What are the permissions needed for a user to deploy chat as a web app in Azure OpenAI?

Question

What are the permissions needed for a user to deploy chat as a web app in Azure OpenAI?

Lavan Mahes 20

Getting the below error when trying to deploy the chat as a web app in Azure OpenAI. I have added admin role to the resource group (arg-ae-hnz-na-snd-genai-01) but still getting the same error.

Error:
The template deployment failed with error: 'Authorization failed for template resource '2934dee6-ed77-526e-b898-530cba829db5' of type 'Microsoft.Authorization/roleAssignments'. The client '******@TeWhatuOra.govt.nz' with object id 'bbc98685-99b7-45c6-9e41-31411d616582' does not have permission to perform action 'Microsoft.Authorization/roleAssignments/write' at scope '/subscriptions/d0411f07-b2fd-4a53-84bf-33eaa2e20136/resourceGroups/arg-ae-hnz-na-snd-genai-01/providers/Microsoft.CognitiveServices/accounts/dev-tuhi-clinicalnotesynthesis/providers/Microsoft.Authorization/roleAssignments/2934dee6-ed77-526e-b898-530cba829db5'.'.

Trace ID : 54aafebe-66d1-4220-a2fd-c529ff1298a5

Daniel Fang 1,060 Reputation points

2024-09-19T07:57:00.2766667+00:00

Hey Lavan

If we just read this specific error message, it is saying that the user (probably your account: ******@TeWhatuOra.govt.nz, as you are deploying the web app) does not have permission to update the role assignment of Microsoft.CognitiveServices under resource group arg-ae-hnz-na-snd-genai-01.

"The client '****@TeWhatuOra.govt.nz'** with object id 'bbc98685-99b7-45c6-9e41-31411d616582' does not have permission to perform action 'Microsoft.Authorization/roleAssignments/write' at scope '/subscriptions/d0411f07-b2fd-4a53-84bf-33eaa2e20136/resourceGroups/arg-ae-hnz-na-snd-genai-01/providers/Microsoft.CognitiveServices/accounts/dev-tuhi-clinicalnotesynthesis/providers/Microsoft.Authorization/roleAssignments/2934dee6-ed77-526e-b898-530cba829db5'.'."

So, I think you need to give your email/account more permission in CognitiveServices (try out Cognitive Services Contributor or go with Owner as a test).
AshokPeddakotla-MSFT 36,016 Reputation points Moderator

2024-09-20T13:39:58.0133333+00:00

Lavan Mahes Just checking to see if you had a chance to review the below response.

Do let me know if that helps or have any other queries.

If the response helped, please do click Accept Answer and Yes for was this answer helpful.

Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.

Answer accepted by question author

0 additional answers

Your answer

Daniel Fang 1,060 Reputation points

2024-09-19T07:57:00.2766667+00:00

Hey Lavan

If we just read this specific error message, it is saying that the user (probably your account: ******@TeWhatuOra.govt.nz, as you are deploying the web app) does not have permission to update the role assignment of Microsoft.CognitiveServices under resource group arg-ae-hnz-na-snd-genai-01.

"The client '****@TeWhatuOra.govt.nz'** with object id 'bbc98685-99b7-45c6-9e41-31411d616582' does not have permission to perform action 'Microsoft.Authorization/roleAssignments/write' at scope '/subscriptions/d0411f07-b2fd-4a53-84bf-33eaa2e20136/resourceGroups/arg-ae-hnz-na-snd-genai-01/providers/Microsoft.CognitiveServices/accounts/dev-tuhi-clinicalnotesynthesis/providers/Microsoft.Authorization/roleAssignments/2934dee6-ed77-526e-b898-530cba829db5'.'."

So, I think you need to give your email/account more permission in CognitiveServices (try out Cognitive Services Contributor or go with Owner as a test).
AshokPeddakotla-MSFT 36,016 Reputation points Moderator

2024-09-20T13:39:58.0133333+00:00

Lavan Mahes Just checking to see if you had a chance to review the below response.

Do let me know if that helps or have any other queries.

If the response helped, please do click Accept Answer and Yes for was this answer helpful.

Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.

Answer 1

AshokPeddakotla-MSFT 36,016 Moderator

Lavan Mahes Greetings & Welcome to Microsoft Q&A forum!

Make sure that you're assigned at least the Cognitive Services Contributor role for the Azure OpenAI resource.

The following table summarizes the RBAC role assignments needed for all Azure resources associated with your application.

User's image

For more details, see Role-based access control for Azure OpenAI Service and Assign Azure roles using the Azure portal.

Do let me know if that helps or have any further queries.

0 comments

Share via

What are the permissions needed for a user to deploy chat as a web app in Azure OpenAI?

0 additional answers

Your answer