Skip to content

Include Azure AI Project Manager and Azure AI Account Owner in developer RBAC role-assignment-write preflight #7808

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rajeshkamal5050 merged 3 commits into from
Apr 20, 2026
Merged

Include Azure AI Project Manager and Azure AI Account Owner in developer RBAC role-assignment-write preflight #7808

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
694b19f
Add Azure AI Project Manager to role-assignment-write preflight list
Copilot Apr 20, 2026
5bf7976
Add Azure AI Account Owner to role-assignment-write preflight list
Copilot Apr 20, 2026
c51d1de
Revert changelog, extension.yaml, and version.txt changes
Copilot Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ const (
// block Microsoft.Authorization/*/Write.
roleUserAccessAdministrator = "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9"
roleRBACAdministrator = "f58310d9-a9f6-439a-9e8d-f62e7b41a168"
roleAzureAIProjectManager = "eadc314b-1a2d-4efa-be10-5d325db5065e"
roleAzureAIAccountOwner = "e47c6f54-e4a2-4754-9501-8e0985b135e1"

// Classic ACR roles that grant push/build access.
roleAcrPush = "8311e382-0749-4cb8-b61a-304f252e45ec"
Expand Down Expand Up @@ -81,6 +83,8 @@ var sufficientRoleAssignWriteRoles = []string{
roleOwner,
roleUserAccessAdministrator,
roleRBACAdministrator,
roleAzureAIProjectManager,
roleAzureAIAccountOwner,
}

// CheckDeveloperRBAC verifies that the currently authenticated developer has the required
Expand Down Expand Up @@ -221,7 +225,9 @@ func CheckDeveloperRBAC(ctx context.Context, azdClient *azdext.AzdClient) error
"to your identity on the Foundry Project scope:\n"+
" • Owner\n"+
" • User Access Administrator\n"+
" • Role Based Access Control Administrator\n\n"+
" • Role Based Access Control Administrator\n"+
" • Azure AI Project Manager\n"+
" • Azure AI Account Owner\n\n"+
" az role assignment create --assignee %s "+
"--role \"Role Based Access Control Administrator\" --scope %q\n\n"+
"Alternatively, if role assignments are managed externally:\n"+
Expand Down
7 changes: 6 additions & 1 deletion cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,8 @@ func TestDeveloperRBACRoleConstants(t *testing.T) {
// Role-assignment write roles
assert.Equal(t, "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9", roleUserAccessAdministrator)
assert.Equal(t, "f58310d9-a9f6-439a-9e8d-f62e7b41a168", roleRBACAdministrator)
assert.Equal(t, "eadc314b-1a2d-4efa-be10-5d325db5065e", roleAzureAIProjectManager)
assert.Equal(t, "e47c6f54-e4a2-4754-9501-8e0985b135e1", roleAzureAIAccountOwner)

// AI roles
assert.Equal(t, "64702f94-c441-49e6-a78b-ef80e0188fee", roleAzureAIDeveloper)
Expand All @@ -64,10 +66,13 @@ func TestSufficientRoleLists(t *testing.T) {
assert.Contains(t, sufficientAIUserRoles, roleAzureAIUser)
assert.Contains(t, sufficientAIUserRoles, roleAzureAIDeveloper)

// Role-assignment write: Owner, UAA, RBAC Admin; Contributor must NOT be included.
// Role-assignment write: Owner, UAA, RBAC Admin, Azure AI Project Manager, Azure AI Account Owner;
// Contributor must NOT be included.
assert.Contains(t, sufficientRoleAssignWriteRoles, roleOwner)
assert.Contains(t, sufficientRoleAssignWriteRoles, roleUserAccessAdministrator)
assert.Contains(t, sufficientRoleAssignWriteRoles, roleRBACAdministrator)
assert.Contains(t, sufficientRoleAssignWriteRoles, roleAzureAIProjectManager)
assert.Contains(t, sufficientRoleAssignWriteRoles, roleAzureAIAccountOwner)
assert.NotContains(t, sufficientRoleAssignWriteRoles, roleContributor)

// ABAC ACR roles: Owner, RepositoryWriter, RepositoryContributor; AcrPush must NOT be included.
Expand Down
Loading