> For the complete documentation index, see [llms.txt](https://docs.poweromni.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.poweromni.ai/en/foundry-user-permission.md).
# Foundry User Permission
For a user to access resources protected by Microsoft Foundry through Power Omni, the Foundry User role must be assigned to that user's account in Azure.
This applies, for example, to users who will access an agent connected to a **Microsoft Fabric Data Agent**. In this type of integration, authentication is performed using the user's own identity in Microsoft Entra ID.
{% hint style="warning" %}
Microsoft recently renamed the **Azure AI User** role to **Foundry User**. While Azure is being updated, the previous name may still appear in some environments. The permissions and role ID remain the same.
{% endhint %}
### Why is this permission required?
When a user accesses an agent through Power Omni, their identity may be used to authenticate the request in Azure and validate which resources they are allowed to access.
The **Foundry User** role grants the required read and data plane permissions so that the user can:
* access the Foundry resource and project;
* use already deployed models;
* interact with agents;
* execute inference requests;
* access project resources using their own Microsoft Entra ID identity.
Without this role assignment, Azure may block the request with authorization errors such as **403 - Access denied**, even if the agent is configured correctly in Power Omni.
This role does not grant full administrative access. The user will not be able to manage the subscription, assign roles to other identities, or delete Azure resources.
### Prerequisites
Before you begin, make sure that:
* The Microsoft Foundry resource and project have already been created;
* The users who will access the agent have accounts in Microsoft Entra ID;
* The users and resources involved are in the correct tenant;
* For Fabric integrations, the Foundry project and the Fabric Data Agent are in the same tenant;
* Your account has permission to create role assignments on the resource, such as **Owner**, **User Access Administrator**, or **Role Based Access Control Administrator**.
### Step-by-step
{% stepper %}
{% step %}
### Open the Microsoft Foundry resource
1. Access the [Azure Portal.](https://portal.azure.com/)
2. In the search bar at the top, search for the Foundry resource used by Power Omni or its resource group.
3. Open the correct resource.
{% hint style="info" %}
To follow the principle of least privilege, assign the role directly to the Foundry resource used by Power Omni. Avoid assigning the role at the entire subscription level unless necessary.
{% endhint %}
{% endstep %}
{% step %}
### Access Control (IAM)
From the resource's side menu, select **Access control (IAM)**.
{% endstep %}
{% step %}
### Start a new role assignment
1. Click **Add**.
2. Select **Add role assignment**.
If this option is disabled, your account does not have permission to assign roles at this scope. In this case, ask an Azure administrator to perform the assignment.
{% endstep %}
{% step %}
### Select the Foundry User role
1. On the **Role** tab, keep **Job function roles** selected.
2. In the search field, search for **Foundry User**.
3. If the role does not appear, search for **Azure AI User**, which is the previous name of the same role.
4. Select the role and click **Next**.
The official role ID is:
```
53ca6127-db72-4b80-b1b0-d745d6d5456d
```
You can use this ID to confirm that you have selected the correct role.
{% endstep %}
{% step %}
### Select the user
On the **Members** tab:
1. Select **User, group, or service principal**.
2. Click **Select members**.
In the side panel:
1. Search for the group, user name, or user email address.\
Example: If you are using the Fabric connector, add the users who will access that agent.
2. Repeat the process to add additional users when necessary.
3. Confirm by clicking **Select**.
4. Click **Next**.
{% endstep %}
{% step %}
### Review and complete the assignment
1. On the **Review + assign** tab, confirm:
* Role: **Foundry User** or **Azure AI User**;
* Member: Users or groups that will access the agents;
* Scope: The correct Foundry resource.
2. Click **Review + assign**.
3. If the button remains available after the first confirmation, click it again to complete the assignment.
{% endstep %}
{% step %}
{% hint style="info" %}
Permission propagation may take a few minutes. After that, ask the user to access Power Omni again and test the agent connected to the resource.
{% endhint %}
{% endstep %}
{% endstepper %}
### Common issues
The Foundry User role does not appear
Search for the previous name, **Azure AI User**. Microsoft is still completing the role name update across all portals and regions.
```
53ca6127-db72-4b80-b1b0-d745d6d5456d
```
The Add role assignment button is disabled
Your account does not have the `Microsoft.Authorization/roleAssignments/write` permission at the selected scope.
Ask a user with one of the following roles to create the assignment:
* **Owner**;
* **User Access Administrator**;
* **Role Based Access Control Administrator**.
The role assignment is visible, but Power Omni still receives an access error.
* Wait a few minutes for the role assignment to propagate.
* Confirm that the permission was assigned to the correct Foundry resource.
* If multiple Foundry resources are configured, repeat the role assignment for each required resource.
* Test the request through Power Omni again.
