A company deploys Azure AI Foundry for an internal AI application development team. The security team needs to ensure the team can create and manage AI projects within a hub but cannot modify the hub's network settings or add new connected resources. Which Azure AI Foundry role assignment is correct?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you want the Azure AI Developer role at the hub level. It lets your team create and manage AI projects, deployments, and experiments inside the hub without letting them change hub network settings, add connections, or manage hub settings. That's the least-privilege fit.
Full Explanation
The Azure AI Developer role at the hub level is correct because it grants permissions to create and manage AI projects, deployments, and experiments within a hub, without administrative permissions to modify hub-level network configurations, add new connections, or manage hub settings. This provides appropriate least-privilege access for development teams. The Azure AI Administrator role at the project level is wrong because the Azure AI Administrator role is a highly privileged role that includes management of the hub itself, including network and resource configuration, so it is not appropriate for developers. The Owner role scoped to individual projects within the hub is wrong because Owner grants full control within those projects, including the ability to assign roles, which may be overprivileged; the Azure AI Developer role is the purpose-built role for this scenario. The Contributor role at the hub level is wrong because Contributor grants write access to all hub settings, including network configuration, violating the restriction on network setting changes.