Access Control

Learn how to view, create, and delete role assignments for your FoundationaLLM instance, and how to check the effective access of a security principal.

Overview

FoundationaLLM uses role-based access control (RBAC). A role assignment binds a security principal (a user, a group, or a service principal) to a role at a scope. Assignments made at a broader scope are inherited by everything below it. For example, a Reader assignment at the instance scope grants read access to every resource in the instance.

The Access Control page (page title Role Assignments) lets you:

View role assignments at the instance scope, on a portal, or on a specific resource
Create and delete role assignments
Check all the role assignments that apply to a principal, including assignments inherited through group membership

For the list of built-in roles and the actions they grant, see the Permissions Reference.

Prerequisites

Access to the Management Portal
To create or delete role assignments, a role that grants FoundationaLLM.Authorization/roleAssignments/write and .../delete on the target scope: Owner, User Access Administrator, or Role Based Access Control Administrator. The Contributor role cannot manage role assignments.
To search for principals with Browse, read access to security principals, for example Reader or Security Principals Reader. Role Based Access Control Administrator does not include it.
To use Check Access, the Role Based Access Control Administrator role assigned at the instance scope. Other roles, including Owner, are not sufficient on their own.

Open the Access Control Page

Sign in to the Management Portal.
In the sidebar, select Security > Access Control.

The page opens with Scope set to Instance and shows the instance-level role assignments.

Choose a Scope

Use the Scope dropdown to choose which assignments to view and where new assignments are created.

Scope	Additional fields	What the table shows
Instance	None	All instance-level role assignments. The page shows "Viewing permissions for: Instance (all instance-level permissions)".
Portal Access	Portal: User Portal, Management Portal, or Agent Portal	Role assignments on the selected portal's configuration set. See Management Portal Access and Chat User Portal Access.
Resource	Resource Provider, Resource Type, Resource Name, and the View Permissions button	Role assignments that apply to one resource, for example a single agent.

View Permissions for a Resource

In Scope, select Resource.
In Resource Provider, select a provider, for example FoundationaLLM.Agent.
In Resource Type, select a type, for example agents.
In Resource Name, enter the resource name.
Select View Permissions (or press Enter in the Resource Name box).

The page builds the scope providers/{provider}/{type}/{name}, shows it under "Viewing permissions for:", and loads the table.

Resource Provider	Resource types
`FoundationaLLM.Agent`	`agents`, `agentTemplates`, `tools`, `workflows`
`FoundationaLLM.AIModel`	`aiModels`
`FoundationaLLM.Attachment`	`attachments`
`FoundationaLLM.Authorization`	`policyAssignments`, `policyDefinitions`, `roleAssignments`, `roleDefinitions`, `securityPrincipals`
`FoundationaLLM.AzureAI`	`agentConversationMappings`, `agentFileMappings`, `projects`
`FoundationaLLM.AzureOpenAI`	`conversationMappings`, `fileMappings`
`FoundationaLLM.Configuration`	`apiEndpointConfigurations`, `appConfigurations`, `appConfigurationSets`
`FoundationaLLM.Context`	`fileOperations`, `files`, `knowledgeSources`, `knowledgeUnits`, `memories`
`FoundationaLLM.Conversation`	`conversations`
`FoundationaLLM.DataPipeline`	`dataPipelines`
`FoundationaLLM.DataSource`	`dataSources`
`FoundationaLLM.Platform`	`packages`, `pluginPackages`, `plugins`
`FoundationaLLM.Prompt`	`prompts`
`FoundationaLLM.Vector`	`vectorDatabases`

Tip: Resources that support access control also have an Access Control button in their editor (for example, on the Security tab of the agent editor). It opens the same role assignments table and create form, already scoped to that resource.

Role Assignments Table

Assignments are grouped by role. Each group header shows the role name and an info icon; hover over or focus the icon to see the role description. Expand a group to see its assignments.

Column	Description
Name	The principal's display name, and email when available. An icon shows the principal type: a person for users, two people for groups, and a check badge for service principals.
Type	The principal type: `User`, `Group`, or `ServicePrincipal`.
Scope	Where the assignment is defined. Assignments made at a broader scope show as inherited, for example Instance (Inherited).
Delete	The trash icon that deletes the assignment.

The table toolbar has:

Hide inherited: hides assignments inherited from the instance scope. It is selected by default for Portal Access.
Filter by role: a multi-select list of the roles present in the table. Use it to show only selected roles.
Refresh (🔄): reloads the assignments.

Create a Role Assignment

Choose the scope where the assignment should be created (see Choose a Scope). For Resource, select View Permissions first; otherwise the dialog uses the instance scope. Check the read-only Scope field in the dialog before you save.
Select Create Role Assignment at the top right of the page.
In the Create Role Assignment dialog, fill in the fields below.
Select Create Role Assignment in the dialog footer.

Section	Field	Description
What is the assignment scope?	Scope	Read-only. Shows the selected scope, or Instance.
What is the description of the role assignment?	Data description	Optional. If you leave it empty, the portal fills it in as "{role} for {principal} on {scope}" after you pick the principal and role.
What principal to assign?	Principal Type	`User`, `Group`, or `ServicePrincipal`. Set automatically when you pick a principal with Browse.
	Principal Name, Principal Email	Read-only. Filled in when you pick a principal with Browse.
	Principal ID	The Microsoft Entra object ID. Select Browse to search, or paste an object ID.
What role to assign?	Role	The role to assign. For Portal Access, only Reader is available.

Find a Principal

Next to Principal ID, select Browse.
In the Browse Principals dialog, choose a Search type (User, Group, or ServicePrincipal).
Type part of the name in Search query and pick the principal from the results.
Select Select.

If you paste a Principal ID instead of browsing, also set Principal Type; the portal shows "Please specify a principal type." if it is missing.

Delete a Role Assignment

Find the assignment in the table.
Select the trash icon in the Delete column.
In the Delete Role Assignment dialog ("Are you sure you want to delete the role assignment for "{principal}"?"), select Yes.

Warning: Removing a role assignment takes effect immediately for the affected principal.

Check Access for a Principal

Check Access lists every role assignment that applies to a principal across the instance, including assignments the principal receives through group membership.

Select Check Access at the top right of the page.
In Principal type, select User, Group, or ServicePrincipal.
In Security principal, type part of the name and pick the principal.
Select Check Access.

The dialog shows a summary line with the principal name, its type, and the number of transitive groups it belongs to. The results table groups assignments by resource provider (Instance for instance-level assignments).

Column	Description
Scope	The scope of the assignment, relative to the resource provider. Filter by text.
Role	The role name. Filter by role.
Source	Direct for assignments made to the principal itself, or Via {group} for assignments inherited through a group. Filter by source.
Description	The role assignment description.

Select Close to close the dialog. If you do not have the required role, the portal shows "You must have the Role Based Access Control Administrator role at instance scope to check access."

Common Access Patterns

Goal	Role	Scope
Full administration, including access management	Owner	Instance
Manage resources without managing access	Contributor	Instance
Read-only access to everything	Reader	Instance
Delegate access management only	Role Based Access Control Administrator or User Access Administrator	Instance
Let a group create agents	Agents Contributor	Instance
Give a user access to one agent	Reader or Owner	Resource: `FoundationaLLM.Agent` / `agents` / agent name
Grant portal sign-in	Reader	Portal Access

Some areas require a dedicated role in addition to (or instead of) Owner: the Quotas pages require Quotas Contributor, the Analytics pages require Analytics Reader, and saving configuration settings requires Configuration Contributor. See the Permissions Reference.

Best Practices

Assign roles to groups. Use Microsoft Entra security groups for teams and assign roles to the groups rather than to individual users.
Apply least privilege. Prefer narrow scopes and specialized roles over instance-wide Owner or Contributor.
Review regularly. Use Check Access and the Filter by role option to audit who has which roles, and remove assignments that are no longer needed.

Troubleshooting

Issue	Resolution
A user cannot access an expected resource	Use Check Access to confirm the user (directly or through a group) has a role on the resource or on a parent scope.
"You do not have permission to manage role assignments."	You need Owner, User Access Administrator, or Role Based Access Control Administrator on the scope.
"You do not have permission to search for security principals."	You need read access to security principals on the scope, for example Reader or Security Principals Reader.
The table is empty for a resource	Confirm the provider, type, and name, then select View Permissions again. Clear Hide inherited to see inherited assignments.

Table of Contents