* The requirement is to allow User1 to add custom data sources to an Azure OpenAI resource (AI1).
* Following the principle of least privilege means granting only the specific rights required.
* The Cognitive Services OpenAI Contributor role allows management of Azure OpenAI resources, including attaching custom data sources for RAG (retrieval-augmented generation).
* The Cognitive Services Contributor role is broader and grants access to all cognitive services, which violates least privilege.
* Search Service Contributor and Search Index Data Contributor are roles for Azure AI Search, not for managing data sources on Azure OpenAI.
Microsoft References:
* Azure built-in roles: Cognitive Services OpenAI Contributor