NoAuthenticationInformation error when trying to connect to AML datastore using identity-based access

Question

I registered an Azure Blob Storage as a datastore in Azure ML. I did not add any sas_token or account_key and according to your webiste: https://learn.microsoft.com/en-us/AZURE/machine-learning/how-to-identity-based-data-access?view=azureml-api-1"This omission indicates that Azure Machine Learning will use identity-based data access for authentication."

When I try to connect to it and download a file, it gives me an authentication error (See attached image). The error information I get is:

ClientAuthenticationError: Server failed to authenticate the request. Please refer to the information in the www-authenticate header.
RequestId:67bf78b6-801e-008a-1d54-07347b000000
Time:2023-10-25T15:06:41.1683481Z
ErrorCode:NoAuthenticationInformation
Content: 

Answer 1

Hello Wang, Yuchen (DFO/MPO)

Thanks for reaching out to us. It seems that you are encountering an authentication error when trying to connect to your Azure Blob Storage datastore in Azure ML.

According to the documentation you provided, if you did not provide a SAS token or account key when registering the datastore, Azure Machine Learning should use identity-based data access for authentication. This means that the datastore should be accessible using the managed identity of your Azure Machine Learning workspace.

To troubleshoot the issue, you can try the following steps:

Check that the managed identity of your Azure Machine Learning workspace has the necessary permissions to access the Azure Blob Storage account. You can do this by checking the access policies of the storage account and ensuring that the managed identity is listed as a contributor or owner.

Check that the connection string for the Azure Blob Storage datastore is correct. You can find the connection string in the Azure Machine Learning workspace under Datastores > [datastore name] > Connection string.

Check that the file you are trying to download exists in the Azure Blob Storage account and that you have the necessary permissions to access it.

Try providing a SAS token or account key when registering the datastore in Azure Machine Learning. This will bypass the identity-based data access and use credential-based authentication instead.

I hope this helps.