Table of Contents

FoundationaLLM Permissions Reference

This reference describes the FoundationaLLM role-based access control (RBAC) model: the built-in roles, the authorizable actions, the extra role requirements that some resource types enforce, and the special handling of the FoundationaLLM.Authorization resource provider.

Source files:

  • src/dotnet/Common/Constants/Data/RoleDefinitions.json (built-in roles)
  • src/dotnet/Common/Constants/Data/AuthorizableActions.json (authorizable actions)
  • src/dotnet/Common/Constants/Data/PolicyDefinitions.json and DefaultPolicyAssignments.json (policies)
  • src/dotnet/Common/Constants/ResourceProviders/*ResourceProviderMetadata.cs (role requirements per resource type)
  • src/dotnet/Authorization/ResourceProviders/AuthorizationResourceProviderService.cs (Authorization provider handling)

The C# constants under src/dotnet/Common/Templates/ are generated from the JSON files.

Overview

Concept Description
Authorizable action An operation on a resource type, written as {ResourceProvider}/{resourceType}/{operation}, for example FoundationaLLM.Agent/agents/write. Operations are read, write, and delete.
Role definition A named set of actions (actions) minus excluded actions (not_actions).
Role assignment Binds a security principal (user, group, or service principal) to a role at a scope.
Scope The instance (/instances/{instanceId}), a resource type (.../providers/{provider}/{type}), or a resource (.../providers/{provider}/{type}/{name}). Assignments are inherited by everything below the scope.
Policy assignment Binds a principal to a policy definition on a resource type (policy-based access control). See Policies.

Users receive the roles assigned to them directly and to the groups they belong to.

Action Patterns

Pattern Meaning Example role
* All actions on all resource providers Owner
*/read All read actions Reader
*/management/write write on the shared management resource type of every provider Resource Providers Administrator
FoundationaLLM.Authorization/* All actions of one resource provider User Access Administrator
FoundationaLLM.Quota/* All actions of one resource provider Quotas Contributor
FoundationaLLM.Agent/agents/read One action —

How Authorization Is Evaluated

For each request, the resource provider checks whether the caller's role assignments on the resource (or on a parent scope) allow the authorizable action. Some resource types add a role requirement to an operation:

  • Optional role ({operation}|{Role} in the metadata): if the action is not allowed by the caller's other assignments but the caller has this role, the caller can still create a resource that does not exist yet (or run the listed action, such as checkname). The role does not grant the action on existing resources. For example, Agents Contributor lets a user create new agents, and Prompts Contributor lets a user create new prompts.
  • Mandatory role ({operation}|{Role}!): the caller must have this role, regardless of any other assignment. Even Owner at the instance scope is denied without it. For example, all quota operations require Quotas Contributor.

When a user creates a resource, FoundationaLLM assigns them the Owner role on the new resource. This does not happen for Authorization resources, for subordinate resources, or for resource types that have a policy assignment.

Role Definitions

All built-in roles are assignable at any scope (assignable_scopes = /).

Role ID Description Actions
Owner 1301f8d4-3bea-4880-945f-315dbd2ddb46 Full access to manage all resources, including the ability to assign roles in FoundationaLLM RBAC. *
Contributor a9f0020f-6e3a-49bf-8d1d-35fd53058edf Full access to manage all resources without the possibility of assigning roles in FoundationaLLM RBAC. *; not: FoundationaLLM.Authorization/*/write, FoundationaLLM.Authorization/*/delete
Reader 00a53e72-f66e-4c03-8f81-7e885fd2eb35 View all resources without the possibility of making any changes. */read
User Access Administrator fb8e0fd0-f7e2-4957-89d6-19f44f7d6618 Manage access to FoundationaLLM resources. */read, FoundationaLLM.Authorization/*
Role Based Access Control Administrator 17ca4b59-3aee-497d-b43b-95dd7d916f99 Manage access to FoundationaLLM resources by assigning roles using FoundationaLLM RBAC. FoundationaLLM.Authorization/roleAssignments/read, .../write, .../delete; FoundationaLLM.Authorization/roleDefinitions/read; FoundationaLLM.Authorization/policyAssignments/read, .../write, .../delete; FoundationaLLM.Authorization/policyDefinitions/read
Security Principals Reader 6fbf9db9-8e0e-4337-be05-58a3d6f2eda3 Read security principals (users, groups, and service principals). FoundationaLLM.Authorization/securityPrincipals/read
Resource Providers Administrator 63b6cc4d-9e1c-4891-8201-cf58286ebfe6 Execute management actions on resource providers. */management/write
Agents Contributor 3f28aa77-a854-4aa7-ae11-ffda238275c9 Create new agents. FoundationaLLM.Agent/toolSets/read, FoundationaLLM.Agent/tools/read, FoundationaLLM.Agent/toolFamilies/read
Agent Access Tokens Contributor 8c5ea0d3-f5a1-4be5-90a7-a12921c45542 Create new agent access tokens. None (role requirement only)
Prompts Contributor 479e7b36-5965-4a7f-baf7-84e57be854aa Create new prompts. None (role requirement only)
Tools Reader 9599b446-a7a5-4cc3-a06a-5cf845e83187 Read tools, tool families, and tool sets. FoundationaLLM.Agent/tools/read, .../toolFamilies/read, .../toolSets/read
Tools Contributor 33e9200a-b6e3-4242-bb40-4d90abd92eea Change tools, tool families, and tool sets. read and write on FoundationaLLM.Agent/tools, toolFamilies, and toolSets
Data Sources Contributor 78ee11d9-6e6a-4adc-8c16-3613e7445113 Create new data sources. None (role requirement only)
Knowledge Sources Contributor 8eec6664-9abf-4beb-84f7-18d9c2917c7f Create new knowledge sources. None (role requirement only)
Knowledge Units Contributor 5f38b653-e3b7-47a8-8fde-e70ea9e4fa91 Create new knowledge units. None (role requirement only)
Vector Databases Contributor c026f070-abc2-4419-aed9-ec0676f81519 Create new vector databases. FoundationaLLM.Configuration/apiEndpointConfigurations/read
Data Pipelines Contributor 2da16a58-ed63-431a-b90e-9df32c2cae4a Create new data pipelines. FoundationaLLM.Configuration/apiEndpointConfigurations/read, FoundationaLLM.AIModel/aiModels/read, FoundationaLLM.Platform/plugins/read
Data Pipelines Execution Manager e959eecb-8edf-4442-b532-4990f9a1df2b Manage all aspects related to data pipeline runs. read on FoundationaLLM.DataSource/dataSources, FoundationaLLM.Configuration/apiEndpointConfigurations, FoundationaLLM.AIModel/aiModels, FoundationaLLM.Platform/pluginPackages, FoundationaLLM.Platform/plugins, FoundationaLLM.Vector/vectorDatabases; read and write on FoundationaLLM.DataPipeline/dataPipelines
Attachments Contributor 8e77fb6a-7a78-43e1-b628-d9e2285fe25a Upload attachments including uploading to Azure OpenAI file store. read and write on FoundationaLLM.Attachment/attachments, FoundationaLLM.AzureOpenAI/conversationMappings, FoundationaLLM.AzureOpenAI/fileMappings; read on FoundationaLLM.Configuration/apiEndpointConfigurations and FoundationaLLM.AIModel/aiModels
Conversations Contributor d0d21b90-5317-499a-9208-3a6cb71b84f9 Create and update conversations, including Azure OpenAI Assistants threads. read and write on FoundationaLLM.Conversation/conversations and FoundationaLLM.AzureOpenAI/conversationMappings; read on FoundationaLLM.Configuration/apiEndpointConfigurations and FoundationaLLM.AIModel/aiModels
Quotas Contributor 2529ca9f-9c8e-45dd-9421-685113c086ad Manage quota definitions and analyze quota metrics and events. FoundationaLLM.Quota/*
Analytics Reader f3ab7cdd-d0c3-43d1-84d7-7409305e0c4a Read analytics data composed across the Conversation, Context, and Telemetry domains. FoundationaLLM.Analytics/analytics/read, FoundationaLLM.Conversation/conversationAnalytics/read, FoundationaLLM.Context/contextAnalytics/read
Configuration Contributor 5dd9a1bb-c11b-4e2d-860c-690ec4e7bcd1 Change configuration settings. None (role requirement only)
Managed Deployments Admin 52193588-ce65-4415-a89d-38399ed481e6 Full access to read, manage, and delete managed endpoint deployments. read, write, and delete on FoundationaLLM.Platform/managedEndpointDeployments
Sandboxes Contributor a8f3e2d1-4c5b-6a7e-8f9d-0e1f2a3b4c5d Read, write, and delete own sandboxes. read, write, and delete on FoundationaLLM.Platform/sandboxes
Sandboxes Admin b9e4f3a2-5d6c-7b8e-9f0a-1b2c3d4e5f6a Read, manage, and delete all sandboxes and manage sandbox infrastructure. read, write, and delete on sandboxes, sandboxClasses, sandboxPolicies, sandboxConfigurations; read and write on sandboxNodePools; read on sandboxContainerImages (all under FoundationaLLM.Platform)

"None (role requirement only)" means the role grants no actions by itself. It takes effect through the role requirements in the next section.

Role Requirements by Resource Type

Resource type Operations Role Requirement
FoundationaLLM.Agent/agents Create or update, checkname Agents Contributor Optional
FoundationaLLM.Agent/agentTemplates create-new (create an agent from a template) Agents Contributor Optional
FoundationaLLM.Agent/agentFiles set-properties Data Pipelines Execution Manager Optional
FoundationaLLM.Agent/agentAccessTokens Create or update Agent Access Tokens Contributor Mandatory
FoundationaLLM.Agent/agentTasks, agentTaskRuns Create or update Conversations Contributor Mandatory
FoundationaLLM.Agent/tools, toolFamilies, toolSets Create or update, checkname Tools Contributor Mandatory
FoundationaLLM.AIModel/aiModels Get, filter Agents Contributor Optional
FoundationaLLM.Configuration/appConfigurations Create or update Configuration Contributor Mandatory
FoundationaLLM.Context/knowledgeUnits Create or update, checkname, check-vector-store-id, set-graph Knowledge Units Contributor Optional
FoundationaLLM.Context/knowledgeSources Create or update, checkname Knowledge Sources Contributor Optional
FoundationaLLM.DataSource/dataSources Create or update, checkname Data Sources Contributor Optional
FoundationaLLM.DataPipeline/dataPipelines Create or update Data Pipelines Contributor Mandatory
FoundationaLLM.DataPipeline/dataPipelines checkname Data Pipelines Contributor Optional
FoundationaLLM.Prompt/prompts Get, create or update, checkname Prompts Contributor Optional
FoundationaLLM.Vector/vectorDatabases Create or update, checkname Vector Databases Contributor Optional
FoundationaLLM.Quota/quotas, quotaMetrics, quotaEvents All operations Quotas Contributor Mandatory
FoundationaLLM.Analytics/analytics query Analytics Reader Mandatory
FoundationaLLM.Conversation/conversationAnalytics query Analytics Reader Mandatory
FoundationaLLM.Context/contextAnalytics query Analytics Reader Mandatory
FoundationaLLM.Platform/managedEndpointDeployments All operations Managed Deployments Admin Mandatory
FoundationaLLM.Platform/sandboxClasses, sandboxPolicies Get, create or update, delete Sandboxes Admin Mandatory
FoundationaLLM.Platform/sandboxConfigurations Create or update, delete Sandboxes Admin Mandatory
FoundationaLLM.Platform/sandboxContainerImages filter, get-properties Sandboxes Admin Mandatory
FoundationaLLM.Platform/sandboxNodePools Get, create or update, get-capacity, set-autoscaler, set-default Sandboxes Admin Mandatory
FoundationaLLM.Authorization/roleAssignments check-access (evaluated at the instance scope) Role Based Access Control Administrator Mandatory
{any provider}/management trigger-command Resource Providers Administrator Mandatory

Viewing data pipeline runs uses the dataPipelines/write action. A Reader role does not include that action, so Readers cannot open the runs list. Listing runs across all pipelines (Pipeline set to Any) requires the action at the instance scope. Saving a pipeline also requires the Data Pipelines Contributor role even when the caller is Owner of the pipeline.

Authorization Resource Provider

The FoundationaLLM.Authorization provider authorizes requests differently from other providers:

Resource type How requests are authorized
roleAssignments Against the scope of the role assignment, not the assignment itself. To create an assignment on .../agents/my-agent, the caller needs FoundationaLLM.Authorization/roleAssignments/write on that agent (or a parent scope). For delete, the provider loads the assignment to find its scope. A filter request at the instance scope is not rejected up front, so that users without permission to list all assignments can still retrieve their own.
policyAssignments Against the scope of the policy assignment, which must be a resource type path.
securityPrincipals Against the scope sent in the request payload, using FoundationaLLM.Authorization/securityPrincipals/read.
roleDefinitions Always readable by everyone.
policyDefinitions Standard authorization (FoundationaLLM.Authorization/policyDefinitions/read).
roleAssignments/check-access Requires the Role Based Access Control Administrator role at the instance scope.

As a result:

  • Owner, User Access Administrator, and Role Based Access Control Administrator can manage role and policy assignments on scopes they cover.
  • Contributor can read role assignments and security principals but cannot create or delete assignments.
  • Role Based Access Control Administrator does not include securityPrincipals/read. To search for principals in the Management Portal, combine it with Security Principals Reader or Reader.

Policies

FoundationaLLM includes one policy definition:

Policy ID Matching strategy
User Principal Name (UPN) match 00000000-0000-0000-0001-000000000001 Ownership by UPN match

Policies can be assigned only to resource types. A standard deployment assigns the UPN match policy to the deployment's user security group on these resource types: FoundationaLLM.Conversation/conversations, FoundationaLLM.Attachment/attachments, FoundationaLLM.AzureOpenAI/conversationMappings, FoundationaLLM.AzureOpenAI/fileMappings, FoundationaLLM.User/userProfiles, FoundationaLLM.Platform/sandboxes, and FoundationaLLM.Context/memories.

With the policy assigned, members of the group can work with their own resources of that type without a role assignment on each resource. The resource providers for these types require the UPN match policy to load resources and allow only one policy definition per resource type.

Management Commands

Every resource provider has a shared management resource type for provider-level commands:

POST /instances/{instanceId}/providers/{resourceProvider}/management/trigger-command

The trigger-command action requires the Resource Providers Administrator role (mandatory), which also grants */management/write. Owner and Contributor cannot trigger management commands without this role.

Authorizable Actions

FoundationaLLM.Agent

Resource type Operations
agents read, write, delete
workflows read, write, delete
tools read, write, delete
toolFamilies read, write, delete
toolSets read, write, delete
agentTemplates read, write, delete
agentTasks read, write, delete
management write

FoundationaLLM.AIModel

Resource type Operations
aiModels read, write, delete
management write

FoundationaLLM.Analytics

Resource type Operations
analytics read
management write

FoundationaLLM.Attachment

Resource type Operations
attachments read, write, delete

FoundationaLLM.Authorization

Resource type Operations
roleAssignments read, write, delete
roleDefinitions read
policyAssignments read, write, delete
policyDefinitions read
securityPrincipals read
management write

FoundationaLLM.AzureAI

Resource type Operations
agentConversationMappings read, write, delete
agentFileMappings read, write, delete
projects read, write, delete
management write

FoundationaLLM.AzureOpenAI

Resource type Operations
conversationMappings read, write, delete
fileMappings read, write, delete
management write

FoundationaLLM.Configuration

Resource type Operations
appConfigurations read, write, delete
appConfigurationSets read
keyVaultSecrets read, write, delete
apiEndpointConfigurations read, write, delete
management write

FoundationaLLM.Context

Resource type Operations
knowledgeSources read, write, delete
knowledgeUnits read, write, delete
files read
fileOperations read
memories read, write, delete
contextAnalytics read
management write

FoundationaLLM.Conversation

Resource type Operations
conversations read, write, delete
conversationAnalytics read
management write

FoundationaLLM.DataPipeline

Resource type Operations
dataPipelines read, write, delete
management write

FoundationaLLM.DataSource

Resource type Operations
dataSources read, write, delete
management write

FoundationaLLM.Platform

Resource type Operations
artifactPackages read, write, delete
plugins read, write, delete
pluginPackages read, write, delete
logs read
managedEndpointDeployments read, write, delete
sandboxes read, write, delete
sandboxNodePools read, write
sandboxClasses read, write, delete
sandboxPolicies read, write, delete
sandboxConfigurations read, write, delete
sandboxContainerImages read
management write

FoundationaLLM.Prompt

Resource type Operations
prompts read, write, delete
management write

FoundationaLLM.Quota

Resource type Operations
quotas read, write, delete
quotaMetrics read
quotaEvents read, write
management write

FoundationaLLM.User

Resource type Operations
userProfiles read, write

FoundationaLLM.Vector

Resource type Operations
vectorDatabases read, write, delete
management write

FoundationaLLM.Vectorization (legacy)

AuthorizableActions.json still defines read, write, and delete actions for vectorizationPipelines, vectorizationRequests, contentSourceProfiles, textPartitioningProfiles, textEmbeddingProfiles, and indexingProfiles. The platform no longer includes a Vectorization resource provider; data pipelines replace it.

Maintenance Notes

When the RBAC model changes:

  1. Update AuthorizableActions.json for new actions and RoleDefinitions.json for new or changed roles, then re-run the T4 templates.
  2. Update *ResourceProviderMetadata.cs for role requirements on resource types.
  3. Update this reference.