Question
You have a Microsoft Foundry project that contains a model deployment.
You have an application that calls the deployment by using the Azure OpenAI v1 API and DefaultAzureCredential.
The developers at your company receive HTTP 403 errors when they send inference requests, even after running az login.
You need to ensure that the developers can perform model inference. The solution must follow the principle of least privilege.
Which role-based access control (RBAC) role should you assign to the developers?
- A. Cognitive Services User
- B. Cognitive Services OpenAI User Correct
- C. Contributor
- D. Cognitive Services Data Reader
Explanation
Signing in with az login only proves identity; the 403 means the identity lacks the data-plane permission to call the model. Cognitive Services OpenAI User allows inference API calls with Microsoft Entra ID without allowing changes to deployments or access to keys, so it meets least privilege. Contributor manages resources and does not grant inference data actions. Cognitive Services User is broader because it is not limited to Azure OpenAI, and Cognitive Services Data Reader is for reading data rather than running inference.
