"New Foundry" agent requires Azure AI User to chat

[BruunF]

We recently started receiving the following error whenever users try to message our agent deployed through the new Foundry experience:

"Authorization error encountered when processing your request with activityId=177603228, conversationId=ergsag--gI1@thread.v2. Please ensure that the user with objectId 06fdgagasd03dd8 has Microsoft.CognitiveServices/accounts/AIServices/agents/write action on the project ai_test-resource/ai_proj_test."

Granting the Azure AI User role to affected users resolves the issue and they can interact with the agent again.

However, this introduces a new problem: users with the Azure AI User role are also able to access ai.azure.com and delete the agent directly.

Our intention is for users to interact with the agent (e.g., via Copilot or another interface) without having direct management permissions over the agent resource itself.

Are we misunderstanding the required permission model here, or is there a recommended way to allow users to interact with an agent without granting them permissions that allow them to modify or delete it in Azure AI Foundry?

[Pl8tinium]

There is the foundry consumer role, that does exactly what you need.

https://learn.microsoft.com/en-us/azure/foundry/concepts/rbac-foundry?tabs=owner%2Cfoundry#:~:text=Description-,Foundry%20Agent%20Consumer,-Grants%20access%20to

Unfortunately, you can only assign it on the foundry level, not on the foundry project level nor on an individual agent level AFAIK

Thereby you lack the granularity to permit individual agent access