Azure ML inference pipeline deployment authorization token error

2
votes

When deploying a real-time inferencing pipeline in Azure ML (as per this tutorial), I receive the below error. I've tried forcibly logging out using OAuth. Tried creating a new Azure workspace but continue to receive the same error.

It looks like the tenant id causing the problem is example.onmicrosoft.com (72f988bf-86f1-41af-91ab-2d7cd011db47)

Deploy: Failed on step CreateServiceFromModels. Details: AzureML service API error. Error calling ServiceCreate: {"code":"Unauthorized","statusCode":401,"message":"Unauthorized","details":[{"code":"EmptyOrInvalidToken","message":"Error: Service invocation failed!\r\nRequest: GET https://management.azure.com/subscriptions/subscription_id/resourceGroups/dev-rg/providers/Microsoft.MachineLearningServices/workspaces/dev-ws/providers/Microsoft.Authorization/permissions?api-version=2015-07-01\r\nStatus Code: 401 Unauthorized\r\nReason Phrase: Unauthorized\r\nResponse Body: {\"error\":{\"code\":\"InvalidAuthenticationTokenTenant\",\"message\":\"The access token is from the wrong issuer 'https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/'. It must match the tenant 'https://sts.windows.net/correct_tenant_id/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/correct_tenant_id' to get the token. Note, if the subscription is transferred to another tenant there i

1
azureazure-active-directoryazure-machine-learning-studioazure-deploymentazure-machine-learning-service
Can you please add more details about the region in which your work space deployed? Also Please share the role that is assigned to you on this workspace? To find out your role, go to the workspace in the Azure portal, and then clicking on “Identity and Access Management (IAM)” on the left. Then click on “Check Access” and find the permissions assigned to you. – Ram-msft
Thanks, your question pointed me to the solution. I appear to have User Access Administrator role only, in addition to Classic Service Administrator. As soon as I added myself to the Owner role, the deployment succeeded. – Phil C

1 Answers

2
votes

I appear to have had User Access Administrator role only (in addition to Classic Service Administrator). As soon as I added myself to the Owner role in the Access Control (IAM) section of the Azure Portal, the deployment succeeded.