Azure AI Foundry Agent Service "agents/write" denied despite Azure AI User role — Managed Application deny assignment blocking dataActions?

Background

We publish an Azure Managed Application to the marketplace with "Restrict access with deny assignments" enabled. The managed resource group contains:

• Container App (Python application using Azure AI Foundry Agent Service)
• Function App
• SQL Database
• Service Bus Queues
• Azure AI Foundry resource with a Foundry project

This is a follow-up to my previous question about GitHub Actions deployment permissions where subscription-scope roles resolved control plane action denials:

How do I deploy GitHub code to Azure Function App through a user-assigned Managed Identity (MI) without giving the MI Reader & Website Contributor subscription scope roles? The rg scope roles did not work and the rg is deployed in another tenant.

The Problem

Our Container App's System-Assigned Managed Identity cannot call the Azure AI Foundry Agent Service:

(PermissionDenied) The principal lacks the required data action 
`Microsoft.CognitiveServices/accounts/AIServices/agents/write` to perform 
`POST /api/projects/{projectName}/assistants` operation.

According to Microsoft's RBAC documentation for AI Foundry, the Azure AI User role includes:

"dataActions": ["Microsoft.CognitiveServices/*"]

This wildcard should cover Microsoft.CognitiveServices/accounts/AIServices/agents/write. Additionally, the documentation explicitly states under "Permissions to build Agents":

DataActions:

• Microsoft.CognitiveServices/accounts/AIServices/agents/read
• Microsoft.CognitiveServices/accounts/AIServices/agents/write
• Microsoft.CognitiveServices/accounts/AIServices/agents/delete

Yet despite having Azure AI User assigned, the error persists.

Roles Assigned to Container App Managed Identity

We have extensively tested various role combinations. Current assignments:

Subscription scope (Pay-As-You-Go):

• Azure AI User
• Azure AI Developer

Resource Group scope (managed RG):

• Azure AI User
• Azure AI Developer
• Owner

Foundry Resource scope:

• Azure AI User
• Azure AI Developer
• Azure AI Owner
• Azure AI Administrator
• Cognitive Services Contributor
• Cognitive Services OpenAI User

Foundry Project scope:

• Azure AI Owner
• Azure AI Project Manager
• Cognitive Services Contributor

Other working roles on other resources:

• Azure Service Bus Data Sender (Service Bus Namespace scope)
• Azure Service Bus Data Receiver (Service Bus Namespace scope)
• Key Vault Secrets User (Key Vault scope)

Additional verification:

• Waited 16+ hours for RBAC propagation
• Restarted Container App multiple times to clear token cache
• Stopped Container App for 10 minutes and restarted

None of these changes affected the error.

Cross-Tenant Foundry Portal Limitation

We also attempted to assign roles via the Foundry portal's Users tab directly on the project. However, we discovered a cross-tenant limitation:

• The Foundry resource is deployed in the client's tenant (via Managed Application)
• We (the publisher) are in a separate tenant
• When searching for principals to add in the Foundry portal, only users from the publisher tenant appear
• The Container App's Managed Identity (which exists in the client tenant) does not appear in the search results
• Client tenant users also do not appear

This means we cannot use the Foundry portal's native user management to grant access to resources in the client tenant, even though we have Owner access to the managed resource group.

What Works vs. What Doesn't

The Service Bus roles work at resource scope within the managed RG. We attempted the same pattern with AI Foundry (assigning roles directly on the Foundry resource and project) but it does not work.

SQL Database details:

The SQL Database uses an App Registration from our (publisher) tenant, authenticated via ClientSecretCredential. Permissions are granted through SQL-level commands, not Azure RBAC:

CREATE USER [InvoiceAgent_CompanyName_Database] FROM EXTERNAL PROVIDER;
GO
ALTER ROLE db_datareader ADD MEMBER [InvoiceAgent_CompanyName_Database];
GO
ALTER ROLE db_datawriter ADD MEMBER [InvoiceAgent_CompanyName_Database];
GO

This works because SQL-level permissions bypass Azure RBAC entirely — the deny assignment only affects Azure control/data plane actions, not database-internal security.

Service Bus uses Azure RBAC at resource scope and works.

Azure AI Foundry uses Azure RBAC and fails at every scope we've tried.

Our Hypothesis

Based on the previous Q&A response explaining deny assignments:

1. The Managed Application creates a deny assignment with DataActions: * (deny all)
2. Specific dataActions are excepted via NotDataActions
3. Service Bus dataActions appear to be in NotDataActions (hence they work)
4. Cognitive Services dataActions are NOT in NotDataActions (hence they fail)
5. Unlike control plane actions, subscription-scope roles do NOT bypass deny assignments for dataActions

We cannot verify this because:

• Azure Portal doesn't show full deny assignment details
• We cannot run Get-AzDenyAssignment due to cross-tenant limitations (we're the publisher in a different tenant)

Questions

Do dataActions behave differently than control plane actions regarding deny assignment inheritance?

• For control plane actions (e.g., Microsoft.Web/sites/config/list/action), subscription-scope roles bypassed the managed RG deny assignment
  • For dataActions, this does not appear to work — is this expected?
  Why do Service Bus dataActions work at resource scope but Cognitive Services dataActions don't?

  - Are certain dataActions automatically added to `NotDataActions` for Managed Applications?
  
     - Is there a default allowlist for common Azure services?
  
     **What is the correct solution for enabling Azure AI Foundry Agent Service in a Managed Application?**
  
        - Should we add `Microsoft.CognitiveServices/*` or specifically `Microsoft.CognitiveServices/accounts/AIServices/agents/*` to the **allowedDataActions** in our Managed Application definition via Partner Center?
  
           - Is there documentation on configuring Cognitive Services dataActions for Managed Applications?
  
           **How can customers or publishers verify what's in the NotDataActions exception list?**
  
              - Is there a way to view this in Portal or must we use PowerShell/CLI?
  
              **Is there a workaround for the cross-tenant Foundry portal limitation?**
  
                 - How can publishers assign Foundry roles to Managed Identities that exist in the client tenant?
  

Environment Details

• Managed Application: Published via Azure Marketplace with deny assignments enabled
• Container App: System-Assigned Managed Identity
• AI Foundry endpoint: *.services.ai.azure.com/api/projects/*
• SDK: azure-ai-projects using DefaultAzureCredential
• Cross-tenant: Publisher in separate tenant from client deployment

Related Documentation

• RBAC for Azure AI Foundry - Azure AI User role definition
• Permissions to build Agents
• Azure deny assignments