DO not have permission to owned project

[ddobric]

After some changes during the build conference, I noticed many issues.

1. C# samples do not use connection string anymore or I cannot find the related sample.
   Previously I have been using:
   AgentsClient client = new (connectionString);
   The worked fine.

Now, I use:
PersistentAgentsClient client = new PersistentAgentsClient(connectionString, new DefaultAzureCredential());

This fails with the following exception

The code that causes the exception:

PersistentAgentsClient client = new PersistentAgentsClient(connectionString, new DefaultAzureCredential());

PersistentAgent? agent = null;

Pageable<PersistentAgent> agentListResponse = client.Administration.GetAgents();

Console.WriteLine("Listing agents in the foundry project...");

foreach (var foundyAgent in agentListResponse)  <------- This fails
{
. . . 
}

I have executed az login and ensured that the right subscription is active (az account show).

[justuswolff-audit]

I believe I had the same issue with the Python SDK. There was a GitHub issue (which I can't find right now), but as far as I remember the project could not be organized under a hub. If it is a standalone project authentication works (which solved it for me). Hope this helps.

[amynic]

Thanks for posting @ddobric - can you review this migration guide from the changes as Build to see if it relates and solves your issue https://github.com/orgs/azure-ai-foundry/discussions/26

[PabloNunes]

Thank you for your feedback, @ddobric. Could you provide some extra information for those questions:

1. How does your ConnectionString looks like? Does it look like the new Quickstart? It should look like: https://your.services.ai.azure.com/api/projects/project

2. Is your Management center in Foundry giving user permissions to the project? It can be located here.

Anything else needed, let us know.
Pablo.

[amynic]

@ddobric thanks for the feedback - did @PabloNunes support you to get unblocked, if so please do select as an answer!

[nicholasdbrady]

You may be hitting an issue related to the recent GA (General Availability) changes for Azure AI Foundry. Here’s what you need to know and check:

1. Migration from Connection String to Endpoint Format:

   • If your Foundry project was created after May 19, 2025, you must use the endpoint URL (not the old connection string) and the new PersistentAgentsClient pattern. Projects created before this date should continue with the connection string and existing SDKs.
   • See the official GA Migration Guide for C# for examples and details.

2. Verify Permissions (RBAC):

   • If your project is under a hub, make sure your user/service principal has contributor or higher access both at the hub and the project level.
   • Projects in a hub inherit RBAC and security settings, which can affect permissions even if you "own" the project.
   • More details here: Role-based access control in Azure AI Foundry

3. Double-Check Your Endpoint & Setup:

   • Make sure the endpoint (or connection string, if pre-GA) matches the current project and follows the recommended format.
   • If you're still getting permission issues, double-check the network settings, and that your IP or private endpoint access is allowed.
   • Troubleshooting tips here: Troubleshoot connection to a project

Summary:
Ensure your SDK usage matches your project’s creation date (endpoint vs connection string), and confirm your user or service principal has the correct RBAC permissions for both the hub and the project.

Let me know if you need further assistance or want specific example code for the migration! And, like @amynic and @PabloNunes shared, please mark which contribution as an answer. Thanks!