RBAC Setup for AI Solution Plays

Configure least-privilege Azure RBAC for AI workloads — OpenAI, AI Search, Storage, Cosmos DB — using managed identities, reusable Bicep modules, and environment-tiered permissions.

Common Role Reference Table

Managed Identity vs Service Principal

Always prefer managed identity for Azure-hosted workloads. Service principals are only for external CI/CD (GitHub Actions OIDC) or on-prem agents.

// System-assigned identity on Container Apps — no credential management
resource app 'Microsoft.App/containerApps@2024-03-01' = {
  name: appName
  identity: {
    type: 'SystemAssigned'
  }
  // ...
}

// User-assigned identity — share across multiple resources
resource uami 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
  name: 'id-${workloadName}-${env}'
  location: location
}

For GitHub Actions, use OIDC federated credentials — never store client secrets:

az ad app federated-credential create --id $APP_ID \
  --parameters '{"name":"gh-deploy","issuer":"https://token.actions.githubusercontent.com",
  "subject":"repo:org/repo:environment:production","audiences":["api://AzureADTokenExchange"]}'

Reusable Bicep Role Assignment Module

Create infra/modules/role-assignment.bicep — one module for all role grants:

@description('Principal ID of the managed identity or service principal')
param principalId string

@description('Role definition ID (GUID only, no full resource path)')
param roleDefinitionId string

@description('Target resource ID to scope the assignment to')
param resourceId string

@allowed(['ServicePrincipal', 'User', 'Group'])
param principalType string = 'ServicePrincipal'

// Deterministic name prevents duplicate assignments on redeploy
var assignmentName = guid(resourceId, roleDefinitionId, principalId)

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: assignmentName
  scope: resourceGroup()
  properties: {
    roleDefinitionId: subscriptionResourceId(
      'Microsoft.Authorization/roleDefinitions', roleDefinitionId)
    principalId: principalId
    principalType: principalType
  }
}

Wiring Role Assignments in main.bicep

// Grant app identity → OpenAI User on the Cognitive Services account
module appToOpenAI 'modules/role-assignment.bicep' = {
  name: 'rbac-app-openai-user'
  params: {
    principalId: app.identity.principalId
    roleDefinitionId: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd' // OpenAI User
    resourceId: cognitiveAccount.id
  }
}

// Grant app identity → Search Index Data Reader
module appToSearch 'modules/role-assignment.bicep' = {
  name: 'rbac-app-search-reader'
  params: {
    principalId: app.identity.principalId
    roleDefinitionId: '1407120a-92aa-4202-b7e9-c0e197c71c8f' // Search Index Data Reader
    resourceId: searchService.id
  }
}

// Grant app identity → Storage Blob Data Reader
module appToBlob 'modules/role-assignment.bicep' = {
  name: 'rbac-app-blob-reader'
  params: {
    principalId: app.identity.principalId
    roleDefinitionId: '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1'
    resourceId: storageAccount.id
  }
}

// Grant indexer identity → Storage Blob Data Contributor + Search Index Data Contributor
module indexerToBlob 'modules/role-assignment.bicep' = {
  name: 'rbac-indexer-blob-contrib'
  params: {
    principalId: indexerIdentity.properties.principalId
    roleDefinitionId: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
    resourceId: storageAccount.id
  }
}

Environment-Specific RBAC Strategy

Implement with a Bicep parameter:

@allowed(['dev', 'staging', 'prod'])
param environment string

// Dev gets Blob Contributor; prod gets Blob Reader
var blobRoleId = environment == 'prod'
  ? '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1'  // Reader
  : 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'  // Contributor

Custom Role Definition

When built-in roles are too broad, create a scoped custom role:

resource customRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
  name: guid(subscription().id, 'fai-ai-app-reader')
  properties: {
    roleName: 'FAI AI App Reader'
    description: 'Read-only access to OpenAI completions and search queries'
    type: 'CustomRole'
    assignableScopes: [resourceGroup().id]
    permissions: [
      {
        actions: [
          'Microsoft.CognitiveServices/accounts/deployments/read'
          'Microsoft.Search/searchServices/indexes/read'
        ]
        dataActions: [
          'Microsoft.CognitiveServices/accounts/OpenAI/deployments/chat/completions/action'
          'Microsoft.Search/searchServices/indexes/documents/search/action'
        ]
        notActions: []
        notDataActions: []
      }
    ]
  }
}

RBAC Audit Script

Run after deployment to verify all assignments are correct:

#!/usr/bin/env bash
set -euo pipefail

RG="${1:?Usage: audit-rbac.sh <resource-group>}"

echo "=== RBAC Audit: $RG ==="

# List all role assignments in the resource group
az role assignment list --resource-group "$RG" \
  --query "[].{Principal:principalName, Role:roleDefinitionName, Scope:scope}" \
  -o table

# Check for overprivileged assignments (Owner/Contributor on prod)
OVERPRIVILEGED=$(az role assignment list --resource-group "$RG" \
  --query "[?roleDefinitionName=='Owner' || roleDefinitionName=='Contributor'].principalName" -o tsv)

if [ -n "$OVERPRIVILEGED" ]; then
  echo "⚠️  Overprivileged principals found:"
  echo "$OVERPRIVILEGED"
  exit 1
fi

# Verify managed identity assignments exist for required roles
REQUIRED_ROLES=("Cognitive Services OpenAI User" "Search Index Data Reader" "Storage Blob Data Reader")
for role in "${REQUIRED_ROLES[@]}"; do
  COUNT=$(az role assignment list --resource-group "$RG" \
    --query "[?roleDefinitionName=='$role'] | length(@)" -o tsv)
  if [ "$COUNT" -eq 0 ]; then
    echo "❌ Missing assignment: $role"
  else
    echo "✅ $role: $COUNT assignment(s)"
  fi
done

Troubleshooting Access Denied

Least Privilege Checklist

• [ ] App identity has only data-plane roles — never Owner/Contributor
• [ ] Indexer identity separated from app identity with write-scoped roles
• [ ] Dev team uses PIM (Privileged Identity Management) for elevated access
• [ ] No API keys — disableLocalAuth: true on OpenAI, Search, Cosmos, Storage
• [ ] Custom roles scoped to resource group, not subscription
• [ ] CI/CD uses OIDC federation — no stored secrets
• [ ] Role assignments use principalType: 'ServicePrincipal' to prevent name conflicts