01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:
az account list
--query '[*].id'
02 The command output should return the requested subscription identifiers (IDs):
[
"abcdabcd-1234-abcd-1234-abcdabcdabcd",
"abcd1234-abcd-1234-abcd-abcd1234abcd"
]
03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):
az account set
--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
04 Run cognitiveservices account list command (Windows/macOS/Linux) with custom output filters to list the name and the associated resource group for each Azure AI Services (AI Foundry) instance available within the current subscription:
az cognitiveservices account list
--output table
--query '[?(kind==`AIServices`)].{name:name, resourceGroup:resourceGroup}'
05 The command output should return the requested AI Foundry instance identifiers:
Name ResourceGroup
------------------------------- ------------------------------
cc-project5-ai-service-instance cloud-shell-storage-westeurope
cc-project5-ai-foundry-instance cloud-shell-storage-westeurope
06 Run cognitiveservices account identity show command (Windows/macOS/Linux) with the name of the Azure AI Foundry instance that you want to examine as the identifier parameter and custom output filters to describe the user-assigned managed identities associated with the selected instance:
az cognitiveservices account identity show
--name cc-project5-ai-service-instance
--resource-group cloud-shell-storage-westeurope
--query 'userAssignedIdentities'
07 The command output should return the information available for the associated identities (including the identity full ID and the ID of the associated principal). If the cognitiveservices account identity show command does not return an output, there are no user-assigned managed identities configured for your instance and the Audit process ends here. To add user-assigned identities to your AI Foundry instance, follow the instructions outlined on this page:
{
"/subscriptions/1234abcd-1234-abcd-1234-abcd1234abcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.ManagedIdentity/userAssignedIdentities/tm-project5-ai-user-identity": {
"clientId": "1234abcd-1234-abcd-1234-abcd1234abcd",
"principalId": "abcd1234-abcd-1234-abcd-1234abcd1234"
}
08 Run role assignment list command (Windows/macOS/Linux) to describe the role assignments for the principal associated with your user-assigned managed identity. Set --assignee parameter value to the "principalId" attribute value returned at the previous step:
az role assignment list
--assignee abcd1234-abcd-1234-abcd-1234abcd1234
--all
09 The command output should return the role assignments for the selected principal:
[
{
"roleDefinitionName": "Owner",
"roleDefinitionId": "/subscriptions/1234abcd-1234-abcd-1234-abcd1234abcd/providers/Microsoft.Authorization/roleDefinitions/1234abcd-1234-abcd-1234-abcd1234abcd",
"condition": null,
"conditionVersion": null,
"createdBy": "1234abcd-1234-abcd-1234-abcd1234abcd",
"createdOn": "2025-09-05T08:11:52.463577+00:00",
"delegatedManagedIdentityResourceId": null,
"description": null,
"name": "1234abcd-1234-abcd-1234-abcd1234abcd",
"principalId": "abcd1234-abcd-1234-abcd-1234abcd1234",
"principalName": "1234abcd-1234-abcd-1234-abcd1234abcd",
"principalType": "ServicePrincipal",
"resourceGroup": "cloud-shell-storage-westeurope",
"scope": "/subscriptions/1234abcd-1234-abcd-1234-abcd1234abcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.CognitiveServices/accounts/cc-project5-ai-service-instance",
"type": "Microsoft.Authorization/roleAssignments",
"updatedBy": "1234abcd-1234-abcd-1234-abcd1234abcd",
"updatedOn": "2025-09-05T08:11:52.463577+00:00"
},
{
"roleDefinitionName": "User Access Administrator",
"roleDefinitionId": "/subscriptions/1234abcd-1234-abcd-1234-abcd1234abcd/providers/Microsoft.Authorization/roleDefinitions/1234abcd-1234-abcd-1234-abcd1234abcd",
"condition": null,
"conditionVersion": null,
"createdBy": "1234abcd-1234-abcd-1234-abcd1234abcd",
"createdOn": "2025-09-06T08:00:52.463577+00:00",
"delegatedManagedIdentityResourceId": null,
"description": null,
"name": "1234abcd-1234-abcd-1234-abcd1234abcd",
"principalId": "abcd1234-abcd-1234-abcd-1234abcd1234",
"principalName": "1234abcd-1234-abcd-1234-abcd1234abcd",
"principalType": "ServicePrincipal",
"resourceGroup": "cloud-shell-storage-westeurope",
"scope": "/subscriptions/1234abcd-1234-abcd-1234-abcd1234abcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.CognitiveServices/accounts/cc-project5-ai-service-instance",
"type": "Microsoft.Authorization/roleAssignments",
"updatedBy": "1234abcd-1234-abcd-1234-abcd1234abcd",
"updatedOn": "2025-09-06T08:00:52.463577+00:00"
}
]
Check the
"roleDefinitionName" attribute value for each role assignment returned by the
role assignment list command output to determine if the associated identity has privileged administrator roles such as
"Owner",
"Contributor",
"User Access Administrator", and
"Role Based Access Control Administrator". If one or more privileged administrator roles are assigned to the user-assigned managed identity associated with your instance, the selected Azure AI Foundry instance is configured with admin privileges.
Security 
Reliability 
Cost
Performance
Operational