Azure OpenAI Studio Access and RBAC Configuration

Question

Is Azure OpenAI Studio (https://oai.azure.com/) publicly accessible to all Azure AD users without access to a specific Azure OpenAI resource? If a user is not assigned any RBAC roles, should they still be able to see the UI and the deployed models but not interact with them? Furthermore, if VNet integration with a selected network and an IP allowlist is enabled, why can users outside the allowlist still access the portal UI and see the models but not use them? Is there a way to completely block unauthorized users from accessing the portal itself? Please provide official Microsoft documentation confirming these behaviors and best practices for restricting access at the portal level.

Answer 1

Hi @Sudhakar P,

Thank you for reaching out to Microsoft Q&A forum!

Azure OpenAI Studio is publicly accessible to all Azure Active Directory (Azure AD) users. However, without appropriate RBAC roles assigned, users can access the portal but cannot interact with deployed models or perform operations within the Studio.

Please look into: RBAC for Azure OpenAI Service.

Regarding Virtual Network (VNet) integration with an IP allowlist, it's important to note that while these settings restrict data plane operations (such as API calls to the models), they do not limit access to the Azure OpenAI Studio portal itself. This means users outside the allowlist can still access the common portal UI, but are unable to utilize the models or perform operations.

Please look into this: Configure Azure AI services virtual networks.

Network settings control API access, not portal visibility. Additionally, use Azure AD conditional access or network security groups to restrict access.

I hope you understand! Thank you.