How do I use Azure AI Foundry endpoints and avoid permission errors

Daniel Basher 0

I am new to Azure and I am trying to get the following tutorial working.

I have tried following the tutorial to provision with azd, I have even used a dev container, github codespaces and manually tried to make the required environmental variables.

Whenever I try to run the tests which check for a connection to AI foundry endpoints with ! python -m pytest --rootdir=infra/tests/

I get the permission errors openai.AuthenticationError: Error code: 401 - {'error': {'code': 'PermissionDenied', 'message': 'Principal does not have access to API/Operation.'}} . I did some googling and it said to do an app registration and pass the AZURE_CLIENT_ID into the .env file and then add the Microsoft Cognitive services "user_impersonation" permission. however I tried this and it still did nothing.

To reiterate this happens even using azd and setting up manual infrastructure so I figure either the code is broken/doesn't explain setup well enough (unlikely), there is something wrong with my Azure account or I am missing something.

Please let me know if anyone knows how to fix this or if you need any further information. Cheers.

Full error: error_code.txt

kothapally Snigdha 490 Reputation points Microsoft Vendor

2024-11-27T23:58:09.23+00:00
Hi Daniel Basher

Greetings & Welcome to Microsoft Q&A forum! Thanks for posting your query!

I understand that you are experiencing an issue with Azure OpenAI Service permissions. Here are a few steps you can take to resolve the 401 - Permission Denied error:

Ensure that you are using the correct API key and endpoint. Sometimes, using an incorrect key or endpoint can lead to authentication errors.

Make sure you have assigned the necessary roles to your Azure OpenAI resource. The roles you might need include Cognitive Services OpenAI User, Cognitive Services OpenAI Contributor, and Cognitive Services Contributor.

Verify that your app registration has the correct permissions. You mentioned adding the user impersonation permission but also ensure that the app registration has the necessary API permissions for Azure OpenAI Service.

Ensure that all required environment variables are correctly set in your .env file. This includes AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET.

Confirm that your application is loading these variables correctly when running tests.

When running your tests, consider adding debugging statements or logging to capture more information about the authentication process.

Use a simple test script to verify if you can connect to the Azure OpenAI service outside of your main application context. Kindly let us know if the above helps or you need further assistance on this issue. Thanks, Snigdha.
kothapally Snigdha 490 Reputation points Microsoft Vendor

2024-11-29T00:05:56.2+00:00

Hi Daniel Basher

Following up to see if the above response was helpful.
kothapally Snigdha 490 Reputation points Microsoft Vendor

2024-11-30T00:01:18.2+00:00

Hi Daniel Basher

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Share via

How do I use Azure AI Foundry endpoints and avoid permission errors

Your answer