Error: "Make sure to create your workspace using a client which support MSI" when deploying Azure ARM template for Machine Learning Services Workpsace

Question

I'm currently trying to script our Azure Machine Learning infrastructure, using ARM templates and running through Terraform. In order to ensure that the template works, I'm first running it from a file using the Az CLI.

I'm running this on Ubuntu, with the below version of the Az CLI:-

azure-cli                         2.0.78

command-modules-nspkg              2.0.3
core                              2.0.78
nspkg                              3.0.4
telemetry                          1.0.4

Python location '/opt/az/bin/python3'
Extensions directory '/home/blah/.azure/cliextensions'

Python (Linux) 3.6.5 (default, Dec 12 2019, 11:11:33) 
[GCC 8.3.0]

I have already created the Storage Account, App Insights and Key Vault using terraform.

When trying to run the template using the Az CLI with the command:-

az group deployment create --name MachineLearning --resource-group data-science --template-file ML_ARM.json --parameters appInsightsName=machine-learning-dev storageAccountName=machinelearningdev keyVaultName=data-science-dev mlApiVersion=2018-11-19 mlWorkspaceName=machine-learning-dev location=uksouth

I receive the following error:-

Make sure to create your workspace using a client which support MSI

The ARM template is below:-

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "storageAccountName": {
            "type": "string",
            "metadata": {
                "description": "The name of the storage account"
            }
        },
        "appInsightsName" : {
            "type": "string",
            "metadata": {
                "description": "The name of the app insights account"
            }
        },
        "keyVaultName": {
            "type": "string",
            "metadata": {
                "description": "The name of the keyvault resource"
            }
        },
        "mlApiVersion": {
            "type": "string",
            "metadata": {
                "description": "The api version of the ML workspace"
            }
        },
        "mlWorkspaceName": {
            "type": "string",
            "metadata": {
                "description": "The name of the Machine Learning Workspace"
            }
        },
        "location": {
            "type": "string",
            "metadata": {
                "description": "Resource location"
            }
        }
    },
  "resources": [
        {
            "apiVersion": "[parameters('mlApiVersion')]",
            "type": "Microsoft.MachineLearningServices/workspaces",
            "name": "[parameters('mlWorkspaceName')]",
            "location": "[parameters('location')]",
            "sku": {
              "tier": "enterprise",
              "name": "enterprise"
            },
            "properties": {
                "storageAccount": "[resourceId('Microsoft.Storage/storageAccounts',parameters('storageAccountName'))]",
                "applicationInsights": "[resourceId('Microsoft.Insights/components',parameters('appInsightsName'))]",
                "keyVault": "[resourceId('Microsoft.KeyVault/vaults',parameters('keyVaultName'))]"
            }
        }
    ]
}

Some rudimentary googling hasn't really been enlightening into what the issue might be with this; the documentation and guide templates for the Machine Learning Service are linked below:-

https://docs.microsoft.com/en-us/azure/machine-learning/service/how-to-create-workspace-template https://docs.microsoft.com/en-us/azure/templates/microsoft.machinelearningservices/2019-11-01/workspaces

Any idea what the issue might be? Thanks in advance for any pointers!

DreadedFrost DreadedFrost · Accepted Answer · 2019-12-19T18:19:55

I am not familar with Terraform or that robust on ML Services; however, the error you provided lends itself to needing to have MSI authentication configured which is configured in the link you provided.

Try updating your ARM to include the identity section like this:

   ...  },
"identity": {
        "type": "systemAssigned"
      },
                "properties": {
                    "storageAccount": "[resourceId('Microsoft.Storage/storageAccounts',parameters('storageAccountName'))]",
                    "applicationInsights": "[resourceId('Microsoft.Insights/components',parameters('appInsightsName'))]",
                    "keyVault": "[resourceId('Microsoft.KeyVault/vaults',parameters('keyVaultName'))]"
                }

This will create the Managed Service Identity.

Error: "Make sure to create your workspace using a client which support MSI" when deploying Azure ARM template for Machine Learning Services Workpsace

1 Answers