment
trangevi Apr 17, 2026
aa18b4f
Merge branch 'main' into fix-rbac-roles
trangevi Apr 17, 2026
36094e5
Linter
trangevi Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions cli/azd/extensions/azure.ai.agents/cspell.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ words:
- uaenorth
- uksouth
# Project terms
- ABAC
- ADLS
- agentserver
- aiservices
Expand Down
4 changes: 3 additions & 1 deletion cli/azd/extensions/azure.ai.agents/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,9 @@ require (
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0-beta.3
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v3 v3.0.0-beta.2
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/cognitiveservices/armcognitiveservices/v2 v2.0.0
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerregistry/armcontainerregistry v1.2.0
// armcontainerregistry v1.3.0-beta.3 is required for RoleAssignmentMode (ABAC detection).
// Upgrade to GA once the property is available in a stable release.
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerregistry/armcontainerregistry v1.3.0-beta.3
Comment thread
trangevi marked this conversation as resolved.
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions v1.3.0
github.com/azure/azure-dev/cli/azd v1.23.14
Expand Down
2 changes: 2 additions & 0 deletions cli/azd/extensions/azure.ai.agents/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/cognitiveservices/armcogni
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/cognitiveservices/armcognitiveservices/v2 v2.0.0/go.mod h1:twcwRey+l1znKBL5TEzYiZMtiVkWfM7Pq8a9vY04xYc=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerregistry/armcontainerregistry v1.2.0 h1:DWlwvVV5r/Wy1561nZ3wrpI1/vDIBRY/Wd1HWaRBZWA=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerregistry/armcontainerregistry v1.2.0/go.mod h1:E7ltexgRDmeJ0fJWv0D/HLwY2xbDdN+uv+X2uZtOx3w=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerregistry/armcontainerregistry v1.3.0-beta.3 h1:4qfc7os3wRQcl+ImfeH9z0abWJzuV9IGcN1B9olmPTU=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerregistry/armcontainerregistry v1.3.0-beta.3/go.mod h1:NlNAngH4e++mzPTN0+1EEvyUmwFmR91u/MQUVV230Z4=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0 h1:PTFGRSlMKCQelWwxUyYVEUqseBJVemLyqWJjvMyt0do=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0/go.mod h1:LRr2FzBTQlONPPa5HREE5+RjSCTXl7BwOvYOaWTqCaI=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.1.0 h1:2qsIIvxVT+uE6yrNldntJKlLRgxGbZ85kgtz5SNBhMw=
Expand Down
7 changes: 4 additions & 3 deletions cli/azd/extensions/azure.ai.agents/internal/exterrors/codes.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,9 +119,10 @@ const (

// Error codes for developer RBAC pre-flight checks.
const (
CodeDeveloperMissingAIUserRole = "developer_missing_ai_user_role"
CodeDeveloperMissingACRRole = "developer_missing_acr_role"
CodeACRResolutionFailed = "acr_resolution_failed"
CodeDeveloperMissingAIUserRole = "developer_missing_ai_user_role"
CodeDeveloperMissingRoleAssignWriteRole = "developer_missing_role_assign_write_role"
CodeDeveloperMissingACRRole = "developer_missing_acr_role"
CodeACRResolutionFailed = "acr_resolution_failed"
)

// Error codes commonly used for internal errors.
Expand Down
7 changes: 4 additions & 3 deletions cli/azd/extensions/azure.ai.agents/internal/project/agent_identity_rbac.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -332,6 +332,7 @@ func ensureSingleAgentRBAC(

created, err := assignRoleToIdentity(
ctx, cred, principalID, roleAzureAIUser, "Azure AI User → Foundry Project", info.ProjectScope,
armauthorization.PrincipalTypeServicePrincipal,
)
if err != nil {
return fmt.Errorf("failed to assign Azure AI User role: %w", err)
Expand Down Expand Up @@ -368,7 +369,7 @@ func discoverAgentIdentity(
return resp.Value, nil
}

// assignRoleToIdentity assigns a single RBAC role to a service principal at the given scope.
// assignRoleToIdentity assigns a single RBAC role to a principal at the given scope.
// It is idempotent: existing assignments are detected and skipped.
// Returns true if a new assignment was created, false if it already existed.
func assignRoleToIdentity(
Expand All @@ -378,6 +379,7 @@ func assignRoleToIdentity(
roleID string,
roleName string,
scope string,
principalType armauthorization.PrincipalType,
) (bool, error) {
subscriptionID := extractSubscriptionID(scope)
if subscriptionID == "" {
Expand Down Expand Up @@ -421,11 +423,10 @@ func assignRoleToIdentity(
return false, nil
}

// Create assignment with explicit ServicePrincipal type
// Create assignment
fullRoleDefinitionID := fmt.Sprintf(
"%s/providers/Microsoft.Authorization/roleDefinitions/%s", scope, roleID)
roleAssignmentName := uuid.New().String()
principalType := armauthorization.PrincipalTypeServicePrincipal
parameters := armauthorization.RoleAssignmentCreateParameters{
Properties: &armauthorization.RoleAssignmentProperties{
RoleDefinitionID: new(fullRoleDefinitionID),
Expand Down
Loading
Loading