How to fix Authorization Failure issue when Deploying online ML deployment in existing Endpoint from Azure container registry using .yml script .

Question

I have an azure Container Registry repository where i have uploaded my ML Model as Docker image to deploy in Azure ML Workspace.

Using .yml script, i am creating Online ML Deployment in existing endpoint, which is causing Authorization Failure in between while script execution is in progress.

I already have Machine Leaning workspace, and ml Endpoint.

My endpoint public access is disabled.

Below is the sample .yml script for reference,

Error Details:

'https://management.azure.com/subscriptions/

Answer 1

Hello Pandiri, Mahendar,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to fix Authorization Failure issue when Deploying online ML deployment in existing Endpoint from Azure container registry using .yml script.

A 403 AuthorizationFailure in Azure ML deployments typically stems from insufficient permissions or network restrictions blocking access to Azure Storage or Container Registry (ACR). Below is a structured steps to resolve these issues:

1. Authentication & Role Assignment Issues: Problem is that the Azure ML workspace’s managed identity lacks permissions to access the storage account hosting score.py. Specifically, the Storage Blob Data Contributor role is required to read/write blobs. If public network access is disabled, network rules might also block access. To fix this, follow the below steps:
   1. In the Azure Portal, navigate to the storage account (e.g., modelestdev).
   2. Under Access Control (IAM), grant the workspace’s managed identity (system- or user-assigned) the Storage Blob Data Contributor role.
   3. For ACR, assign the AcrPull role to the same identity. CLI Command for Role Assignment:

            az role assignment create --assignee <identity-id> --role "Storage Blob Data Contributor" --scope /subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<storage>
      

      https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-cli)
   4. If using a SAS token, regenerate it with rcwl (read, create, write, list) permissions:

         az storage blob generate-sas --account-name <storage> --container-name <container> --name score.py --permissions rcwl --expiry 2025-02-09T23:59:59Z --https-only
   

2. Network Configuration: The problem lies in disabling public network access (egress_public_network_access: disabled) which blocks external access to storage/ACR unless private endpoints or trusted services are configured it might not work, but based on your requirement of nonpublic network. Follow this step to fix it:
   1. Option 1: Use Private Endpoints
      1. Create private endpoints for the storage account and ACR.
      2. Link these endpoints to the same VNet as the Azure ML workspace. For more detail steps: https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview
   2. Option 2: Allow Trusted Services
      1. In the storage account/ACR firewall, enable: Allow Azure services on the trusted services list to access this resource
3. Code Configuration in YAML: The problem is that using a local path (e.g., C:\Projects\...) in code_configuration.code forces Azure ML to upload code to workspace storage. If permissions are misconfigured, this upload will continue to fail. You can also fix it by follow the steps below:
   1. Reference code from cloud storage instead:

              code_configuration:
                code: azureml:my_code_asset:1  # Pre-uploaded code asset
                scoring_script: score.py
      

      For local development, ensure the workspace identity has write access to the storage account.
4. Environment Variables & Validation: You will need to explicitly set storage credentials in the YAML:

      environment_variables:
        AZURE_STORAGE_ACCOUNT: "<storage>"
        AZURE_STORAGE_ACCESS_KEY: "<key>"
      
   

5. Last but not the least, for verification purposes, redeploy and authenticate your solution after the above is done:

      az ml online-deployment create --file deployment.yml
      az login --identity  # For managed identity
   

By addressing permissions, network rules, and code references, the 403 error should resolve. For further details, refer to:

• https://learn.microsoft.com/en-us/azure/machine-learning/how-to-identity-based-service-authentication
• https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad-errors

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.