Authentication Failed When Creating Prompt Flow

Question

Authentication Failed When Creating Prompt Flow

Sally Chen 145 Microsoft External Staff

I want to create prompt flow in Azure AI Studio. However, I face the following issue:

Authentication Failed

Unable to access the dag.yaml file with original storage location at Users/MY_USERNAME/promptflow/MY_PROMPT_FLOW/flow.dag.yaml. Please check the storage setting.

If there any solutions to this error? Thank you.

kothapally Snigdha 2,100 Reputation points Microsoft External Staff

2024-11-01T22:31:22.0633333+00:00

Hi Sally Chen,

Thanks for Reaching the Microsoft Q&A Forum.

Ensure that your Azure ML workspace has the correct permissions set for the storage account. The identity used by your Azure ML workspace should have at least Storage Blob Data Contributor access to the storage account associated with your project.

If your storage account is set to private, confirm that the necessary firewall rules are in place to allow access from your Azure services. You may need to add your IP address or configure a virtual network.

For public access, ensure that CORS (Cross-Origin Resource Sharing) settings on your storage account allow access from Azure AI Studio. This can be configured in the storage account settings under Resource sharing (CORS).

Make sure that all necessary environment variables for authentication are correctly configured if you are using Environmental. credentials Missing or incorrect configurations can lead to authentication failures.

Thank you!
kothapally Snigdha 2,100 Reputation points Microsoft External Staff

2024-11-04T16:08:10.71+00:00

Hi Sally Chen,

Following up ti see if the above response was helpfu.

Thank you!
kothapally Snigdha 2,100 Reputation points Microsoft External Staff

2024-11-05T16:07:21.4266667+00:00

Hi Sally Chen,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others.

Thank you!
Mauro Minella 51 Reputation points Microsoft Employee

2024-11-09T10:45:55.4433333+00:00
Hi, I have exactly the same problem with Azure AI Studio, while with ML Studio it works:

Sometimes the creation of the workflow even works, so I can configure it normally.

But after some time (a few hours, a few minutes or days) it becomes totally impossible to either create new workflows or open any of the previous ones.

Here are the permissions I created, as documented here:

STORAGE ACCOUNT

owner for the logged user

storage blob DATA contributor for the logged user and for the project (which is the equivalent of the ML workspace identity, in fact it's seen as a managed identity)

storage account contributor for the project and for the hub

storage blob DATA reader for the project and for the Azure AI Search Service

Storage File Data Privileged Contributor for the project and for the hub

storage TABLE DATA CONTRIBUTOR for the project and for the Azure AI Search Service

AI SEARCH

owner for the logged user

contributor for the HUB

Search Index Data Reader for the AI Services (including OpenAI)

Search Service Contributor for the AI Services

AI SERVICES

ownwer for the logged user

contributor for the hub

Cognitive Services OpenAI Contributor for the logged user and for AI Search

Cognitive Services User for the logged user

I tried to re-create multiple hubs from scratch, they ALL have this behavior.

The last error was today, November 11th 2024.

Thanks,

Mauro
Mauro Minella 51 Reputation points Microsoft Employee

2024-11-10T14:57:59.19+00:00
One more note: it seems that even workflows I have been working for weeks without any issues, suddenly present the error above.

This problem is DETERMINISTIC and cannot be considered a specific issue on my environment.

BTW, I can't understand:

WHO should be authorized on the storage account: the currently logged user? The project (equivalent to the ML workspace)? The hub? Another service? BTW, I did it for ALL of them

WHERE is this flow.dag.yaml file located: in the storage account associated to the hub, I guess. But I can't find ANY folder called "Users" or any of the below subfolders

WHY this problem doesn't happen AT ALL with Azure ML Studio: because the PromptFlow version included in AI Studio is still in preview?

WHAT kind of authorization should be given: Storage Blob Data Contributor? Storage Blob Data Reaer? Simple Contributor? Owner? Again, I tried with ALL of them: same result

Thank you,

Mauro
alik9 0 Reputation points

2024-11-19T11:04:46.03+00:00

Same issue here, I fixed it by setting the Blob Storage connected to my Project in the network settings to "enable from all networks"
Mauro Minella 51 Reputation points Microsoft Employee

2024-11-19T11:44:55.69+00:00

I found it. It's actually not a network problem but an authentication issue associated to the AI Studio portal: despite all the managed identities (that should access the storage where prompt flows are located) as added as blob storage data contributors, Azure AI Studio still needs key based authentication on the storage account.

So, if for any reason it's disabled -as it happens, for instance, in companies like mine as part of security initiatives where a policy regularly checks this parameter-, then the access is forbidden until "key access" is enabled again:
kothapally Snigdha 2,100 Reputation points Microsoft External Staff

2024-11-19T18:43:39.7766667+00:00

Hi Sally Chen,

I would recommend creating a new thread on the same forum with as many details about your issue as possible. That would make sure that your issue has better visibility in the community.
Jason Leong 10 Reputation points Microsoft Employee

2024-11-25T03:08:01.33+00:00

@Mauro Minella The Storage access key could be disabled due to company policy. A better way to access is configure it to use Entra ID. Refer to this page for information on how to change it

https://learn.microsoft.com/en-gb/azure/ai-studio/how-to/disable-local-auth?tabs=portal#update-an-existing-hub

4 answers

Your answer

kothapally Snigdha 2,100 Reputation points Microsoft External Staff

2024-11-01T22:31:22.0633333+00:00

Hi Sally Chen,

Thanks for Reaching the Microsoft Q&A Forum.

Ensure that your Azure ML workspace has the correct permissions set for the storage account. The identity used by your Azure ML workspace should have at least Storage Blob Data Contributor access to the storage account associated with your project.

If your storage account is set to private, confirm that the necessary firewall rules are in place to allow access from your Azure services. You may need to add your IP address or configure a virtual network.

For public access, ensure that CORS (Cross-Origin Resource Sharing) settings on your storage account allow access from Azure AI Studio. This can be configured in the storage account settings under Resource sharing (CORS).

Make sure that all necessary environment variables for authentication are correctly configured if you are using Environmental. credentials Missing or incorrect configurations can lead to authentication failures.

Thank you!
kothapally Snigdha 2,100 Reputation points Microsoft External Staff

2024-11-04T16:08:10.71+00:00

Hi Sally Chen,

Following up ti see if the above response was helpfu.

Thank you!
kothapally Snigdha 2,100 Reputation points Microsoft External Staff

2024-11-05T16:07:21.4266667+00:00

Hi Sally Chen,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others.

Thank you!
Mauro Minella 51 Reputation points Microsoft Employee

2024-11-09T10:45:55.4433333+00:00

Hi, I have exactly the same problem with Azure AI Studio, while with ML Studio it works:

Sometimes the creation of the workflow even works, so I can configure it normally.

But after some time (a few hours, a few minutes or days) it becomes totally impossible to either create new workflows or open any of the previous ones.

Here are the permissions I created, as documented here:

STORAGE ACCOUNT

owner for the logged user

storage blob DATA contributor for the logged user and for the project (which is the equivalent of the ML workspace identity, in fact it's seen as a managed identity)

storage account contributor for the project and for the hub

storage blob DATA reader for the project and for the Azure AI Search Service

Storage File Data Privileged Contributor for the project and for the hub

storage TABLE DATA CONTRIBUTOR for the project and for the Azure AI Search Service

AI SEARCH

owner for the logged user

contributor for the HUB

Search Index Data Reader for the AI Services (including OpenAI)

Search Service Contributor for the AI Services

AI SERVICES

ownwer for the logged user

contributor for the hub

Cognitive Services OpenAI Contributor for the logged user and for AI Search

Cognitive Services User for the logged user

I tried to re-create multiple hubs from scratch, they ALL have this behavior.

The last error was today, November 11th 2024.

Thanks,

Mauro
Mauro Minella 51 Reputation points Microsoft Employee

2024-11-10T14:57:59.19+00:00

One more note: it seems that even workflows I have been working for weeks without any issues, suddenly present the error above.

This problem is DETERMINISTIC and cannot be considered a specific issue on my environment.

BTW, I can't understand:

WHO should be authorized on the storage account: the currently logged user? The project (equivalent to the ML workspace)? The hub? Another service? BTW, I did it for ALL of them

WHERE is this flow.dag.yaml file located: in the storage account associated to the hub, I guess. But I can't find ANY folder called "Users" or any of the below subfolders

WHY this problem doesn't happen AT ALL with Azure ML Studio: because the PromptFlow version included in AI Studio is still in preview?

WHAT kind of authorization should be given: Storage Blob Data Contributor? Storage Blob Data Reaer? Simple Contributor? Owner? Again, I tried with ALL of them: same result

Thank you,

Mauro
alik9 0 Reputation points

2024-11-19T11:04:46.03+00:00

Same issue here, I fixed it by setting the Blob Storage connected to my Project in the network settings to "enable from all networks"
Mauro Minella 51 Reputation points Microsoft Employee

2024-11-19T11:44:55.69+00:00

I found it. It's actually not a network problem but an authentication issue associated to the AI Studio portal: despite all the managed identities (that should access the storage where prompt flows are located) as added as blob storage data contributors, Azure AI Studio still needs key based authentication on the storage account.

So, if for any reason it's disabled -as it happens, for instance, in companies like mine as part of security initiatives where a policy regularly checks this parameter-, then the access is forbidden until "key access" is enabled again:
kothapally Snigdha 2,100 Reputation points Microsoft External Staff

2024-11-19T18:43:39.7766667+00:00

Hi Sally Chen,

I would recommend creating a new thread on the same forum with as many details about your issue as possible. That would make sure that your issue has better visibility in the community.
Jason Leong 10 Reputation points Microsoft Employee

2024-11-25T03:08:01.33+00:00

@Mauro Minella The Storage access key could be disabled due to company policy. A better way to access is configure it to use Entra ID. Refer to this page for information on how to change it

https://learn.microsoft.com/en-gb/azure/ai-studio/how-to/disable-local-auth?tabs=portal#update-an-existing-hub

Answer 1

Mauro Minella 51 Microsoft Employee

Hi @Jason, you are absolutely right: this solution definitely solved the problem.

Thank you,

Mauro User's image

Tim Hinchey 0 Reputation points

2024-12-12T13:43:45.9866667+00:00

This worked for me. Has been frustrating me for ages! Thank you

Answer 2

Jason Leong 10 Microsoft Employee

The Storage access key has been disabled on the Storage account. You could re-enable it if you have the permissions, as per Mauro Minella's comment. But if your company has a policy to disable it, you will need to find another way.

Refer to this page for information on how to change the access to using Entra ID:

https://learn.microsoft.com/en-gb/azure/ai-studio/how-to/disable-local-auth?tabs=portal#update-an-existing-hub

Answer 3

Nguyen Tran 0 Microsoft Employee

I had done following configs and it works:

From Azure Portal, go to the Storage Account which is used for your AI Project, go to IAM, select Add role assignment.
In the Role Assignment, in the Roles, you'll see a drop down list, please select the role storage blob DATA contributor & then, role Storage File Data Privileged Contributor; add member for the identity you want to grant access.
Click review & assign.
Done.

Answer 4

Zhen Yuan 0 Microsoft Employee

I had the same issue before, and I managed to fix by following the below steps:

add "storage blob data contributor" role to the account
enable "allow storage account key access"

hopefully this helps.

Share via

Authentication Failed When Creating Prompt Flow

4 answers

Your answer