From 694b19f7d12116c50d0f95d071d31d1735f85f9b Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 20 Apr 2026 04:42:56 +0000 Subject: [PATCH 1/3] Add Azure AI Project Manager to role-assignment-write preflight list Agent-Logs-Url: https://github.com/Azure/azure-dev/sessions/89079973-998a-406d-a9c2-fe7581a550d8 Co-authored-by: ankitbko <3169316+ankitbko@users.noreply.github.com> --- cli/azd/extensions/azure.ai.agents/CHANGELOG.md | 4 ++++ cli/azd/extensions/azure.ai.agents/extension.yaml | 2 +- .../azure.ai.agents/internal/project/developer_rbac_check.go | 5 ++++- .../internal/project/developer_rbac_check_test.go | 4 +++- cli/azd/extensions/azure.ai.agents/version.txt | 2 +- 5 files changed, 13 insertions(+), 4 deletions(-) diff --git a/cli/azd/extensions/azure.ai.agents/CHANGELOG.md b/cli/azd/extensions/azure.ai.agents/CHANGELOG.md index 46dd2593b1c..312827860d9 100644 --- a/cli/azd/extensions/azure.ai.agents/CHANGELOG.md +++ b/cli/azd/extensions/azure.ai.agents/CHANGELOG.md @@ -1,5 +1,9 @@ # Release History +## 0.1.25-preview (2026-04-20) + +- Add `Azure AI Project Manager` to the list of roles that satisfy the developer role-assignment-write pre-flight check on the Foundry Project scope. + ## 0.1.24-preview (2026-04-17) - [[#7765]](https://github.com/Azure/azure-dev/pull/7765) Improve invalid manifest error messaging to guide users to check for a required `template` field. diff --git a/cli/azd/extensions/azure.ai.agents/extension.yaml b/cli/azd/extensions/azure.ai.agents/extension.yaml index ee7480a8c05..c8c06cd7b76 100644 --- a/cli/azd/extensions/azure.ai.agents/extension.yaml +++ b/cli/azd/extensions/azure.ai.agents/extension.yaml @@ -5,7 +5,7 @@ displayName: Foundry agents (Preview) description: Ship agents with Microsoft Foundry from your terminal. (Preview) usage: azd ai agent [options] # NOTE: Make sure version.txt is in sync with this version. -version: 0.1.24-preview +version: 0.1.25-preview requiredAzdVersion: ">1.23.13" language: go capabilities: diff --git a/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check.go b/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check.go index 926e4c8a8a6..15fb7f04da6 100644 --- a/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check.go +++ b/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check.go @@ -30,6 +30,7 @@ const ( // block Microsoft.Authorization/*/Write. roleUserAccessAdministrator = "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9" roleRBACAdministrator = "f58310d9-a9f6-439a-9e8d-f62e7b41a168" + roleAzureAIProjectManager = "eadc314b-1a2d-4efa-be10-5d325db5065e" // Classic ACR roles that grant push/build access. roleAcrPush = "8311e382-0749-4cb8-b61a-304f252e45ec" @@ -81,6 +82,7 @@ var sufficientRoleAssignWriteRoles = []string{ roleOwner, roleUserAccessAdministrator, roleRBACAdministrator, + roleAzureAIProjectManager, } // CheckDeveloperRBAC verifies that the currently authenticated developer has the required @@ -221,7 +223,8 @@ func CheckDeveloperRBAC(ctx context.Context, azdClient *azdext.AzdClient) error "to your identity on the Foundry Project scope:\n"+ " • Owner\n"+ " • User Access Administrator\n"+ - " • Role Based Access Control Administrator\n\n"+ + " • Role Based Access Control Administrator\n"+ + " • Azure AI Project Manager\n\n"+ " az role assignment create --assignee %s "+ "--role \"Role Based Access Control Administrator\" --scope %q\n\n"+ "Alternatively, if role assignments are managed externally:\n"+ diff --git a/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check_test.go b/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check_test.go index 9e0ca560e5c..2f03a61c722 100644 --- a/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check_test.go +++ b/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check_test.go @@ -46,6 +46,7 @@ func TestDeveloperRBACRoleConstants(t *testing.T) { // Role-assignment write roles assert.Equal(t, "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9", roleUserAccessAdministrator) assert.Equal(t, "f58310d9-a9f6-439a-9e8d-f62e7b41a168", roleRBACAdministrator) + assert.Equal(t, "eadc314b-1a2d-4efa-be10-5d325db5065e", roleAzureAIProjectManager) // AI roles assert.Equal(t, "64702f94-c441-49e6-a78b-ef80e0188fee", roleAzureAIDeveloper) @@ -64,10 +65,11 @@ func TestSufficientRoleLists(t *testing.T) { assert.Contains(t, sufficientAIUserRoles, roleAzureAIUser) assert.Contains(t, sufficientAIUserRoles, roleAzureAIDeveloper) - // Role-assignment write: Owner, UAA, RBAC Admin; Contributor must NOT be included. + // Role-assignment write: Owner, UAA, RBAC Admin, Azure AI Project Manager; Contributor must NOT be included. assert.Contains(t, sufficientRoleAssignWriteRoles, roleOwner) assert.Contains(t, sufficientRoleAssignWriteRoles, roleUserAccessAdministrator) assert.Contains(t, sufficientRoleAssignWriteRoles, roleRBACAdministrator) + assert.Contains(t, sufficientRoleAssignWriteRoles, roleAzureAIProjectManager) assert.NotContains(t, sufficientRoleAssignWriteRoles, roleContributor) // ABAC ACR roles: Owner, RepositoryWriter, RepositoryContributor; AcrPush must NOT be included. diff --git a/cli/azd/extensions/azure.ai.agents/version.txt b/cli/azd/extensions/azure.ai.agents/version.txt index 4bceb94e4be..2c21a72ec06 100644 --- a/cli/azd/extensions/azure.ai.agents/version.txt +++ b/cli/azd/extensions/azure.ai.agents/version.txt @@ -1 +1 @@ -0.1.24-preview +0.1.25-preview From 5bf79760fd670f75be1612ca38a8fe563fa58bf5 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 20 Apr 2026 05:00:18 +0000 Subject: [PATCH 2/3] Add Azure AI Account Owner to role-assignment-write preflight list Agent-Logs-Url: https://github.com/Azure/azure-dev/sessions/fe7b2283-2704-4e84-b294-74187b36333a Co-authored-by: ankitbko <3169316+ankitbko@users.noreply.github.com> --- cli/azd/extensions/azure.ai.agents/CHANGELOG.md | 2 +- .../azure.ai.agents/internal/project/developer_rbac_check.go | 5 ++++- .../internal/project/developer_rbac_check_test.go | 5 ++++- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/cli/azd/extensions/azure.ai.agents/CHANGELOG.md b/cli/azd/extensions/azure.ai.agents/CHANGELOG.md index 312827860d9..632ae60c452 100644 --- a/cli/azd/extensions/azure.ai.agents/CHANGELOG.md +++ b/cli/azd/extensions/azure.ai.agents/CHANGELOG.md @@ -2,7 +2,7 @@ ## 0.1.25-preview (2026-04-20) -- Add `Azure AI Project Manager` to the list of roles that satisfy the developer role-assignment-write pre-flight check on the Foundry Project scope. +- Add `Azure AI Project Manager` and `Azure AI Account Owner` to the list of roles that satisfy the developer role-assignment-write pre-flight check on the Foundry Project scope. ## 0.1.24-preview (2026-04-17) diff --git a/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check.go b/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check.go index 15fb7f04da6..76e483161f1 100644 --- a/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check.go +++ b/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check.go @@ -31,6 +31,7 @@ const ( roleUserAccessAdministrator = "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9" roleRBACAdministrator = "f58310d9-a9f6-439a-9e8d-f62e7b41a168" roleAzureAIProjectManager = "eadc314b-1a2d-4efa-be10-5d325db5065e" + roleAzureAIAccountOwner = "e47c6f54-e4a2-4754-9501-8e0985b135e1" // Classic ACR roles that grant push/build access. roleAcrPush = "8311e382-0749-4cb8-b61a-304f252e45ec" @@ -83,6 +84,7 @@ var sufficientRoleAssignWriteRoles = []string{ roleUserAccessAdministrator, roleRBACAdministrator, roleAzureAIProjectManager, + roleAzureAIAccountOwner, } // CheckDeveloperRBAC verifies that the currently authenticated developer has the required @@ -224,7 +226,8 @@ func CheckDeveloperRBAC(ctx context.Context, azdClient *azdext.AzdClient) error " • Owner\n"+ " • User Access Administrator\n"+ " • Role Based Access Control Administrator\n"+ - " • Azure AI Project Manager\n\n"+ + " • Azure AI Project Manager\n"+ + " • Azure AI Account Owner\n\n"+ " az role assignment create --assignee %s "+ "--role \"Role Based Access Control Administrator\" --scope %q\n\n"+ "Alternatively, if role assignments are managed externally:\n"+ diff --git a/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check_test.go b/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check_test.go index 2f03a61c722..b07c6b25005 100644 --- a/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check_test.go +++ b/cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check_test.go @@ -47,6 +47,7 @@ func TestDeveloperRBACRoleConstants(t *testing.T) { assert.Equal(t, "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9", roleUserAccessAdministrator) assert.Equal(t, "f58310d9-a9f6-439a-9e8d-f62e7b41a168", roleRBACAdministrator) assert.Equal(t, "eadc314b-1a2d-4efa-be10-5d325db5065e", roleAzureAIProjectManager) + assert.Equal(t, "e47c6f54-e4a2-4754-9501-8e0985b135e1", roleAzureAIAccountOwner) // AI roles assert.Equal(t, "64702f94-c441-49e6-a78b-ef80e0188fee", roleAzureAIDeveloper) @@ -65,11 +66,13 @@ func TestSufficientRoleLists(t *testing.T) { assert.Contains(t, sufficientAIUserRoles, roleAzureAIUser) assert.Contains(t, sufficientAIUserRoles, roleAzureAIDeveloper) - // Role-assignment write: Owner, UAA, RBAC Admin, Azure AI Project Manager; Contributor must NOT be included. + // Role-assignment write: Owner, UAA, RBAC Admin, Azure AI Project Manager, Azure AI Account Owner; + // Contributor must NOT be included. assert.Contains(t, sufficientRoleAssignWriteRoles, roleOwner) assert.Contains(t, sufficientRoleAssignWriteRoles, roleUserAccessAdministrator) assert.Contains(t, sufficientRoleAssignWriteRoles, roleRBACAdministrator) assert.Contains(t, sufficientRoleAssignWriteRoles, roleAzureAIProjectManager) + assert.Contains(t, sufficientRoleAssignWriteRoles, roleAzureAIAccountOwner) assert.NotContains(t, sufficientRoleAssignWriteRoles, roleContributor) // ABAC ACR roles: Owner, RepositoryWriter, RepositoryContributor; AcrPush must NOT be included. From c51d1de9cc4c3ff763ad076d3b46caaeb0ac6e8c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 20 Apr 2026 11:37:37 +0000 Subject: [PATCH 3/3] Revert changelog, extension.yaml, and version.txt changes Agent-Logs-Url: https://github.com/Azure/azure-dev/sessions/6871d403-3238-431a-bdff-5d6f7b64e349 Co-authored-by: ankitbko <3169316+ankitbko@users.noreply.github.com> --- cli/azd/extensions/azure.ai.agents/CHANGELOG.md | 4 ---- cli/azd/extensions/azure.ai.agents/extension.yaml | 2 +- cli/azd/extensions/azure.ai.agents/version.txt | 2 +- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/cli/azd/extensions/azure.ai.agents/CHANGELOG.md b/cli/azd/extensions/azure.ai.agents/CHANGELOG.md index 632ae60c452..46dd2593b1c 100644 --- a/cli/azd/extensions/azure.ai.agents/CHANGELOG.md +++ b/cli/azd/extensions/azure.ai.agents/CHANGELOG.md @@ -1,9 +1,5 @@ # Release History -## 0.1.25-preview (2026-04-20) - -- Add `Azure AI Project Manager` and `Azure AI Account Owner` to the list of roles that satisfy the developer role-assignment-write pre-flight check on the Foundry Project scope. - ## 0.1.24-preview (2026-04-17) - [[#7765]](https://github.com/Azure/azure-dev/pull/7765) Improve invalid manifest error messaging to guide users to check for a required `template` field. diff --git a/cli/azd/extensions/azure.ai.agents/extension.yaml b/cli/azd/extensions/azure.ai.agents/extension.yaml index c8c06cd7b76..ee7480a8c05 100644 --- a/cli/azd/extensions/azure.ai.agents/extension.yaml +++ b/cli/azd/extensions/azure.ai.agents/extension.yaml @@ -5,7 +5,7 @@ displayName: Foundry agents (Preview) description: Ship agents with Microsoft Foundry from your terminal. (Preview) usage: azd ai agent [options] # NOTE: Make sure version.txt is in sync with this version. -version: 0.1.25-preview +version: 0.1.24-preview requiredAzdVersion: ">1.23.13" language: go capabilities: diff --git a/cli/azd/extensions/azure.ai.agents/version.txt b/cli/azd/extensions/azure.ai.agents/version.txt index 2c21a72ec06..4bceb94e4be 100644 --- a/cli/azd/extensions/azure.ai.agents/version.txt +++ b/cli/azd/extensions/azure.ai.agents/version.txt @@ -1 +1 @@ -0.1.25-preview +0.1.24-preview