No authorizaed to Microsoft.ContainerInstance/containerGroups/write

Question

Following the "AI Fundamentals with Azure" course on Udacity, I went through all the practical sections up to the model deployment, where I get the following error:

ACI Service request failed. Reason: The client '741cd1ab-df80-48f7-a693-7d3b59099a0c' with object id '741cd1ab-df80-48f7-a693-7d3b59099a0c' does not have authorization to perform action 'Microsoft.ContainerInstance/containerGroups/write' over scope '/subscriptions/e4814fa4-a27c-445b-baf3-a93f364bb7a1/resourceGroups/udacity-exercises/providers/Microsoft.ContainerInstance/containerGroups/predict-rentals2-utJr0KFWMkGUwzuOdIrD6Q' or the scope is invalid.  

What to check?

Thanks in advance.
Pietro

Answer 1

I too experienced the error which is essentially telling you that your Azure Machine Learning Workspace does not have permissions to create the Azure Container Instance. You can verify that the object id is in fact the id of the Azure Machine Learning Workspace by running the following Azure CLI command:
az ad sp show --id <add object id value here>

which in this case would be:

az ad sp show --id 741cd1ab-df80-48f7-a693-7d3b59099a0c

If this is the case then you will see in the output under alternativeNames key your ML workspace name.

With that established you now need to add the appropriate role to the managed identity associated with your ML workspace. I added the Azure Container Instance Contributor role but this did not appear to make any difference. I experimented and gave it the Contributor role (obviously not ideal - but in my case I was just doing a lab and the ML workspace was deleted 30 mins later) and I managed to successfully deploy the model