Private Foundry Hub Project - Cannot edit Prompt Flow in Foundry Portal

Question

Private Foundry Hub Project - Cannot edit Prompt Flow in Foundry Portal

Christopher Wilson 0 Microsoft Employee

## Steps to Reproduce

1. Follow steps in lab, https://microsoftlearning.github.io/mslearn-ai-studio/Instructions/03-Use-prompt-flow-chat.html. *NOTE: The lab shows public access, but you need to depoloy using private Microsoft Foundry Hub and Project.

2. Deploy AI Foundry Hub and Project with private network configuration:
   - Public network access: Disabled
   - Private endpoints enabled
   - Private DNS zones configured
   - Access via VM in same VNet

3. Assign user the following roles:
   - Contributor on Resource Group
   - Azure AI Developer on Hub
   - Azure AI Developer on Project
   - Storage Blob Data Contributor on Storage Account
   - Key Vault Secrets Officer on Key Vault

4. Access AI Foundry Portal (https://ai.azure.com) from Windows VM in same VNet

5. Navigate to AI Foundry Project

6. Create a new Prompt Flow (e.g., Chat Flow). Flow will be created.

7. Attempt to click on the Prompt Flow. A modal window will appear

This flow was created by MOD Administrator, but access to the workspace and default storage account allows you to edit it. Clone it to avoid accidental overwrites


## Troubleshooting Steps Taken

### Permissions (All Successful - Issue Persists)
1. ✅ Added Azure AI Developer role to AI Foundry Project
2. ✅ Added Azure AI Developer role to AI Foundry Hub
3. ✅ Added Storage Blob Data Contributor to Storage Account
4. ✅ Added Key Vault Secrets Officer to Key Vault
5. ✅ Added Contributor role at Resource Group level
6. ✅ Verified all role assignments propagated (waited 10+ minutes)

### Browser/Session Troubleshooting
1. ✅ Cleared browser cache and cookies
2. ✅ Logged out and logged back into AI Foundry portal
3. ✅ Tried different browser (Edge, Chrome)
4. ✅ Used InPrivate/Incognito mode
5. ✅ Waited for RBAC propagation (multiple times, 5-15 minutes each)

### Resource Configuration
1. ✅ Verified AI Foundry Project system-assigned managed identity has Storage Blob Data Reader
2. ✅ Confirmed all private endpoints operational with DNS A records
3. ✅ Verified user can access storage, Key Vault (through private network)
4. ✅ Confirmed resources deployed correctly with no errors

### Comparison Testing
1. ✅ Tested same user in different tenant with PUBLIC AI Foundry - WORKS
2. ✅ Confirmed issue is specific to PRIVATE network deployment
3. ✅ Verified same user identity, same Microsoft Learn lab scenario

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Jerald Felix 18,760 Volunteer Moderator

Hello Christopher Wilson,

Thanks for raising this question in Q&A forum. The "MOD Administrator" modal in private AI Foundry deployments indicates missing user-level storage permissions specifically Storage File Data Privileged Contributor. Your RBAC is correct for managed identities, but the portal requires your user account to have direct file share access.

Root Cause

Private network Prompt Flow authoring requires Azure Files access (not just Blobs). The portal validates your user identity against File shares before allowing edits.

Fix: Add Missing File Role

bash
# Get Storage Account ID

Additional Private Network Checklist

DNS Over HTTPS (Critical)

Browser DNS bypasses private endpoint resolution.

Edge: Settings → Privacy → Disable "Use secure DNS"

Chrome: Settings → Privacy → Security → Disable "Use secure DNS"

Access via Compute Instance

For fully private deployments, use AI Foundry Compute Instance instead of standalone VM.

Navigate to Compute → Create compute instance in same VNet

Open Jupyter or VS Code from portal

Launch https://ml.azure.com from compute instance browser

Storage Account Firewall

Verify exception for Azure services.

bash
az storage account update \
  --name <storage-account> \
  --resource-group <rg> \
  --bypass AzureServices

Role Requirements Summary

Scope	Identity	Role	Purpose
Storage Account	Your User	Storage Blob Data Contributor	Portal blob operations learn.microsoft
--------	--------	--------	--------
Storage Account	Your User	Storage Blob Data Contributor	Portal blob operations learn.microsoft
Storage Account	Your User	Storage File Data Privileged Contributor	Prompt Flow authoring azure
Storage Account	Hub Managed Identity	Storage Blob Data Reader	Runtime operations learn.microsoft
Key Vault	Your User	Key Vault Secrets Officer	Connection secrets learn.microsoft

Validation Steps

powershell
# From VM in VNet

Add Storage File Data Privileged Contributor + disable browser secure DNS—these resolve 90% of private deployment edit issues. Wait 10 mins for RBAC propagation after adding roles. If helpful kindly accpet the answer.

Cheers,

Jerald Felix

SRILAKSHMI C 19,735 Reputation points Microsoft External Staff Moderator

2026-01-01T07:07:38.84+00:00

Duplicate of the thread - https://learn.microsoft.com/en-us/answers/questions/5687432/foundry-hub-project-cannot-edit-prompt-flow-in-fou

SRILAKSHMI C 19,735 Reputation points Microsoft External Staff Moderator

2026-01-01T07:07:38.84+00:00

Duplicate of the thread - https://learn.microsoft.com/en-us/answers/questions/5687432/foundry-hub-project-cannot-edit-prompt-flow-in-fou