Issues connecting to Azure AI Foundry models using MS Entra ID from Python

Question

I am trying to connect a non-Azure OpenAI embedding model in AI Foundry using Microsoft Entra ID.

I don't have an issue connecting to Azure OpenAI embedding models using Microsoft Entra ID.

After creating a client and executing the following simple code:

model = EmbeddingsClient(
    endpoint=endpoint,
    credential=DefaultAzureCredential(),
    model=model_name
)

response = model.embed(
    input=["first phrase","second phrase","third phrase"],
)

I get the following error when "response" is created:

Unauthorized. Access token is missing, invalid, audience is incorrect (https://cognitiveservices.azure.com or https://ai.azure.com), or have expired.

I have tried using the following in the code but I still have the issue

token_provider = get_bearer_token_provider(
    DefaultAzureCredential(), "https://cognitiveservices.azure.com/.default"
)

Answer 1

Hello Terrence Rideau,

Step 1

Go to your model endpoint, locate the OpenAI resource containing the embedding model

Step 2

Go to connected resource of your Azure AI project

Click on the resource (Azure OpenAI one) and switch to MS Entra id authentication as show in screenshot

Step 3

Click on the Azure OpenAI resource from connected resource

Please add your email address or ML studio as Cognitive Services User from "Add role assignment section of connected resource's IAM section.

Step 4

Do "az login" if you are testing from local terminal and authenticate your tenant prior

Reference - https://learn.microsoft.com/en-us/azure/ai-foundry/concepts/rbac-azure-ai-foundry

Then install OpenAI with below command

%pip install openai

Using default credentials, Please run below code (which can be procured from sample code section of your endpoint when switched to MS entra authentication on your endpoint)

import os
from azure.identity import DefaultAzureCredential, get_bearer_token_provider
from openai import AzureOpenAI

endpoint = "https://<yourazureopenAiurl>.openai.azure.com/openai/deployments/text-embedding-3-small/embeddings?api-version=2023-05-15" #endpoint copied from models+endpoints
model_name = "text-embedding-3-small"
deployment = "text-embedding-3-small"

token_provider = get_bearer_token_provider(DefaultAzureCredential(), "https://cognitiveservices.azure.com/.default")
api_version = "2024-02-01"


client = AzureOpenAI(
    api_version=api_version,
    azure_endpoint=endpoint,
    azure_ad_token_provider=token_provider,
)

response = client.embeddings.create(
    input=["first phrase","second phrase","third phrase"],
    model=deployment
)

for item in response.data:
    length = len(item.embedding)
    print(
        f"data[{item.index}]: length={length}, "
        f"[{item.embedding[0]}, {item.embedding[1]}, "
        f"..., {item.embedding[length-2]}, {item.embedding[length-1]}]"
    )
print(response.usage)

Output

data[0]: length=1536, [-0.00721184303984046, 0.007491494063287973, ..., 0.01611734740436077, -0.004887983202934265]
data[1]: length=1536, [-0.003025691257789731, 0.009231699630618095, ..., 0.029947662726044655, 0.020937401801347733]
data[2]: length=1536, [-0.013795719482004642, 0.031857650727033615, ..., 0.017506178468465805, 0.0226223636418581]
Usage(prompt_tokens=6, total_tokens=6)

Reference used -https://learn.microsoft.com/en-us/azure/ai-foundry/model-inference/how-to/configure-entra-id?tabs=python&pivots=ai-foundry-portal#understand-roles-in-the-context-of-resource-in-azure

Thank you.