chore: Update RBAC Configuration to Reference Role IDs (follow-up)

[ShreyasW-Microsoft]

Purpose

Update the RBAC configuration so that every role assignment references its Azure built-in role definition ID (GUID) instead of the role display name. Referencing roles by GUID avoids ambiguity and intermittent lookup/deployment failures that can occur when resolving roles by display name.

Scope of changes:

• infra/main.bicep — convert all roleDefinitionIdOrName role-name values to their role definition GUIDs, each annotated with an inline // Role Name comment.
• infra/main_custom.bicep — same conversion, including the previously missed Storage Blob Data Contributor assignment for the workflow managed identity (flagged in review).
• Inline role-name comments use the // Role Name format (space after //, no quotes) for readability and consistency with the rest of the files.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• Every roleDefinitionIdOrName across the infra Bicep files references a role definition GUID (no remaining display-name references).
• Each GUID maps to the correct Azure built-in role (see the inline // Role Name comments).
• The workflow managed identity's Storage Blob Data Contributor assignment now uses GUID ba92f5b4-2d11-453d-a403-e96b0029c9fe.

Other Information

Companion change to the Container Migration Solution Accelerator PR applying the same role-ID convention.

[Copilot]

Pull request overview

This PR continues the RBAC normalization work from #631 by replacing remaining role name references with role definition GUIDs in the Bicep templates and the generated ARM template, improving consistency and avoiding name-based lookups.

Changes:

• Replace roleDefinitionIdOrName role names with role definition GUIDs across container registry, storage, AI services, and App Configuration role assignments.
• Preserve role names as inline comments in Bicep for readability.
• Regenerate infra/main.json to reflect the updated RBAC role IDs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
infra/main.bicep	Updates multiple RBAC roleDefinitionIdOrName entries from role names to role GUIDs (with inline comments).
infra/main_custom.bicep	Mirrors the RBAC GUID updates for the custom deployment entrypoint.
infra/main.json	Regenerated ARM template reflecting the GUID-based RBAC role assignments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.