fix: serialize AI Foundry resource updates

[Yamini Dhiman (Yamini1-Microsoft)]

Purpose

This pull request updates the deployment Bicep templates to improve resource deployment ordering and adjust identity configuration for role assignments related to Azure AI and Search services. The changes ensure that dependencies are explicitly declared and correct identity settings are used during role assignment.

Deployment dependency improvements:

• Added dependsOn clauses to both the aiProject and aiProjectWithIdentity resources to ensure they are deployed only after aiServicesDeployments completes, preventing potential race conditions during resource provisioning. [1] [2]

Role assignment and identity handling:

• Updated the existingOpenAiProject module to depend on assignFoundryRoleToMIExisting, ensuring proper sequencing of role assignments.
• Changed the enableSystemAssignedIdentity parameter from true to false in the existingOpenAiProject module parameters, aligning the configuration with the intended identity usage for role assignments.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• Validate that all operations updating the same AI Foundry account now run sequentially and no longer produce  RequestConflict .

Other Information

[Copilot]

Copilot review overview

🟢 Approval recommended

The dependencies consistently serialize conflicting Foundry updates while preserving identity and role-assignment behavior.

Review effort: Balanced
Findings: None

What changed in this PR

Serializes Azure AI Foundry resource updates to prevent deployment conflicts and corrects existing-resource identity handling.

Changes:

• Deploys AI projects only after model deployments complete.
• Sequences existing-resource role-assignment modules.
• Uses existing identities without re-enabling system-assigned identity.

File	Description
infra/​deploy_foundry_role_assignment.bicep	Orders project creation after model deployments.
infra/​deploy_ai_foundry.bicep	Adds deployment ordering and corrects existing-project identity parameters.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.