Policy Assignments
Learn how to view, create, and delete policy assignments on resource types.
Overview
In addition to role-based access control (RBAC), FoundationaLLM supports policy-based access control (PBAC). A policy assignment binds a security principal to a policy definition on a resource type. When a principal that is covered by the assignment accesses resources of that type, the resource provider enforces the policy.
Policies can only be assigned to resource types (for example, providers/FoundationaLLM.Conversation/conversations), not to individual resources.
FoundationaLLM includes one built-in policy definition:
| Policy | Description |
|---|---|
| User Principal Name (UPN) match | Defines ownership by a match on the User Principal Name (UPN). Principals covered by the assignment can work with the resources of that type that belong to their own UPN, without needing a role assignment on each resource. |
A standard deployment assigns the User Principal Name (UPN) match policy to the deployment's user security group on these resource types:
| Resource type | Resources |
|---|---|
FoundationaLLM.Conversation/conversations |
Conversations |
FoundationaLLM.Attachment/attachments |
Attachments |
FoundationaLLM.AzureOpenAI/conversationMappings |
Azure OpenAI conversation mappings |
FoundationaLLM.AzureOpenAI/fileMappings |
Azure OpenAI file mappings |
FoundationaLLM.User/userProfiles |
User profiles |
FoundationaLLM.Platform/sandboxes |
Sandboxes |
FoundationaLLM.Context/memories |
Personalized memories |
Prerequisites
- Access to the Management Portal
- To create or delete policy assignments, a role that grants
FoundationaLLM.Authorization/policyAssignments/writeand.../deleteon the resource type: Owner, User Access Administrator, or Role Based Access Control Administrator. The Contributor role cannot manage policy assignments.
Open the Policies Page
- Sign in to the Management Portal.
- In the sidebar, select Security > Policies.
The page (title Policy Assignments) shows the prompt "Select a resource provider and type to view its policy assignments." until you choose a resource type.
View Policy Assignments for a Resource Type
- In Resource Provider, select a provider.
- In Resource Type, select a type.
The page shows "Viewing policies for: {provider}/{type}" and loads the table.
| Resource Provider | Resource types |
|---|---|
FoundationaLLM.Agent |
agents, agentTasks, agentTemplates, tools, workflows |
FoundationaLLM.AIModel |
aiModels |
FoundationaLLM.Attachment |
attachments |
FoundationaLLM.Authorization |
policyAssignments, policyDefinitions, roleAssignments, roleDefinitions, securityPrincipals |
FoundationaLLM.AzureAI |
agentConversationMappings, agentFileMappings, projects |
FoundationaLLM.AzureOpenAI |
conversationMappings, fileMappings |
FoundationaLLM.Configuration |
apiEndpointConfigurations, appConfigurations, appConfigurationSets |
FoundationaLLM.Context |
fileOperations, files, knowledgeSources, knowledgeUnits, memories |
FoundationaLLM.Conversation |
conversations |
FoundationaLLM.DataPipeline |
dataPipelines |
FoundationaLLM.DataSource |
dataSources |
FoundationaLLM.Platform |
packages, pluginPackages, plugins, sandboxes, sandboxNodePools |
FoundationaLLM.Prompt |
prompts |
FoundationaLLM.User |
userProfiles |
FoundationaLLM.Vector |
vectorDatabases |
Note: Only resource types whose resource provider enforces the policy are affected by an assignment. The defaults listed in the Overview are the resource types that use the UPN match policy. These resource providers allow only one policy definition per resource type.
Policy Assignments Table
Assignments are grouped by policy. Each group header shows the policy name and an info icon; hover over the icon to see the policy description. Groups are expanded when the table loads.
| Column | Description |
|---|---|
| Name | The principal's display name, and email when available. An icon shows the principal type: a person for users, two people for groups, and a check badge for service principals. |
| Type | The principal type: User, Group, or ServicePrincipal. |
| Scope | Where the assignment is defined. |
| Delete | The trash icon that deletes the assignment. |
The table toolbar has a Hide inherited checkbox and a Refresh (🔄) button.
Create a Policy Assignment
The Create Policy Assignment button is enabled only after you select a resource provider and resource type.
- Select the resource provider and resource type.
- Select Create Policy Assignment at the top right of the page.
- In the Create Policy Assignment dialog, fill in the fields below.
- Select Create Policy Assignment in the dialog footer.
| Section | Field | Description |
|---|---|---|
| What is the assignment scope? | Scope (Resource Type Path) | Read-only. Shows the selected resource type path, for example providers/FoundationaLLM.Agent/agents. |
| What is the description of the policy assignment? | Description | Optional. If you leave it empty, the portal fills it in as "{policy} for {principal} on {scope}" after you pick the principal and policy. |
| What principal to assign? | Principal Type | User, Group, or ServicePrincipal. Set automatically when you pick a principal with Browse. |
| Principal Name, Principal Email | Read-only. Filled in when you pick a principal with Browse. | |
| Principal ID | The Microsoft Entra object ID. Select Browse to search, or paste an object ID. | |
| What policy to assign? | Policy | The policy definition to assign. |
To find a principal, select Browse, choose a Search type, type part of the name in Search query, pick the principal, and select Select.
Delete a Policy Assignment
- Find the assignment in the table.
- Select the trash icon in the Delete column.
- In the Delete Policy Assignment dialog ("Are you sure you want to delete the policy assignment for "{principal}"?"), select Yes.
Warning: The resource providers for the default resource types require the UPN match policy to load their resources. Deleting a default assignment can stop members of that group from accessing their own conversations, attachments, user profiles, sandboxes, or memories.
Troubleshooting
| Issue | Resolution |
|---|---|
| Create Policy Assignment is disabled | Select both a resource provider and a resource type. |
| "You do not have permission to manage policy assignments." | You need Owner, User Access Administrator, or Role Based Access Control Administrator on the resource type. |
| The policy has no effect | Confirm that the principal (or a group it belongs to) is the one in the assignment and that the resource type enforces the policy. |