Table of Contents

Configure Management Portal Access

Learn how to grant and revoke access to the FoundationaLLM Management Portal for users, groups, and service principals.

Overview

Access to the Management Portal is controlled by role assignments on the Management Portal configuration scope. Assigning the Reader role on this scope lets a principal sign in to the portal. When you create an assignment with Scope set to Portal Access, the role list is limited to Reader.

Signing in does not grant permissions on resources. What a user can see and change inside the portal depends on their other role assignments. See Access Control.

Note: A Reader (or higher) role at the instance scope is inherited by the portal scope, so principals with instance-level roles can also sign in.

Portal Access Options

The Portal dropdown offers three portals:

Portal Scope
User Portal providers/FoundationaLLM.Configuration/appConfigurationSets/UserPortal
Management Portal providers/FoundationaLLM.Configuration/appConfigurationSets/ManagementPortal
Agent Portal providers/FoundationaLLM.Configuration/appConfigurationSets/AgentPortal

Prerequisites

  • Access to the Management Portal
  • Owner, User Access Administrator, or Role Based Access Control Administrator on the Management Portal scope (or on the instance)

Grant Management Portal Access

  1. In the sidebar, select Security > Access Control.
  2. In Scope, select Portal Access.
  3. In Portal, select Management Portal.
  4. Select Create Role Assignment.
  5. Next to Principal ID, select Browse.
  6. In the Browse Principals dialog, choose a Search type (User, Group, or ServicePrincipal), type part of the name in Search query, and pick the principal.
  7. Select Select.
  8. In the role list, select Reader.
  9. Select Create Role Assignment in the dialog footer.

The principal can now sign in to the Management Portal.

To grant access to a team, assign the Reader role to a Microsoft Entra security group. All members of the group can then sign in.

If a principal does not appear in search, select its Principal Type and paste its object ID in Principal ID. Principal Name and Principal Email are read-only and are filled in only when you use Browse.

Revoke Management Portal Access

  1. In the sidebar, select Security > Access Control.
  2. In Scope, select Portal Access.
  3. In Portal, select Management Portal.
  4. Find the assignment in the table. Hide inherited is selected by default; clear it to also see assignments inherited from the instance scope.
  5. Select the trash icon in the Delete column, and then select Yes.

Removing the portal assignment does not revoke access granted by a role at the instance scope. Use Check Access to find all the assignments that apply to a principal.

Troubleshooting

Issue Resolution
The user sees an access denied message Confirm the user, or a group the user belongs to, has Reader on the Management Portal scope or a role at the instance scope. Use Check Access to verify.
A group assignment does not apply Confirm the user is a member of the group in Microsoft Entra ID.
Roles other than Reader are not listed This is expected for Portal Access. Assign other roles at the Instance or Resource scope.
"You do not have permission to manage role assignments." You need Owner, User Access Administrator, or Role Based Access Control Administrator on the scope.