A water utility needs operators and prompt engineers to have different Foundry permissions. What should platform admins do?

Mapping Entra ID groups to Foundry roles that match operators versus prompt engineers is the correct least-privilege approach for a water utility that needs different Foundry permissions by persona. Platform admins should bind municipal Entra groups—such as SCADA operators and GenAI prompt engineers—to distinct Azure RBAC or Foundry role assignments so each group receives only the actions required for its job. Operators may need runtime monitoring and limited agent operations, while prompt engineers need project and prompt authoring rights without full Owner control of the Foundry resource. Group-based assignment also keeps joiner/mover/leaver workflows auditable across the utility. Mapping Entra groups to Foundry Owner roles for operators versus prompt engineers fails because Owner confers full control over the Foundry resource including access management, which violates least privilege for both personas and does not differentiate operator monitoring duties from prompt-engineering authoring duties. Mapping Entra groups to Foundry hub roles for operators versus prompt engineers fails because hub roles govern hub-level management, not the differentiated project-level capabilities for runtime operations versus prompt authoring that the personas require. Mapping Entra groups to Foundry storage roles for operators versus prompt engineers fails because storage roles govern access to blob data, not Foundry's own project and model permissions — it does not grant, or differentiate, the actual Foundry capabilities operators and prompt engineers need. Exam caveat: Entra group-to-role mapping is an identity design pattern; the exam may also mention built-in Cognitive Services / Azure AI roles. Prefer correctly scoped mapped Foundry roles over Owner, hub-level, or storage-only role mappings when the stem contrasts operators and prompt engineers or asks how to differentiate permissions safely. Operational check: verify distinct Entra groups exist for operators and prompt engineers, each is assigned only the intended Foundry/AI roles, no Owner or hub-level grants and no storage-only roles are used for model interaction, and a sample user from each group can perform their job without Owner on the Foundry resource.