Azure OpenAI fine-tuned model cross-tenant deployment

Question

Hi,

I have fine-tuned a model on Azure OpenAI and I'm trying to deploy it on a different Azure OpenAI account that belongs to another Azure Tenant. According to the Azure documentation, it is possible to deploy a fine-tuned model to another Azure Subscription. However, it is unclear whether this subscription can reside in a different Azure Tenant.

I followed the documentation's code snippet using two subscriptions from two different tenants. I authenticated with a user account that has been invited as a guest to the target tenant and has the necessary permissions to create a deployment in the target Azure OpenAI Account. Despite this, I got the following error:

{'error': {'code': 'LinkedAuthorizationFailed', 'message': "The client has permission to perform action 'Microsoft.MachineLearningServices/workspaces/models/read' on scope '/subscriptions/<redacted>/resourceGroups/rg-dev/providers/Microsoft.CognitiveServices/accounts/<redacted>/deployments/my-model', however the current tenant '<redacted-target-tenant-id>' is not authorized to access linked subscription '<redacted-target-tenant-id>'."}}

Can you confirm whether it is possible to deploy a fine-tuned model from Azure OpenAI Account A, which belongs to Tenant A, to Azure OpenAI Account B, which belongs to a subscription in Tenant B?

Thanks,
Michele

Answer 1

Michele Zanotti Greetings & Welcome to Microsoft Q&A forum!

As mentioned in the documentation, Fine-tuning supports deploying a fine-tuned model to a different region than where the model was originally fine-tuned. You can also deploy to a different subscription/region.

The only limitations are that the new region must also support fine-tuning and when deploying cross subscription the account generating the authorization token for the deployment must have access to both the source and destination subscriptions.

{'error': {'code': 'LinkedAuthorizationFailed', 'message': "The client has permission to perform action 'Microsoft.MachineLearningServices/workspaces/models/read' on scope '/subscriptions/<redacted>/resourceGroups/rg-dev/providers/Microsoft.CognitiveServices/accounts/<redacted>/deployments/my-model', however the current tenant '<redacted-target-tenant-id>' is not authorized to access linked subscription '<redacted-target-tenant-id>'."}}

As per the error, please double check that the user account you are using to authenticate has the necessary permissions to access the linked subscription in Tenant B. You may also need to check if there are any network or firewall restrictions that may be preventing access to the linked subscription.

I'll also check and confirm if there are any further restrictions among the different tenants.