AuthenticationError: Error code: 401 - {'error': {'code': 'PermissionDenied', 'message': 'Principal does not have access to API/Operation.'}}

Orlando Herrera 10

Got AuthenticationError: Error code: 401 - {'error': {'code': 'PermissionDenied', 'message': 'Principal does not have access to API/Operation.'}} error, I theoretically gave all permisions needed, but it keeps blocking me

dupammi 8,540 Reputation points Microsoft Vendor

2024-08-22T01:27:13.07+00:00

Hi @Orlando Herrera

Thank you for reaching out to the Microsoft Q&A Forum.

The 401 "PermissionDenied" error suggests that the service principal lacks the necessary permissions to access the Azure OpenAI API. Ensure the service principal is assigned the Cognitive Services Contributor role directly on the Azure OpenAI resource via the Azure portal. Confirm that the role assignment is at the correct scope and that there are no restrictive Azure AD Conditional Access policies in place. Also, review the Azure Activity Logs for any denied actions. If the issue persists, temporarily assign the Owner role to test if it's a permissions issue.
dupammi 8,540 Reputation points Microsoft Vendor

2024-08-23T01:27:52.0566667+00:00

@Orlando Herrera

We haven’t heard from you on the last response and was just checking back to see if you got a chance to try above suggestions.

Thank you.
Quincy Qu 0 Reputation points

2024-09-27T09:28:21.7766667+00:00

@dupammi

I believe that to resolve this error, the role that needs to be assigned is Azure AI Developer, not the role mentioned in your response. Could you please double-check the actual situation?
Quincy Qu 0 Reputation points

2024-09-27T09:29:02.53+00:00

@dupammi I believe that to resolve this error, the role that needs to be assigned is Azure AI Developer, not the role mentioned in your response. Could you please double-check the actual situation?
Balaji Kithiganahalli 5 Reputation points

2025-01-29T22:32:56.18+00:00

This is an old post. But in case someone comes here looking for answer, Quincy Qu is correct and you have to assign Azure AI Developer role or Azure AI Administrator role, NOT Cognitive Services Contributor. I tested and the only thing worked for me was AI Developer Role.

var builder = Kernel.CreateBuilder().AddAzureOpenAIChatCompletion(

endpoint: endPointUrl,

deploymentName: deploymentName,

credentials: new DefaultAzureCredential(new DefaultAzureCredentialOptions { TenantId = tenantId })

);
Tim Søberg Thøgersen 0 Reputation points

2025-01-31T13:49:51.9266667+00:00

I have had the same problem and Balaji is correct: you have to assign Azure AI Developer role or Azure AI Administrator role, NOT Cognitive Services Contributor

Share via

AuthenticationError: Error code: 401 - {'error': {'code': 'PermissionDenied', 'message': 'Principal does not have access to API/Operation.'}}

Your answer