Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
Hello Raqib Rasheed,
Thanks for raising this question in Q&A forum.
I understand that your AI Agent (using the Azure AI Project SDKs) works locally but fails to run when deployed to an Azure Container App (ACA).
This issue is almost always caused by Authentication differences between your local environment and the cloud environment. Locally, the SDK uses your user credentials (via az login). In the cloud, it tries to use a Managed Identity, which requires specific setup.
Please check the following three configurations:
- Enable Managed Identity:
- Go to your Container App in the Azure Portal.
- Select Identity > User assigned (Recommended) or System assigned.
- Add an identity.
- Grant Permissions (RBAC):
- The identity you assigned to the Container App must have permissions to access the Azure AI Project.
- Go to your Azure AI Project (or the underlying AI Hub resource).
- Go to Access control (IAM) > Add role assignment.
- Assign the "Azure AI Developer" (or Cognitive Services User) role to the Managed Identity you created in Step 1.
- Note: Without this role, the agent code will fail with 401/403 errors when trying to create threads or run messages.
- Update Environment Variables:
- In your Container App Containers settings, ensure you have passed the necessary environment variables that your code expects (e.g.,
PROJECT_CONNECTION_STRING). - Critical for User-Assigned Identity: You must add an environment variable named
AZURE_CLIENT_IDand set its value to the Client ID of the User Assigned Managed Identity. Without this,DefaultAzureCredentialin Python may fail to select the correct identity or fallback to a failed state.
- In your Container App Containers settings, ensure you have passed the necessary environment variables that your code expects (e.g.,
Troubleshooting Logs:
If the issue persists, check the Log Stream in the Container App portal. If you see an error like CredentialUnavailableError or ClientAuthenticationError, it confirms the identity setup above is incomplete.
If helps, approve the answer.
Best Regards,
Jerald Felix