Two consequences shape the order below: The agent identity does not exist until the agent is created, so its RBAC role assignments must happen after create, not before. Your dev identity (az login) is ...