Include Azure AI Project Manager and Azure AI Account Owner in developer RBAC role-assignment-write preflight#7808
Conversation
Agent-Logs-Url: https://github.com/Azure/azure-dev/sessions/89079973-998a-406d-a9c2-fe7581a550d8 Co-authored-by: ankitbko <3169316+ankitbko@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Updates the azure.ai.agents extension’s developer RBAC preflight so users with the Azure AI Project Manager built-in role don’t get false negatives when validating Microsoft.Authorization/roleAssignments/write permissions on the Foundry Project scope, and releases a new preview version containing the fix.
Changes:
- Add
roleAzureAIProjectManagerand include it in the “roleAssignments/write” sufficient role list and user-facing guidance. - Extend unit tests to assert the new role constant and list membership.
- Bump extension version to
0.1.25-previewand add release notes.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check.go | Adds Azure AI Project Manager role ID to the roleAssignments/write preflight allowlist and suggestion text. |
| cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check_test.go | Updates assertions to cover the new role constant and sufficient role list. |
| cli/azd/extensions/azure.ai.agents/version.txt | Bumps extension version to 0.1.25-preview. |
| cli/azd/extensions/azure.ai.agents/extension.yaml | Keeps extension manifest version in sync with version.txt. |
| cli/azd/extensions/azure.ai.agents/CHANGELOG.md | Adds 0.1.25-preview entry describing the RBAC preflight fix. |
Agent-Logs-Url: https://github.com/Azure/azure-dev/sessions/fe7b2283-2704-4e84-b294-74187b36333a Co-authored-by: ankitbko <3169316+ankitbko@users.noreply.github.com>
|
@copilot Can you remove the changelog and extension.yaml, and version. Text changes |
Agent-Logs-Url: https://github.com/Azure/azure-dev/sessions/6871d403-3238-431a-bdff-5d6f7b64e349 Co-authored-by: ankitbko <3169316+ankitbko@users.noreply.github.com>
|
/check-enforcer override |
📋 Prioritization NoteThanks for the contribution! The linked issue isn't in the current milestone yet. |
roleAzureAIProjectManagerconstant (eadc314b-1a2d-4efa-be10-5d325db5065e) indeveloper_rbac_check.goroleAzureAIAccountOwnerconstant (e47c6f54-e4a2-4754-9501-8e0985b135e1) indeveloper_rbac_check.gosufficientRoleAssignWriteRolesTestDeveloperRBACRoleConstants/TestSufficientRoleListsgo build+go testfor the extensionFixes #7812