Azure AI Foundry project hub RBAC delegation failing when provisioning managed compute across multi-tenant subscriptions

D Sagar Jangid 20 Reputation points
2026-08-17T14:30:13.1366667+00:00

We are architecting a multi-tenant enterprise hub on Microsoft Azure using Azure AI Foundry SDK in Python (azure-ai-projects). When child workspace projects in tenant subscriptions attempt to utilize shared compute clusters provisioned in thecentral Hub subscription, the provisioning pipeline throws SubscriptionCrossTenantResourceAccessForbidden.

We have verified Managed Identity role assignments (Azure AI Enterprise Owner). How can we configure Azure Lighthouse or

cross-tenant Service Principal delegations so developers can build inside Foundry Hubs without exposing root storage

containers?

Azure OpenAI in Foundry Models
0 comments
Answer accepted by question author
Nithin 330 Reputation points
2026-08-17T16:09:37.38+00:00

Hi @D Sagar Jangid

RBAC delegation failures between Azure AI Foundry Hubs and Projects typically occur when permissions are missing at the parent Hub scope, or the delegator lacks role assignment privileges (Microsoft.Authorization/roleAssignments/write).

Quick Fixes / Solutions:

  1. Assign Hub-Level Scope: Ensure users have at least the Azure AI Developer (or Reader) role assigned at the parent Hub level, not just on the child Project.
  2. Verify Role Delegation Rights: To assign or delegate roles to others, ensure your account has Owner or User Access Administrator on the resource group or project.
  3. Add Underlying Storage RBAC: Verify users/Managed Identities have Storage Blob Data Contributor and Cognitive Services OpenAI Contributor on linked hub storage and AI services.

Ref: Role-based access control in Azure AI Foundry

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.