User Group focused on Azure AI and GitHub Copilot

For a user group focused on Azure AI and GitHub Copilot, the required permissions depend on which services and features are being used in the learning environment.

1. Azure Copilot (Copilot in Azure / Azure portal)
   • By default, Azure Copilot is available to all users in a tenant.
   • A Global Administrator in Microsoft Entra ID can restrict or grant access to Azure Copilot for specific users or groups. If access is restricted, the Global Administrator must:
     • Enable Azure Copilot for the tenant.
     • Optionally assign access to specific Microsoft Entra users or groups so that group members can use Copilot in the Azure portal.
2. GitHub Copilot for Azure (in Visual Studio / VS Code)
   • Each participant needs:
     • A GitHub account.
     • A GitHub Copilot subscription (managed by GitHub).
   • For GitHub Copilot for Azure specifically, participants also need:
     • An Azure account and access to an Azure subscription.
   • Tenant-level access to Copilot in Azure can again be controlled by a Global Administrator using Microsoft Entra users or groups.
3. Using Azure OpenAI or Azure AI services in tools (example: SSMS Copilot)
   • When using Azure OpenAI via Copilot in tools like SQL Server Management Studio (SSMS), the Azure resource must grant appropriate Azure RBAC roles to the users or groups:
     • Cognitive Services OpenAI User for read-only access to the Azure OpenAI endpoint.
     • Cognitive Services OpenAI Contributor for read/write access and endpoint modification.
   • These roles are assigned on the Azure OpenAI endpoint resource under Access Control (IAM) to users, groups, service principals, or managed identities.
4. Hosted agents or Azure AI Foundry capabilities (if used in the group)
   • If the group uses agents that access Azure AI account-level capabilities (Speech, Content Safety, Computer Vision, Document Intelligence, Language, etc.), members or service identities need one of the following roles at account scope:
     • Cognitive Services User – covers Speech, Vision, Language, and other non-OpenAI capabilities.
     • Foundry User – covers all CognitiveServices data actions, including OpenAI and other capabilities, with a single grant.

In practice, to run a user group:

• Ensure a Global Administrator configures access to Azure Copilot and Copilot in Azure for the relevant Microsoft Entra security group.
• Ensure participants have GitHub Copilot subscriptions for GitHub Copilot usage.
• Assign appropriate Azure RBAC roles (Cognitive Services OpenAI User/Contributor, Cognitive Services User, or Foundry User) on Azure AI resources used in demos or labs.

References:

• Manage access to Azure Copilot
• Get started with GitHub Copilot for Azure (visual-studio-2026)
• Get started with GitHub Copilot for Azure (visual-studio-2022)
• Use Azure OpenAI with Copilot in SSMS
• Hosted agent permissions reference