Cannot upload files in New Foundry

I am trying to upload a file when I am building a agent, it is trying to create a vector store. My setup is the Basic Agent setup, I don't have a storage attached. Assigning the role at the root resource is not acceptable for me. The error is the following: "You don't have permission to upload files in this project. Please ask your administrator to assign the Foundry User role."

Hi @Marcus Vinicius Cursino Suares , just to add to the above, what you're describing does look like a portal bug rather than a misconfiguration. The Foundry User role assigned at the project scope should be sufficient for file uploads within that project; needing to assign it at the root Foundry resource level to make uploads work suggests the portal's permission check is evaluating against the wrong scope for this specific operation.

A few practical things worth confirming to help narrow it down:

• Check which type of upload is failing, Agent file search, playground uploads, and vector store uploads each call different backend APIs and may have different permission check paths. Knowing which one helps determine if this is isolated to one workflow or the entire upload surface.

Also check if the connected storage account has its own access control requirements. In new Foundry projects, file uploads often go through an Azure Storage account linked to the project, and the Foundry User role at project scope may not automatically grant the necessary Storage Blob Data Contributor role on that storage account. This is a common gap that isn't always obvious from the portal error message.

If assigning at the root resource is not acceptable for your security model, the narrowest workaround is to additionally assign Storage Blob Data Contributor on the project's linked storage account directly to the affected user, rather than elevating at the Foundry resource level. This may restore upload functionality without broadening access beyond the project boundary.

Please upvote and accept the answer if it helps!

Hello @Marcus Vinicius Cursino Suares ,

Welcome to Microsoft Q&A .Thank you for reaching out to us.

The issue appears to be related to RBAC scope evaluation rather than a general file upload failure. The key indicator is that file uploads succeed when the Foundry User role is assigned at the Azure AI Foundry resource (account) scope, while the same operation fails when the role is assigned only at the project scope. This points toward a permissions evaluation difference between the Foundry resource and project scopes

Azure AI Foundry uses a hierarchical RBAC model where projects are child resources of a Foundry resource. The Foundry resource acts as the primary security boundary, while projects operate as sub-scopes within that resource.

Based on the observed behavior, certain upload-related portal operations appear to evaluate permissions at the Foundry resource scope in addition to project-level permissions. This aligns with the fact that assigning the Foundry User role at the Foundry resource level restores upload functionality even when the role is already assigned at the project scope.

Please check if the following steps help-

1. Verifying Role Assignments
   1. Please confirm that the affected user has the Foundry User role assigned at the Azure AI Foundry resource (account) scope, as this is the scope that has been observed to restore upload functionality.
   2. Verify whether the assignment is direct or inherited through a Microsoft Entra ID group.
   3. Review whether any Azure Policy, Conditional Access, Deny Assignments or Privileged Identity Management (PIM) requirements could affect effective access.
2. Allowing RBAC Propagation After any role assignment changes:
   • Wait approximately 5–10 minutes for permission updates to propagate.
   • Refresh the browser session or sign out and sign back in.
   • Retry the upload operation.
3. Verifying Effective Access Using the Azure portal:
   • Navigate to Access Control (IAM) on the Foundry resource.
   • Use Check Access to verify that the expected permissions are effective.
   • Repeat the same validation on the Foundry project if needed.
4. Confirming the Upload Workflow To determine whether additional authorization paths are involved, please confirm which upload scenario is being used:
   • Data Files
   • Agent/File Search
   • Fine-tuning datasets
   • Evaluation datasets
   • Prompt Flow assets
   • Playground uploads
   • Knowledge or Vector Store uploads
   Different workflows may interact with different backend services and permission checks.

If least-privilege access is required, assigning the role only at the specific Foundry resource scope (rather than the Resource Group or Subscription scope) provides the narrowest practical permission boundary while matching the observed authorization requirements

If the Issue Persists

If uploads continue to fail after confirming the resource-level role assignment, please let us know

1. Exact error message displayed in the portal.
2. Upload workflow being used.
3. Azure Activity Log entries showing authorization-related failures.
4. Confirmation whether the issue affects all users or only specific users.
5. Confirmation whether custom RBAC roles or PIM-enabled assignments are being used.

The following references might be helpful , please check them out

• Role-based access control for Microsoft Foundry - Microsoft Foundry | Microsoft Learn
• Role-based access control for Azure OpenAI (classic) - Microsoft Foundry (classic) portal | Microsoft Learn
• Hosted agent permissions reference - Microsoft Foundry | Microsoft Learn
• Create a project - Microsoft Foundry | Microsoft Learn

Please let us know if the response was helpful

Thank you