What happened?
I'm consistently getting a "Permission Denied" Error when calling my DAB application from foundry agent. I strongly suspect this has to do with Roles, because when I remove role requirement from dab-config.json, and change to "Authenticated", everything works fine.
Setup:
- Data Api builder hosted in Azure container app
- Dab Config fragment:
"permissions": [ { "role": "MyRole", "actions": [ { "action": "read" } ] } ]
- Entra ID app created according to steps detailed on https://learn.microsoft.com/en-us/azure/data-api-builder/concept/security/authenticate-entra?tabs=bash
- Accessing my hosted DAB from my local machine works fine: first get a token in cli:
az account get-access-token --scope <myApi> --query "accessToken" -o tsv
Then use postman to send a request to container app with headers
Authorization Bearer <token>
X-MS-API-ROLE MyRole
=> Result: data from my database :)
- I setup an agent in foundry, with my DAB as a tool.
- I assigned MyRole to the Agent using this command found in documentation:
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $agentId -PrincipalId $agentId -ResourceId $dabSp.Id -AppRoleId $userReadBasicRole.Id
- Role assignment is visible in Entra ID portal, User & Groups: Agent Identity is shown there with "My Role" in the Role assigned column.
Now when I chat with the agent in playground, I always get
"PermissionDenied", "message": "Permission denied for read on entity xxx".
Inspecting the trace, I see that the agent can read entities metadata fine, but gets Permissions: [] from DAB.
As soon as I change my dab-config to the following, everything works fine:
"permissions": [ { "role": "Authenticated", "actions": [ { "action": "read" } ] } ]
It seems I'm missing something with the roles, but what? Or is there a bug?
Maybe the Foundry agent isn't sending the X-MS-API-ROLE header - I tried to add that by creating the tool connection in foundry with
azd ai connection create --custom-key "X-MS-API-ROLE=MyRole" (...other params)
But it didn't help. Any help is welcome!
Version
2.0.12
What database are you using?
Azure SQL
What hosting model are you using?
Container Apps
Which API approach are you accessing DAB through?
MCP
Relevant log output
Code of Conduct
What happened?
I'm consistently getting a "Permission Denied" Error when calling my DAB application from foundry agent. I strongly suspect this has to do with Roles, because when I remove role requirement from dab-config.json, and change to "Authenticated", everything works fine.
Setup:
"permissions": [ { "role": "MyRole", "actions": [ { "action": "read" } ] } ]az account get-access-token --scope <myApi> --query "accessToken" -o tsvThen use postman to send a request to container app with headers
=> Result: data from my database :)
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $agentId -PrincipalId $agentId -ResourceId $dabSp.Id -AppRoleId $userReadBasicRole.IdNow when I chat with the agent in playground, I always get
"PermissionDenied", "message": "Permission denied for read on entity xxx".
Inspecting the trace, I see that the agent can read entities metadata fine, but gets Permissions: [] from DAB.
As soon as I change my dab-config to the following, everything works fine:
"permissions": [ { "role": "Authenticated", "actions": [ { "action": "read" } ] } ]It seems I'm missing something with the roles, but what? Or is there a bug?
Maybe the Foundry agent isn't sending the X-MS-API-ROLE header - I tried to add that by creating the tool connection in foundry with
azd ai connection create --custom-key "X-MS-API-ROLE=MyRole" (...other params)But it didn't help. Any help is welcome!
Version
2.0.12
What database are you using?
Azure SQL
What hosting model are you using?
Container Apps
Which API approach are you accessing DAB through?
MCP
Relevant log output
Code of Conduct