Search code examples
azureazure-active-directoryazure-machine-learning-serviceazure-deployment

Azure ML inference pipeline deployment authorization token error


When deploying a real-time inferencing pipeline in Azure ML (as per this tutorial), I receive the below error. I've tried forcibly logging out using OAuth. Tried creating a new Azure workspace but continue to receive the same error.

It looks like the tenant id causing the problem is example.onmicrosoft.com (72f988bf-86f1-41af-91ab-2d7cd011db47)


Deploy: Failed on step CreateServiceFromModels. Details: AzureML service API error. Error calling ServiceCreate: {"code":"Unauthorized","statusCode":401,"message":"Unauthorized","details":[{"code":"EmptyOrInvalidToken","message":"Error: Service invocation failed!\r\nRequest: GET https://management.azure.com/subscriptions/subscription_id/resourceGroups/dev-rg/providers/Microsoft.MachineLearningServices/workspaces/dev-ws/providers/Microsoft.Authorization/permissions?api-version=2015-07-01\r\nStatus Code: 401 Unauthorized\r\nReason Phrase: Unauthorized\r\nResponse Body: {\"error\":{\"code\":\"InvalidAuthenticationTokenTenant\",\"message\":\"The access token is from the wrong issuer 'https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/'. It must match the tenant 'https://sts.windows.net/correct_tenant_id/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/correct_tenant_id' to get the token. Note, if the subscription is transferred to another tenant there i


Solution

  • I appear to have had User Access Administrator role only (in addition to Classic Service Administrator). As soon as I added myself to the Owner role in the Access Control (IAM) section of the Azure Portal, the deployment succeeded.