Give AzureQuantum application full permissions

Question

I am attempting to run an application on Azure via the QuantumWorkspace.

from azure.quantum import Workspace
from azure.identity import ClientSecretCredential
credential = ClientSecretCredential(
    tenant_id="<TENANT_ID>",
    client_id="<CLIENT_ID>",
    client_secret="<CLIENT_SECRET>",
)
workspace = Workspace(
    subscription_id="<SUBSCRIPTION_ID>",
    resource_group="<RESOURCE_GROUP>",
    name="<WORKSPACE_NAME>",
    location="eastus",
    credential=credential,
)

When I attempt to get the associated devices of the workspace however, I get the following error:

azure.core.exceptions.HttpResponseError: (InsufficientPermissions) There are not enough permissions to perform this operation.

Code: InsufficientPermissions

Message: There are not enough permissions to perform this operation.

Is there a way I can just give full permissions to my application? I believe I've already done this, but it's honestly very difficult to tell based on the way in which the settings are defined on Azure.

Answer 1

Hi @vincent

I understand you have reached out separately to the product group and the issue is resolved. I am posting the resolution here, please accept it as answer for the benefit of community users looking for solution to similar issues.

Solution:

If using an application, the application needs to be granted Quantum Workspace Data Contributor role on the workspace to submit jobs (here is list of roles and what they enable):

[Understanding workspace access - Azure Quantum | Microsoft Learn](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fazure%2Fquantum%2Fmanage-workspace-access%23role&data=05%7C02%7CPriyanka.Rudramaina%40microsoft.com%7C918844af73c44d6a640808dd551ac0b5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638760295747267940%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=cJOOot%2FEV%2B69ntlG2dS2VA9zw%2BS50gLNj1c4oy0wyBA%3D&reserved=0"Original URL: https://learn.microsoft.com/en-us/azure/quantum/manage-workspace-access#role. Click or tap if you trust this link.")

In general, if you just need to connect Azure Quantum and run jobs, I'd strongly recommend connection string over application with a secret. It's very easy to set up, and you won't need any additional roles. They seem to support taking a workspace object, so you can pass it in like this:

     from azure.quantum import Workspace

 connection_string = "[Copy connection string here]"

workspace = Workspace.from_connection_string(connection_string)

 

See here for how to get your connection string enabled and how to use it in the python SDK.

[Connect to your Azure Quantum workspace - Azure Quantum | Microsoft Learn](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fazure%2Fquantum%2Fhow-to-connect-workspace%3Ftabs%3Dtabid-python1%252Ctabid-python%23connect-using-a-connection-string&data=05%7C02%7CPriyanka.Rudramaina%40microsoft.com%7C918844af73c44d6a640808dd551ac0b5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638760295747283147%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=luFNQDt5MVQZFfdWpQJJFv7aJLA%2BEXbKjJtzziqPrys%3D&reserved=0"Original URL: https://learn.microsoft.com/en-us/azure/quantum/how-to-connect-workspace?tabs=tabid-python1%2Ctabid-python#connect-using-a-connection-string. Click or tap if you trust this link.")

A connection string and an application with a client secret will both achieve the same thing--it will enable access to submit jobs using the python SDK with a known secret. The application path is nicer than connection string if you need this same application to also connect to other Azure resources, and you want to leverage the same application to talk to multiple resources. Application may also be nicer if you plan to use managed identity authentication instead of client secrets, since that is more secure.

If I have answered your question, please accept this as answer as a token of appreciation and don't forget to thumbs up for "Was it helpful"!