Foundry User Permission

For a user to access resources protected by Microsoft Foundry through Power Omni, the Foundry User role must be assigned to that user's account in Azure.

This applies, for example, to users who will access an agent connected to a Microsoft Fabric Data Agent. In this type of integration, authentication is performed using the user's own identity in Microsoft Entra ID.

Microsoft recently renamed the Azure AI User role to Foundry User. While Azure is being updated, the previous name may still appear in some environments. The permissions and role ID remain the same.

Why is this permission required?

When a user accesses an agent through Power Omni, their identity may be used to authenticate the request in Azure and validate which resources they are allowed to access.

The Foundry User role grants the required read and data plane permissions so that the user can:

• access the Foundry resource and project;

• use already deployed models;

• interact with agents;

• execute inference requests;

• access project resources using their own Microsoft Entra ID identity.

Without this role assignment, Azure may block the request with authorization errors such as 403 - Access denied, even if the agent is configured correctly in Power Omni.

This role does not grant full administrative access. The user will not be able to manage the subscription, assign roles to other identities, or delete Azure resources.

Prerequisites

Before you begin, make sure that:

• The Microsoft Foundry resource and project have already been created;

• The users who will access the agent have accounts in Microsoft Entra ID;

• The users and resources involved are in the correct tenant;

• For Fabric integrations, the Foundry project and the Fabric Data Agent are in the same tenant;

• Your account has permission to create role assignments on the resource, such as Owner, User Access Administrator, or Role Based Access Control Administrator.

Step-by-step

1

Open the Microsoft Foundry resource

1. Access the Azure Portal.

2. In the search bar at the top, search for the Foundry resource used by Power Omni or its resource group.

3. Open the correct resource.

To follow the principle of least privilege, assign the role directly to the Foundry resource used by Power Omni. Avoid assigning the role at the entire subscription level unless necessary.

2

Access Control (IAM)

From the resource's side menu, select Access control (IAM).

3

Start a new role assignment

1. Click Add.

2. Select Add role assignment.

If this option is disabled, your account does not have permission to assign roles at this scope. In this case, ask an Azure administrator to perform the assignment.

4

Select the Foundry User role

1. On the Role tab, keep Job function roles selected.

2. In the search field, search for Foundry User.

3. If the role does not appear, search for Azure AI User, which is the previous name of the same role.

4. Select the role and click Next.

The official role ID is:

53ca6127-db72-4b80-b1b0-d745d6d5456d

You can use this ID to confirm that you have selected the correct role.

5

Select the user

On the Members tab:

1. Select User, group, or service principal.

2. Click Select members.

In the side panel:

1. Search for the group, user name, or user email address. Example: If you are using the Fabric connector, add the users who will access that agent.

2. Repeat the process to add additional users when necessary.

1. Confirm by clicking Select.

2. Click Next.

6

Review and complete the assignment

1. On the Review + assign tab, confirm:

   • Role: Foundry User or Azure AI User;

   • Member: Users or groups that will access the agents;

   • Scope: The correct Foundry resource.

2. Click Review + assign.

3. If the button remains available after the first confirmation, click it again to complete the assignment.

7

Permission propagation may take a few minutes. After that, ask the user to access Power Omni again and test the agent connected to the resource.

Common issues

The Foundry User role does not appear

Search for the previous name, Azure AI User. Microsoft is still completing the role name update across all portals and regions.

53ca6127-db72-4b80-b1b0-d745d6d5456d

The Add role assignment button is disabled

Your account does not have the Microsoft.Authorization/roleAssignments/write permission at the selected scope.

Ask a user with one of the following roles to create the assignment:

• Owner;

• User Access Administrator;

• Role Based Access Control Administrator.

The role assignment is visible, but Power Omni still receives an access error.

• Wait a few minutes for the role assignment to propagate.

• Confirm that the permission was assigned to the correct Foundry resource.

• If multiple Foundry resources are configured, repeat the role assignment for each required resource.

• Test the request through Power Omni again.