Create Agent disabled in new Foundry

Question

I have a user with Azure AI User permission on the Foundry Project, and Reader to its Foundry parent. In the new portal, it is not possible to create an Agent, having disabled the button. In the old portal and by sdk, it works fine

Answer 1

Angandin hi,

this is not RBAC in ur case, its portal capability mismatch / feature gating in new Foundry UI, if it works in old portal and SDK then permissions are already sufficient, new portal just enforces additional checks or has feature flag not enabled for that user/tenant/project, “Create Agent” being disabled usually means either missing specific action permission on project (not just Azure AI User) or feature not rolled out in that region/tenant yet

check assign Contributor (or at least Cognitive Services/OpenAI specific role) on the Foundry project temporarily and refresh, new portal is stricter than old one and sometimes Azure AI User is not enough for create operations in UI even though SDK works + confirm region and project type, some Foundry features roll out unevenly so new UI may block while backend still allows via SDK. & try different user with higher privileges (Owner/Contributor) to confirm its not UI permission evaluation bug

important signal here is “SDK works”, that means backend is fine and this is UI-layer issue (RBAC mapping or feature flag), use old portal or SDK for agent creation, if u want proper fix, open support and mention Create Agent disabled in new Foundry UI but works via SDK and legacy portal, thats known pattern for partial rollout.

at he end so it is not ur permissions, new portal either stricter or feature-gated.

rgds,

Alex

&

pls if it helps accept my answer and mark it as an answer

Answer 2

Hello Angandin,

Welcome to Microsoft Q&A .Thank you for reaching out to us.

The observed behavior where the Create Agent option is disabled in the new Foundry portal, while agent creation works through the classic portal and SDK, is related to how permissions are evaluated in the updated user experience.

In the new Foundry portal, the interface performs a stricter permission validation before enabling agent creation. Even though agent creation itself is a data‑plane operation and functions correctly through SDK and legacy paths, the new UI additionally checks for effective write‑capable visibility at both the Foundry project level and the parent Foundry resource. When access at the parent resource is limited to Reader, the portal cannot confidently validate agent‑creation capability and therefore disables the Create Agent button. This is a UI‑side safety check and does not indicate a service issue or misconfiguration in the agent environment.

Agent creation still works in other paths because

1. The classic portal and SDK rely directly on backend data‑plane permissions.
2. Azure AI User permission at the project scope is sufficient for agent creation through those paths.
3. The underlying Foundry Agent Service is functioning as expected, which confirms this is not a platform outage or regression.

To resolve the create agent button being disabled in the new portal ,align with the new UI permission checks by ensuring that the Azure AI User visibility is available at the parent Foundry resource level in addition to the project.

Please check if the following steps help to resolve the issue

1. Assign Azure AI User at the Foundry resource (parent) scope.
2. Retain Azure AI User at the Foundry project scope.
3. Refresh the portal after role propagation completes.

This satisfies both the UI validation and the actual backend permission requirement.

An alternative resolution would be to

• Assign Azure AI Project Manager or Azure AI Account Owner at the Foundry resource scope.
• This immediately enables agent creation in the new portal but grants broader permissions than strictly required.

To conclude , the observed behavior is driven by stricter permission validation in the new Foundry portal UI. Backend permissions remain correct, which is why SDK and classic portal agent creation works. Aligning Azure AI User access at the parent Foundry resource resolves the UI limitation while retaining least‑privilege access.

The following references might be helpful , please check them out

• Role-based access control for Microsoft Foundry - Microsoft Foundry | Microsoft Learn
• Set up your environment for Foundry Agent Service - Microsoft Foundry | Microsoft Learn

Please let us know if the response was helpful in resolving the query.

Thank you