How to fix - openai.AuthenticationError: Error code: 401 - {'error': {'code': 'PermissionDenied', 'message': 'Principal does not have access to API/Operation.'}}

Question

How to fix - openai.AuthenticationError: Error code: 401 - {'error': {'code': 'PermissionDenied', 'message': 'Principal does not have access to API/Operation.'}}

Rawat, Rahul 0

Hi Team,

I am using below git repo for reference -

https://github.com/Azure-Samples/azure-search-openai-demo.git

All required roles assigned to service principle being used by the code -

OpenAI Contributor Role

Trying to setup locally when running to get chat answers as stream via api - /chat/stream

getting below error -

File "/Users/rrawat33/AIWorkspace/python_playground_space/app/backend/app.py", line 203, in format_as_ndjson

*async for event in r:*

openai.AuthenticationError: Error code: 401 - {'error': {'code': 'PermissionDenied', 'message': 'Principal does not have access to API/Operation.'}}

[2025-02-16 12:33:47 +0530] [87938] [INFO] 127.0.0.1:52223 POST /chat/stream 1.1 200 - 3851673

Rawat, Rahul 0 Reputation points

2025-02-16T07:58:29.6766667+00:00

I am trying to setup locally on my mac book.
Vikram Singh 2,590 Reputation points Microsoft Employee Moderator

2025-02-17T05:51:35.77+00:00
Hi Rawat, Rahul,

Thanks for posting your question in Microsoft Q&A, apologize for any inconvenience caused on this.

The error indicates that the service principal you're using does not have the necessary permissions to access the API.

Here are a few steps you can take to resolve this issue:

Verify Role Assignments: Ensure that the service principal has the necessary roles assigned. In addition to the OpenAI Contributor Role, you should also assign the Azure AI Developer role or the Azure AI Administrator role.

Check Role Scope: Make sure that the role assignments are at the correct scope. The roles should be assigned directly to the Azure OpenAI resource via the Azure portal.

If the above steps do not resolve the issue, you can try the following workarounds:

Test with Owner Role: Temporarily assign the Owner role to the service principal to test if it's a permissions issue. If the error is resolved, it confirms that the issue is related to permissions.

API Key Authentication: If Azure RBAC is not working, consider using API key authentication. Ensure that the API keys are correct, not expired, and properly set in the WebApp Environment variable AZURE_OPENAI_KEY.

By following these steps, you should be able to resolve the permission issue and get your setup working locally on your MacBook.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.

Cheers

Rawat, Rahul 0

Hi @Vikram Singh

I tried above steps and assigned all mentioned roles however still same issue i am getting no luck.

Please find my .env file and Role Assignment screen shot let me what further need to be follow to resolve this issue.

User's image

I have kept both API and service principle client ans secret in .env file.

AZURE_ENV_NAME=dev
AZURE_SUBSCRIPTION_ID=mnsdafnjksdfnkjsdfnkjds
AZURE_TENANT_ID=fbejkdjksdfkjasdnfs14e1

AZURE_STORAGE_ACCOUNT=cliapp
AZURE_STORAGE_CONTAINER=user
AZURE_USERSTORAGE_ACCOUNT=cliapp
AZURE_USERSTORAGE_CONTAINER=user

## OPEN AI SERVICE
AZURE_OPENAI_SERVICE=dev-open
AZURE_OPENAI_GPT4V_DEPLOYMENT=
AZURE_OPENAI_GPT4V_MODEL=
AZURE_OPENAI_CHATGPT_DEPLOYMENT=gpt-4o-mini
AZURE_OPENAI_CHATGPT_MODEL=gpt-4o-mini
AZURE_OPENAI_EMB_DEPLOYMENT=text-embedding-ada-002
AZURE_OPENAI_CUSTOM_URL=
AZURE_OPENAI_API_KEY=dnjfjklnfkjsdnfkdjsfnfkjdsf
AZURE_OPENAI_ENDPOINT=https://dfnfk-open.openai.azure.com/
AZURE_OPENAI_API_VERSION=2024-10-21


## AZURE AI SEARCH
AZURE_SEARCH_SERVICE=az-ai-search-box
AZURE_SEARCH_INDEX=gptkbindex
AZURE_SERVER_APP_ID=dsfsdf-c2d4-47f6-jfnjlksdnfkjsldnfdsaf-eaf5117f7d7f
AZURE_SERVER_APP_SECRET=lWV8Q~fsdfsdfsdfsdfs-pirMwb9C
AZURE_CLIENT_APP_ID=dsfsdf-c2d4-47f6-dfsdfsf-eaf5117f7d7f
AZURE_USE_AUTHENTICATION=false
AZURE_ENFORCE_ACCESS_CONTROL=false
AZURE_ENABLE_GLOBAL_DOCUMENT_ACCESS=false

Rawat, Rahul 0 Reputation points

2025-02-17T06:49:03.8766667+00:00

When i can get next update please .. Or if you want we can meet over teams call as well. If this works as expected we will be taking it for prod.
Vikram Singh 2,590 Reputation points Microsoft Employee Moderator

2025-02-19T06:53:57.6933333+00:00
Hi Rawat, Rahul,

Thanks for getting back to me.

I noticed that you have set permissions at both the resource and resource group levels but not at the subscription level. To successfully deploy and run your resources, you'll need to ensure the following Azure account permissions:

Role Assignments: Your Azure account must have Microsoft.Authorization/roleAssignments/write permissions. This can be achieved by having roles such as Role Based Access Control (RBAC) Administrator, User Access Administrator, or Owner. If you don't have subscription-level permissions, you must be granted RBAC for an existing resource group and deploy to that group.

Deployment Permissions: Your Azure account also needs Microsoft.Resources/deployments/write permissions at the subscription level.

Please make sure these permissions are in place to proceed with your deployment.

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

Thanks
Vikram Singh 2,590 Reputation points Microsoft Employee Moderator

2025-02-21T09:27:42.3+00:00

Hi Rawat, Rahul,

Greetings.

Just following up to check if my suggestion helped. Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Thank you
Vikram Singh 2,590 Reputation points Microsoft Employee Moderator

2025-02-24T04:02:13.9033333+00:00

Hi Rawat, Rahul,

Greetings.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.

Thank You.
Rawat, Rahul 0 Reputation points

2025-02-27T10:55:12.49+00:00
Thanks Vikram for all help and support.

Following are the Role assignment which helped me to resolved the permission issue with open AI demo python code.

Azure Open AI -

Azure AI developer

Cognitive services contributor

Azure Search ( Cognitive search service ) -

Search index data manager

Azure AI Administrator

1 answer

Your answer

Rawat, Rahul 0 Reputation points

2025-02-16T07:58:29.6766667+00:00

I am trying to setup locally on my mac book.
Vikram Singh 2,590 Reputation points Microsoft Employee Moderator

2025-02-17T05:51:35.77+00:00

Hi Rawat, Rahul,

Thanks for posting your question in Microsoft Q&A, apologize for any inconvenience caused on this.

The error indicates that the service principal you're using does not have the necessary permissions to access the API.

Here are a few steps you can take to resolve this issue:

Verify Role Assignments: Ensure that the service principal has the necessary roles assigned. In addition to the OpenAI Contributor Role, you should also assign the Azure AI Developer role or the Azure AI Administrator role.

Check Role Scope: Make sure that the role assignments are at the correct scope. The roles should be assigned directly to the Azure OpenAI resource via the Azure portal.

If the above steps do not resolve the issue, you can try the following workarounds:

Test with Owner Role: Temporarily assign the Owner role to the service principal to test if it's a permissions issue. If the error is resolved, it confirms that the issue is related to permissions.

API Key Authentication: If Azure RBAC is not working, consider using API key authentication. Ensure that the API keys are correct, not expired, and properly set in the WebApp Environment variable AZURE_OPENAI_KEY.

By following these steps, you should be able to resolve the permission issue and get your setup working locally on your MacBook.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.

Cheers
Rawat, Rahul 0 Reputation points

2025-02-17T06:43:59.6566667+00:00

Hi @Vikram Singh

I tried above steps and assigned all mentioned roles however still same issue i am getting no luck.

Please find my .env file and Role Assignment screen shot let me what further need to be follow to resolve this issue.

I have kept both API and service principle client ans secret in .env file.

AZURE_ENV_NAME=dev AZURE_SUBSCRIPTION_ID=mnsdafnjksdfnkjsdfnkjds AZURE_TENANT_ID=fbejkdjksdfkjasdnfs14e1 AZURE_STORAGE_ACCOUNT=cliapp AZURE_STORAGE_CONTAINER=user AZURE_USERSTORAGE_ACCOUNT=cliapp AZURE_USERSTORAGE_CONTAINER=user ## OPEN AI SERVICE AZURE_OPENAI_SERVICE=dev-open AZURE_OPENAI_GPT4V_DEPLOYMENT= AZURE_OPENAI_GPT4V_MODEL= AZURE_OPENAI_CHATGPT_DEPLOYMENT=gpt-4o-mini AZURE_OPENAI_CHATGPT_MODEL=gpt-4o-mini AZURE_OPENAI_EMB_DEPLOYMENT=text-embedding-ada-002 AZURE_OPENAI_CUSTOM_URL= AZURE_OPENAI_API_KEY=dnjfjklnfkjsdnfkdjsfnfkjdsf AZURE_OPENAI_ENDPOINT=https://dfnfk-open.openai.azure.com/ AZURE_OPENAI_API_VERSION=2024-10-21 ## AZURE AI SEARCH AZURE_SEARCH_SERVICE=az-ai-search-box AZURE_SEARCH_INDEX=gptkbindex AZURE_SERVER_APP_ID=dsfsdf-c2d4-47f6-jfnjlksdnfkjsldnfdsaf-eaf5117f7d7f AZURE_SERVER_APP_SECRET=lWV8Q~fsdfsdfsdfsdfs-pirMwb9C AZURE_CLIENT_APP_ID=dsfsdf-c2d4-47f6-dfsdfsf-eaf5117f7d7f AZURE_USE_AUTHENTICATION=false AZURE_ENFORCE_ACCESS_CONTROL=false AZURE_ENABLE_GLOBAL_DOCUMENT_ACCESS=false
Rawat, Rahul 0 Reputation points

2025-02-17T06:49:03.8766667+00:00

When i can get next update please .. Or if you want we can meet over teams call as well. If this works as expected we will be taking it for prod.
Vikram Singh 2,590 Reputation points Microsoft Employee Moderator

2025-02-19T06:53:57.6933333+00:00

Hi Rawat, Rahul,

Thanks for getting back to me.

I noticed that you have set permissions at both the resource and resource group levels but not at the subscription level. To successfully deploy and run your resources, you'll need to ensure the following Azure account permissions:

Role Assignments: Your Azure account must have Microsoft.Authorization/roleAssignments/write permissions. This can be achieved by having roles such as Role Based Access Control (RBAC) Administrator, User Access Administrator, or Owner. If you don't have subscription-level permissions, you must be granted RBAC for an existing resource group and deploy to that group.

Deployment Permissions: Your Azure account also needs Microsoft.Resources/deployments/write permissions at the subscription level.

Please make sure these permissions are in place to proceed with your deployment.

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

Thanks
Vikram Singh 2,590 Reputation points Microsoft Employee Moderator

2025-02-21T09:27:42.3+00:00

Hi Rawat, Rahul,

Greetings.

Just following up to check if my suggestion helped. Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Thank you
Vikram Singh 2,590 Reputation points Microsoft Employee Moderator

2025-02-24T04:02:13.9033333+00:00

Hi Rawat, Rahul,

Greetings.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.

Thank You.
Rawat, Rahul 0 Reputation points

2025-02-27T10:55:12.49+00:00

Thanks Vikram for all help and support.

Following are the Role assignment which helped me to resolved the permission issue with open AI demo python code.

Azure Open AI -

Azure AI developer

Cognitive services contributor

Azure Search ( Cognitive search service ) -

Search index data manager

Azure AI Administrator

Answer 1

Hi Rawat, Rahul,

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this!

Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer. Accepted answers show up at the top, resulting in improved discoverability for others.

Issue: How to fix - openai.AuthenticationError: Error code: 401 - {'error': {'code': 'PermissionDenied', 'message': 'Principal does not have access to API/Operation.

Solution: Following are the Role assignment which helped me to resolved the permission issue with open AI demo python code.

Azure Open AI -

Azure AI developer
Cognitive services contributor

Azure Search (Cognitive search service) -

Search index data manager
Azure AI Administrator

If your issue remains unresolved or have further questions, please let us know in the comments how we can assist. We are here to help you and strive to make your experience better and greatly value your feedback.

Cheers

Vikram Singh 2,590 Reputation points Microsoft Employee Moderator

2025-03-03T07:40:11.9966667+00:00

Hi Rawat, Rahul,

Greetings.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.

Thank You.

Share via

How to fix - openai.AuthenticationError: Error code: 401 - {'error': {'code': 'PermissionDenied', 'message': 'Principal does not have access to API/Operation.'}}

1 answer

Your answer