AI-103 Certification Practice Question #13

Question

You have a Microsoft Foundry project that contains a model deployment.
You have an application that calls the deployment by using the Azure OpenAI v1 API and DefaultAzureCredential.
The developers at your company receive HTTP 403 errors when they send inference requests, even after running az login.
You need to ensure that the developers can perform model inference. The solution must follow the principle of least privilege.
Which role-based access control (RBAC) role should you assign to the developers?

Accepted Answer

Developers authenticate with `DefaultAzureCredential` (Entra ID) and get HTTP 403 on inference even after `az login`, which is a data-plane authorization gap, not an authentication failure. The Azure OpenAI RBAC doc lists "Cognitive Services OpenAI User" as the role whose permissions include making inference API calls with Microsoft Entra ID, and Microsoft's keyless-auth guidance explicitly recommends assigning that exact role to the `DefaultAzureCredential` principal. Contributor would work but violates least privilege, and the generic "Cognitive Services User"/"Data Reader" roles do not carry the Azure OpenAI inference DataActions. Suggested Answer and MS Learn agree, so confidence is high.

More AI-103 practice questions