Table of Contents

Configure Chat User Portal Access

Learn how to grant and revoke access to the FoundationaLLM Chat User Portal for users, groups, and service principals.

Overview

Access to the Chat User Portal is controlled by role assignments on the User Portal configuration scope. Assigning the Reader role on this scope lets a principal sign in to the Chat User Portal. When you create an assignment with Scope set to Portal Access, the role list is limited to Reader.

Signing in does not grant access to agents. Users also need access to the agents they use, for example through a role assignment on the agent or on the instance. See Access Control.

Note: A Reader (or higher) role at the instance scope is inherited by the portal scope, so principals with instance-level roles can also sign in.

Portal Access Options

The Portal dropdown offers three portals:

Portal Scope
User Portal (the Chat User Portal) providers/FoundationaLLM.Configuration/appConfigurationSets/UserPortal
Management Portal providers/FoundationaLLM.Configuration/appConfigurationSets/ManagementPortal
Agent Portal providers/FoundationaLLM.Configuration/appConfigurationSets/AgentPortal

To grant access to the Agent Portal, follow the steps below and select Agent Portal instead of User Portal.

Prerequisites

  • Access to the Management Portal
  • Owner, User Access Administrator, or Role Based Access Control Administrator on the User Portal scope (or on the instance)

Grant Chat User Portal Access

  1. In the Management Portal sidebar, select Security > Access Control.
  2. In Scope, select Portal Access.
  3. In Portal, select User Portal.
  4. Select Create Role Assignment.
  5. Next to Principal ID, select Browse.
  6. In the Browse Principals dialog, choose a Search type (User, Group, or ServicePrincipal), type part of the name in Search query, and pick the principal.
  7. Select Select.
  8. In the role list, select Reader.
  9. Select Create Role Assignment in the dialog footer.

The principal can now sign in to the Chat User Portal.

To grant access to a team, assign the Reader role to a Microsoft Entra security group. All members of the group can then sign in.

If a principal does not appear in search, select its Principal Type and paste its object ID in Principal ID. Principal Name and Principal Email are read-only and are filled in only when you use Browse.

Revoke Chat User Portal Access

  1. In the Management Portal sidebar, select Security > Access Control.
  2. In Scope, select Portal Access.
  3. In Portal, select User Portal.
  4. Find the assignment in the table. Hide inherited is selected by default; clear it to also see assignments inherited from the instance scope.
  5. Select the trash icon in the Delete column, and then select Yes.

Removing the portal assignment does not revoke access granted by a role at the instance scope. Use Check Access to find all the assignments that apply to a principal.

Troubleshooting

Issue Resolution
The user cannot sign in to the Chat User Portal Confirm the user, or a group the user belongs to, has Reader on the User Portal scope or a role at the instance scope. Use Check Access to verify.
The user can sign in but sees no agents Grant the user access to the agents, for example Reader on the agent.
A group assignment does not apply Confirm the user is a member of the group in Microsoft Entra ID.
Roles other than Reader are not listed This is expected for Portal Access. Assign other roles at the Instance or Resource scope.