AI-102 Plan and manage an Azure AI solution Practice Question
You are deploying an Azure AI Services resource by using an ARM template as part of an automated pipeline. The template must create the resource, a key vault, and a role assignment that allows a specific managed identity to read the resource key from the key vault. The deployment fails with an authorization error when creating the role assignment. You need to resolve the failure. What should you do?
⚠ Common exam trap
The trap here is assuming Contributor is sufficient for every deployment action, when Contributor deliberately excludes the ability to grant access to others.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the User Access Administrator role to the pipeline service principal at the target scope before the deployment.
Role assignment creation is a privileged operation that requires permissions such as Microsoft.Authorization/roleAssignments/write, provided by Owner or User Access Administrator. Contributor and key vault access policies do not include that permission, so granting User Access Administrator to the pipeline identity at the target scope is what allows the template to complete.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign the User Access Administrator role to the pipeline service principal at the target scope before the deployment.
Why this is correct
Creating role assignments requires the Microsoft.Authorization/roleAssignments/write permission, which is included in User Access Administrator or Owner. Granting that role to the pipeline identity at the deployment scope lets the ARM template create the role assignment successfully, resolving the authorization failure.
- ✗
Add the Contributor role to the pipeline service principal at the subscription scope.
Why it's wrong here
Contributor can create and manage most resources but cannot create role assignments, because that action requires Microsoft.Authorization/roleAssignments/write. The deployment would still fail at the role assignment step, so this does not resolve the error even though it grants broad resource management permissions.
- ✗
Enable the key vault for template deployment and add the pipeline identity to the key vault access policy.
Why it's wrong here
Key vault access policies govern reading secrets, keys, and certificates, not creating Azure RBAC role assignments. Allowing template deployment for the vault is unrelated to the Microsoft.Authorization provider operation that failed, so this change would not grant the missing permission.
- ✗
Change the template to use a system-assigned managed identity for the Azure AI Services resource instead of the key vault.
Why it's wrong here
Changing the identity model of the AI resource does not grant the pipeline identity permission to create role assignments. The failing operation is the role assignment itself, so modifying which identity the resource uses leaves the authorization error unresolved and may also break the intended access pattern.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AI-102 question from scratch — 761 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.