{"id":57984,"date":"2026-07-22T02:02:20","date_gmt":"2026-07-21T16:02:20","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/"},"modified":"2026-07-22T02:03:37","modified_gmt":"2026-07-21T16:03:37","slug":"secure-microsoft-foundry-projects-with-rbac-and-managed-identity","status":"publish","type":"post","link":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/","title":{"rendered":"Secure Microsoft Foundry Projects with RBAC and Managed Identity"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post Secure Microsoft Foundry Projects with RBAC and Managed Identity we will explain how to stop AI projects accumulating excessive access, shared credentials and unclear ownership as they move from testing into production.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">The high-level idea is simple. Role-based access control, or RBAC, decides who can perform an action and where they can perform it. Managed identities give Azure-hosted applications and projects their own secure login, without requiring your team to store passwords or API keys.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Used together, these controls help ensure that a finance assistant cannot quietly access HR files, a test project cannot modify production data, and a departing developer does not leave behind credentials that still work.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why Foundry access becomes difficult so quickly<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A single Microsoft Foundry proof of concept may involve only two developers and one model. Six months later, the same environment could contain multiple projects, agents, data connections, storage accounts and business teams.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The common response is to grant broad access whenever somebody encounters a permission error. That gets the project moving again, but it also creates a growing security and compliance problem.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Foundry separates resource management from runtime activity. In plain English, the permission to configure an Azure resource is different from the permission to read data, run a model or interact with an agent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This distinction matters because Azure Contributor access does not automatically provide every runtime permission. Conversely, a user who can run an agent should not necessarily be able to change networking, deploy models or assign access to other people.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The technology behind RBAC and managed identities<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">RBAC controls who can do what<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Azure RBAC is Microsoft Azure&#8217;s permission system. A role contains a set of allowed actions, while a scope defines where those actions apply.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Scopes can include an entire subscription, a resource group, a Foundry resource or an individual project. Permissions assigned at a higher level are generally inherited by the resources below it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Foundry provides roles for different responsibilities. For example, Foundry User supports normal development activity, while Foundry Agent Consumer is designed for people or applications that only need to interact with an existing agent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You may still see older names such as Azure AI User while Microsoft completes its role-name changes. The important point is to confirm the role&#8217;s permissions rather than relying on its label alone.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Managed identity replaces stored credentials<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A managed identity is a Microsoft Entra ID identity created for an Azure resource. Azure manages the underlying credentials and token renewal, so your team does not need to place passwords, client secrets or access keys in source code.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When a Foundry project needs to access Azure Storage, Azure AI Search or another service, its managed identity requests a short-lived access token. The target service checks the identity&#8217;s RBAC permissions before allowing the request.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Our guide to using managed identity in production and Azure CLI locally explains the broader passwordless pattern. Across Foundry projects, the next step is making sure every identity receives the correct role at the narrowest practical scope.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A practical access model for Foundry projects<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. Separate people, projects and agents<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Do not treat every identity as interchangeable. Your developers, project managed identity, deployment pipeline and individual agents may each require different access.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>People<\/strong> need access based on their job, preferably through Microsoft Entra security groups rather than individual assignments.<\/li>\n<li><strong>The project managed identity<\/strong> needs access to the Foundry resource and approved supporting services.<\/li>\n<li><strong>Deployment automation<\/strong> needs permission to create or update resources, but should not retain permanent administrator access.<\/li>\n<li><strong>Agent identities<\/strong> need only the permissions required for the tools and business systems they call.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This separation improves auditability. When an unusual action occurs, your security team can identify whether it came from a person, a project, a deployment process or an agent.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Make the project your normal access boundary<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Each Foundry project should represent a clear workload, team or environment. Development, testing and production should not share one large project simply because it is easier to set up.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Assigning Foundry User to a development group at the individual project scope limits what that team can reach. Granting the same role across the entire Foundry resource may unintentionally provide access to other projects.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There will be exceptions. Some older Foundry tools still require permissions at the parent resource level, so test the complete workload before finalising your access design.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The business outcome is containment. A mistake or compromised account in one project is less likely to affect every AI workload in the organisation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Grant data access to the project identity<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The project identity needs separate runtime permissions for the services it uses. For example, an agent that reads documents from an Azure Storage container may need Storage Blob Data Reader, while a process that writes files may require Storage Blob Data Contributor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Azure AI Search has similar distinctions between reading an index and creating or updating one. Standard agent deployments using your own Storage, Search and Cosmos DB services will require roles on each supporting resource.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A basic Azure CLI pattern looks like this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Grant the project identity access to its Foundry resource\naz role assignment create \\\n --assignee-object-id &quot;$PROJECT_MI_OBJECT_ID&quot; \\\n --assignee-principal-type ServicePrincipal \\\n --role &quot;Foundry User&quot; \\\n --scope &quot;$FOUNDRY_RESOURCE_ID&quot;\n\n# Allow the project to read and write approved blob data\naz role assignment create \\\n --assignee-object-id &quot;$PROJECT_MI_OBJECT_ID&quot; \\\n --assignee-principal-type ServicePrincipal \\\n --role &quot;Storage Blob Data Contributor&quot; \\\n --scope &quot;$PROJECT_STORAGE_ID&quot;\n\n# Give the development team access only to this project\naz role assignment create \\\n --assignee-object-id &quot;$DEVELOPER_GROUP_OBJECT_ID&quot; \\\n --assignee-principal-type Group \\\n --role &quot;Foundry User&quot; \\\n --scope &quot;$FOUNDRY_PROJECT_ID&quot;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Replace the example roles with the minimum permissions your workload requires. A query-only application should not receive write access just because Contributor removes a permission error.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Remove keys from production workflows<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">API keys are convenient during early testing, but possession of a key commonly grants broad access without identifying the individual user. Keys can also be copied into scripts, emails, configuration files and developer laptops.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use Microsoft Entra ID authentication and managed identities for production wherever the target service supports them. Store unavoidable third-party credentials in Azure Key Vault, which securely stores sensitive information, and allow only the required workload identity to retrieve them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This becomes especially important when agents connect to external services. Our articles on connecting Foundry agents to external A2A endpoints and connecting agents to business systems with MCP and OpenAPI cover those integration boundaries in more detail.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Automate assignments and review them regularly<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Manual role assignments are difficult to reproduce and easy to forget. Define projects, identities and role assignments through Bicep, Terraform or another approved infrastructure deployment process.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Record four items for every assignment: the identity, required action, target resource and scope. If the business owner cannot explain why an assignment exists, it should be investigated.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Review direct and inherited assignments for a project identity\naz role assignment list \\\n --assignee &quot;$PROJECT_MI_OBJECT_ID&quot; \\\n --all \\\n --include-inherited \\\n --output table<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Review production access quarterly and when people change roles. This supports the Essential Eight, the Australian government&#8217;s cybersecurity framework, particularly its focus on restricting administrative privileges and controlling access to sensitive systems.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What this looks like in a growing business<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a 200-person professional services company running separate Foundry projects for document review, customer support and internal HR assistance. Initially, every developer is given broad Contributor access and the projects share one storage account.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Under a safer model, developers receive project-level access through security groups. Each project identity receives access only to its own storage containers, search indexes and approved business systems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The HR agent cannot retrieve customer-support records. The customer agent cannot open employee documents. Deployment administrators retain elevated access only when needed, while normal users can interact with agents without being able to modify them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The result is not simply better security. Troubleshooting is faster, access reviews are clearer, employee changes are easier to manage, and the organisation has stronger evidence for customers, auditors and cyber insurers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Start with an access map before adding more agents<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">RBAC and managed identities are most effective when designed before dozens of projects exist. Start by mapping each project&#8217;s owners, users, runtime identity, data sources and external connections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then remove shared credentials, move assignments to the lowest practical scope and test both permitted and blocked actions. A successful security test should prove not only that the agent works, but also that it cannot reach data outside its responsibilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudProInc combines more than 20 years of enterprise IT experience with hands-on Microsoft Foundry, Azure and cybersecurity work. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations turn access-control theory into practical environments that teams can actually operate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are unsure whether your Foundry projects have accumulated excessive access, shared keys or unclear identities, we are happy to review the current setup and identify the highest-priority risks \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Learn how to control Microsoft Foundry access, remove stored credentials and give each AI project only the permissions it genuinely needs.<\/p>\n","protected":false},"author":1,"featured_media":57986,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_opengraph-title":"RBAC and Managed Identity for Secure Foundry Projects","_yoast_wpseo_opengraph-description":"Learn how RBAC and managed identity limit access, replace stored credentials and separate development, testing and production across secure AI projects.","_yoast_wpseo_twitter-title":"RBAC and Managed Identity for Secure Foundry Projects","_yoast_wpseo_twitter-description":"Learn how RBAC and managed identity limit access, replace stored credentials and separate development, testing and production across secure AI projects.","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[41,19,13,115],"tags":[],"class_list":["post-57984","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure-managed-identity","category-azure-security","category-blog","category-microsoft-ai-foundry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v28.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>RBAC and Managed Identity for Secure Foundry Projects<\/title>\n<meta name=\"description\" content=\"Learn how RBAC and managed identity limit access, replace stored credentials and separate development, testing and production across secure AI projects.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"RBAC and Managed Identity for Secure Foundry Projects\" \/>\n<meta property=\"og:description\" content=\"Learn how RBAC and managed identity limit access, replace stored credentials and separate development, testing and production across secure AI projects.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/\" \/>\n<meta property=\"og:site_name\" content=\"CPI Consulting\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-21T16:02:20+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-21T16:03:37+00:00\" \/>\n<meta name=\"author\" content=\"CPI Staff\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"RBAC and Managed Identity for Secure Foundry Projects\" \/>\n<meta name=\"twitter:description\" content=\"Learn how RBAC and managed identity limit access, replace stored credentials and separate development, testing and production across secure AI projects.\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"CPI Staff\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/\"},\"author\":{\"name\":\"CPI Staff\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#\\\/schema\\\/person\\\/192eeeb0ce91062126ce3822ae88fe6e\"},\"headline\":\"Secure Microsoft Foundry Projects with RBAC and Managed Identity\",\"datePublished\":\"2026-07-21T16:02:20+00:00\",\"dateModified\":\"2026-07-21T16:03:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/\"},\"wordCount\":1374,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/#primaryimage\"},\"thumbnailUrl\":\"\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity.png\",\"articleSection\":[\"Azure Managed-Identity\",\"Azure Security\",\"Blog\",\"Microsoft AI Foundry\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/\",\"url\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/\",\"name\":\"RBAC and Managed Identity for Secure Foundry Projects\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/#primaryimage\"},\"thumbnailUrl\":\"\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity.png\",\"datePublished\":\"2026-07-21T16:02:20+00:00\",\"dateModified\":\"2026-07-21T16:03:37+00:00\",\"description\":\"Learn how RBAC and managed identity limit access, replace stored credentials and separate development, testing and production across secure AI projects.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/#primaryimage\",\"url\":\"\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity.png\",\"contentUrl\":\"\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity.png\",\"width\":1536,\"height\":1024},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/07\\\/22\\\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Secure Microsoft Foundry Projects with RBAC and Managed Identity\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#website\",\"url\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/\",\"name\":\"Cloud Pro Inc - CPI Consulting Pty Ltd\",\"description\":\"Cloud, AI &amp; Cybersecurity Consulting | Melbourne\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#organization\",\"name\":\"Cloud Pro Inc - Cloud Pro Inc - CPI Consulting Pty Ltd\",\"url\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/favfinalfile.png\",\"contentUrl\":\"\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/favfinalfile.png\",\"width\":500,\"height\":500,\"caption\":\"Cloud Pro Inc - Cloud Pro Inc - CPI Consulting Pty Ltd\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/#\\\/schema\\\/person\\\/192eeeb0ce91062126ce3822ae88fe6e\",\"name\":\"CPI Staff\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g\",\"caption\":\"CPI Staff\"},\"sameAs\":[\"http:\\\/\\\/www.cloudproinc.com.au\"],\"url\":\"https:\\\/\\\/cloudproinc.azurewebsites.net\\\/index.php\\\/author\\\/cpiadmin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"RBAC and Managed Identity for Secure Foundry Projects","description":"Learn how RBAC and managed identity limit access, replace stored credentials and separate development, testing and production across secure AI projects.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/","og_locale":"en_US","og_type":"article","og_title":"RBAC and Managed Identity for Secure Foundry Projects","og_description":"Learn how RBAC and managed identity limit access, replace stored credentials and separate development, testing and production across secure AI projects.","og_url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/","og_site_name":"CPI Consulting","article_published_time":"2026-07-21T16:02:20+00:00","article_modified_time":"2026-07-21T16:03:37+00:00","author":"CPI Staff","twitter_card":"summary_large_image","twitter_title":"RBAC and Managed Identity for Secure Foundry Projects","twitter_description":"Learn how RBAC and managed identity limit access, replace stored credentials and separate development, testing and production across secure AI projects.","twitter_misc":{"Written by":"CPI Staff","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/#article","isPartOf":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/"},"author":{"name":"CPI Staff","@id":"https:\/\/www.cloudproinc.com.au\/#\/schema\/person\/192eeeb0ce91062126ce3822ae88fe6e"},"headline":"Secure Microsoft Foundry Projects with RBAC and Managed Identity","datePublished":"2026-07-21T16:02:20+00:00","dateModified":"2026-07-21T16:03:37+00:00","mainEntityOfPage":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/"},"wordCount":1374,"commentCount":0,"publisher":{"@id":"https:\/\/www.cloudproinc.com.au\/#organization"},"image":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/#primaryimage"},"thumbnailUrl":"\/wp-content\/uploads\/2026\/07\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity.png","articleSection":["Azure Managed-Identity","Azure Security","Blog","Microsoft AI Foundry"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/","url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/","name":"RBAC and Managed Identity for Secure Foundry Projects","isPartOf":{"@id":"https:\/\/www.cloudproinc.com.au\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/#primaryimage"},"image":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/#primaryimage"},"thumbnailUrl":"\/wp-content\/uploads\/2026\/07\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity.png","datePublished":"2026-07-21T16:02:20+00:00","dateModified":"2026-07-21T16:03:37+00:00","description":"Learn how RBAC and managed identity limit access, replace stored credentials and separate development, testing and production across secure AI projects.","breadcrumb":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/#primaryimage","url":"\/wp-content\/uploads\/2026\/07\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity.png","contentUrl":"\/wp-content\/uploads\/2026\/07\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity.png","width":1536,"height":1024},{"@type":"BreadcrumbList","@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/22\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.cloudproinc.com.au\/"},{"@type":"ListItem","position":2,"name":"Secure Microsoft Foundry Projects with RBAC and Managed Identity"}]},{"@type":"WebSite","@id":"https:\/\/www.cloudproinc.com.au\/#website","url":"https:\/\/www.cloudproinc.com.au\/","name":"Cloud Pro Inc - CPI Consulting Pty Ltd","description":"Cloud, AI &amp; Cybersecurity Consulting | Melbourne","publisher":{"@id":"https:\/\/www.cloudproinc.com.au\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cloudproinc.com.au\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.cloudproinc.com.au\/#organization","name":"Cloud Pro Inc - Cloud Pro Inc - CPI Consulting Pty Ltd","url":"https:\/\/www.cloudproinc.com.au\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudproinc.com.au\/#\/schema\/logo\/image\/","url":"\/wp-content\/uploads\/2022\/01\/favfinalfile.png","contentUrl":"\/wp-content\/uploads\/2022\/01\/favfinalfile.png","width":500,"height":500,"caption":"Cloud Pro Inc - Cloud Pro Inc - CPI Consulting Pty Ltd"},"image":{"@id":"https:\/\/www.cloudproinc.com.au\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.cloudproinc.com.au\/#\/schema\/person\/192eeeb0ce91062126ce3822ae88fe6e","name":"CPI Staff","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g","caption":"CPI Staff"},"sameAs":["http:\/\/www.cloudproinc.com.au"],"url":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/author\/cpiadmin\/"}]}},"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/07\/secure-microsoft-foundry-projects-with-rbac-and-managed-identity.png","jetpack-related-posts":[{"id":57297,"url":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/2026\/03\/17\/why-microsoft-ai-foundry-should-be-on-every-cios-vendor-evaluation-list-for-2026\/","url_meta":{"origin":57984,"position":0},"title":"Why Microsoft AI Foundry Should Be on Every CIO&#8217;s Vendor Evaluation List for 2026","author":"CPI Staff","date":"March 17, 2026","format":false,"excerpt":"Most mid-market Australian organisations are past the AI proof-of-concept stage. The models work. The board is asking for the next phase. And suddenly the questions nobody planned for are piling up. Where do the models run? Who approves new deployments? How does the organisation trace what an agent did when\u2026","rel":"","context":"In &quot;AI&quot;","block_context":{"text":"AI","link":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/category\/ai\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/03\/why-microsoft-ai-foundry-every-cios-vendor-evaluation-2026-cover.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/03\/why-microsoft-ai-foundry-every-cios-vendor-evaluation-2026-cover.png 1x, \/wp-content\/uploads\/2026\/03\/why-microsoft-ai-foundry-every-cios-vendor-evaluation-2026-cover.png 1.5x, \/wp-content\/uploads\/2026\/03\/why-microsoft-ai-foundry-every-cios-vendor-evaluation-2026-cover.png 2x, \/wp-content\/uploads\/2026\/03\/why-microsoft-ai-foundry-every-cios-vendor-evaluation-2026-cover.png 3x, \/wp-content\/uploads\/2026\/03\/why-microsoft-ai-foundry-every-cios-vendor-evaluation-2026-cover.png 4x"},"classes":[]},{"id":57288,"url":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/2026\/03\/22\/what-microsoft-ai-foundry-means-for-australian-organisations-designing-enterprise-ai-platforms\/","url_meta":{"origin":57984,"position":1},"title":"What Microsoft AI Foundry Means for Australian Organisations Designing Enterprise AI Platforms","author":"CPI Staff","date":"March 22, 2026","format":false,"excerpt":"Most Australian organisations that started building AI capabilities in the last two years are hitting the same wall. The proof of concept worked. The board approved the next phase. And now IT teams are drowning in questions nobody planned for. Where do the models run? Who approves new deployments? How\u2026","rel":"","context":"In &quot;AI&quot;","block_context":{"text":"AI","link":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/category\/ai\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/03\/microsoft-ai-foundry-australian-enterprise-ai-platforms-cover.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/03\/microsoft-ai-foundry-australian-enterprise-ai-platforms-cover.png 1x, \/wp-content\/uploads\/2026\/03\/microsoft-ai-foundry-australian-enterprise-ai-platforms-cover.png 1.5x, \/wp-content\/uploads\/2026\/03\/microsoft-ai-foundry-australian-enterprise-ai-platforms-cover.png 2x, \/wp-content\/uploads\/2026\/03\/microsoft-ai-foundry-australian-enterprise-ai-platforms-cover.png 3x, \/wp-content\/uploads\/2026\/03\/microsoft-ai-foundry-australian-enterprise-ai-platforms-cover.png 4x"},"classes":[]},{"id":57836,"url":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/2026\/07\/12\/implementing-secure-a2a-auth-in-microsoft-foundry-agent-service\/","url_meta":{"origin":57984,"position":2},"title":"Implementing Secure A2A Auth in Microsoft Foundry Agent Service","author":"CPI Staff","date":"July 12, 2026","format":false,"excerpt":"AI agents are starting to call other agents. Here is how to implement A2A authentication in Microsoft Foundry Agent Service without creating a security blind spot.","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/07\/implementing-secure-a2a-auth-in-microsoft-foundry-agent-service.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/07\/implementing-secure-a2a-auth-in-microsoft-foundry-agent-service.png 1x, \/wp-content\/uploads\/2026\/07\/implementing-secure-a2a-auth-in-microsoft-foundry-agent-service.png 1.5x, \/wp-content\/uploads\/2026\/07\/implementing-secure-a2a-auth-in-microsoft-foundry-agent-service.png 2x, \/wp-content\/uploads\/2026\/07\/implementing-secure-a2a-auth-in-microsoft-foundry-agent-service.png 3x, \/wp-content\/uploads\/2026\/07\/implementing-secure-a2a-auth-in-microsoft-foundry-agent-service.png 4x"},"classes":[]},{"id":57294,"url":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/2026\/03\/18\/microsoft-ai-foundry-hq-closes-the-gap-between-ai-experimentation-and-enterprise-grade-deployment\/","url_meta":{"origin":57984,"position":3},"title":"Microsoft AI Foundry HQ Closes the Gap Between AI Experimentation and Enterprise-Grade Deployment","author":"CPI Staff","date":"March 18, 2026","format":false,"excerpt":"Most Australian organisations have the same AI problem right now. The proof of concept worked. Leadership approved the budget. And then everything stalled. The gap between a successful AI experiment and a production-grade enterprise deployment is wider than anyone expected. Models need governance. Agents need monitoring. Compliance teams need audit\u2026","rel":"","context":"In &quot;AI&quot;","block_context":{"text":"AI","link":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/category\/ai\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/03\/microsoft-ai-foundry-hq-closes-gap-ai-experimentation-enterprise-deployment-cover.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/03\/microsoft-ai-foundry-hq-closes-gap-ai-experimentation-enterprise-deployment-cover.png 1x, \/wp-content\/uploads\/2026\/03\/microsoft-ai-foundry-hq-closes-gap-ai-experimentation-enterprise-deployment-cover.png 1.5x, \/wp-content\/uploads\/2026\/03\/microsoft-ai-foundry-hq-closes-gap-ai-experimentation-enterprise-deployment-cover.png 2x, \/wp-content\/uploads\/2026\/03\/microsoft-ai-foundry-hq-closes-gap-ai-experimentation-enterprise-deployment-cover.png 3x, \/wp-content\/uploads\/2026\/03\/microsoft-ai-foundry-hq-closes-gap-ai-experimentation-enterprise-deployment-cover.png 4x"},"classes":[]},{"id":57587,"url":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/2026\/05\/28\/connecting-microsoft-foundry-agents-to-business-systems-2\/","url_meta":{"origin":57984,"position":4},"title":"Connecting Microsoft Foundry Agents to Business Systems","author":"CPI Staff","date":"May 28, 2026","format":false,"excerpt":"AI agents are moving from proof of concept to production planning. For many Australian organisations, the question is no longer whether an agent can answer a question. The harder question is whether it can safely do useful work across the systems the business already runs on. That means connecting agents\u2026","rel":"","context":"In &quot;AI for Business &amp; AI Strategy&quot;","block_context":{"text":"AI for Business &amp; AI Strategy","link":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/category\/ai-for-business-ai-strategy\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/05\/connecting-microsoft-foundry-agents-to-business-systems.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/05\/connecting-microsoft-foundry-agents-to-business-systems.png 1x, \/wp-content\/uploads\/2026\/05\/connecting-microsoft-foundry-agents-to-business-systems.png 1.5x, \/wp-content\/uploads\/2026\/05\/connecting-microsoft-foundry-agents-to-business-systems.png 2x, \/wp-content\/uploads\/2026\/05\/connecting-microsoft-foundry-agents-to-business-systems.png 3x, \/wp-content\/uploads\/2026\/05\/connecting-microsoft-foundry-agents-to-business-systems.png 4x"},"classes":[]},{"id":57604,"url":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/2026\/06\/01\/claude-opus-4-8-in-azure-ai-foundry\/","url_meta":{"origin":57984,"position":5},"title":"Claude Opus 4.8 in Azure AI Foundry","author":"CPI Staff","date":"June 1, 2026","format":false,"excerpt":"Anthropic\u2019s Claude Opus 4.8 is now available in Microsoft Azure AI Foundry, giving organisations another frontier model option inside the Azure ecosystem. For Australian businesses already standardising on Microsoft cloud services, this matters for a simple reason: AI adoption is moving from experimentation to production. The question is no longer\u2026","rel":"","context":"In &quot;AI Governance &amp; Risk Management&quot;","block_context":{"text":"AI Governance &amp; Risk Management","link":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/category\/ai-governance-risk-management\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/06\/claude-opus-48-in-azure-ai-foundry.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/06\/claude-opus-48-in-azure-ai-foundry.png 1x, \/wp-content\/uploads\/2026\/06\/claude-opus-48-in-azure-ai-foundry.png 1.5x, \/wp-content\/uploads\/2026\/06\/claude-opus-48-in-azure-ai-foundry.png 2x, \/wp-content\/uploads\/2026\/06\/claude-opus-48-in-azure-ai-foundry.png 3x, \/wp-content\/uploads\/2026\/06\/claude-opus-48-in-azure-ai-foundry.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/wp-json\/wp\/v2\/posts\/57984","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/wp-json\/wp\/v2\/comments?post=57984"}],"version-history":[{"count":1,"href":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/wp-json\/wp\/v2\/posts\/57984\/revisions"}],"predecessor-version":[{"id":57985,"href":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/wp-json\/wp\/v2\/posts\/57984\/revisions\/57985"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/wp-json\/wp\/v2\/media\/57986"}],"wp:attachment":[{"href":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/wp-json\/wp\/v2\/media?parent=57984"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/wp-json\/wp\/v2\/categories?post=57984"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cloudproinc.azurewebsites.net\/index.php\/wp-json\/wp\/v2\/tags?post=57984"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}