The Cognitive Services OpenAI User role grants least-privilege read/use permissions: view resource endpoints, list available models, use existing deployments in Azure OpenAI Studio (e.g., generate text and images ). It cannot create or manage deployments (that would require Cognitive Services OpenAI Contributor ), satisfying least-privilege. References Azure OpenAI built-in roles: OpenAI User vs OpenAI Contributor . https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control Azure RBAC for Azure AI services. https://learn.microsoft.com/azure/ai-services/role-based-access-control?tabs=azure-portal