Authentication Failed This flow was created by [my name], but access to the workspace and default storage account allows you to edit it. Clone it to avoid accidental overwrites.

Question

Hi All,

I created a Azure foundry hub, within which i have created a project. I had created a prompt within the project. Once done, When i try to open it, It throws following error:

Authentication Failed

This flow was created by [my name], but access to the workspace and default storage account allows you to edit it. Clone it to avoid accidental overwrites.

Permissions are set as follows:	Identities	Storage Account	Hub		Project	open ai service hud models	key vault
AI Hub Managed Identity	Blob Contributor, File Data Privileged Contributor	Azure AI Administrator		Azure AI Administrator	Azure AI Administrator	Azure AI Administrator, KeyVault Administrator
AI Project Managed Identity	Blob Contributor, File Data Privileged Contributor	na		na	na	Azure AI Administrator, KeyVault Administrator
Me	Blob Contributor, File Data Privileged Contributor	Owner		Owner	Owner	na

Let me know if you guys have any solution to this.

Answer 1

Hello RayDev,

I understand this is a confusing issue with Prompt Flow storage, and it's not about your Azure RBAC roles (like Owner or Contributor), but about the underlying file-system permissions.

Thank you for that excellent follow-up and for confirming your permissions.
A special thanks to our volunteer, Amira for accurate diagnosis.

However, I will try to provide a deeper explanation of what is happening and I will answer your query "if there is a file or folder level access required and how to achieve it."

The Problem: RBAC vs. POSIX ACLs

Your permissions (Owner, Blob Contributor, File Data Privileged Contributor) are the highest possible. Your test—accessing the files in the Azure portal—confirms that your Azure RBAC (IAM) permissions are working perfectly.

However, Azure Data Lake Storage (ADLS) Gen2, which Prompt Flow uses, has a second, hidden permission model called POSIX ACLs (Access Control Lists).

• Azure Portal (what you used): The portal's Storage Explorer often uses your high-level File Data Privileged Contributor RBAC role to show you the files, bypassing the ACLs. This gives a false sense of security.
• AI Foundry Studio (what is failing): The Prompt Flow backend interacts with the storage as a filesystem. It requires the POSIX ACLs to be correct.

The Authentication Failed error is misleading. It's an Authorization Failure at the file-system (ACL) level because the AI Studio (acting on your behalf or using its own identity) is being denied read or write access by the ACLs on that specific folder.

The Solution: How to Check and Fix the ACLs

You need to manually check and grant permissions at the folder level for both you and your AI Project's Managed Identity.

1. In the Azure portal, go to your Storage Account.
2. From the left menu, open Storage Explorer (preview).
3. Navigate to your blob container, and then drill down to your flow's folder: /Users/<your-UPN>/promptflow/<flow-name>
4. Right-click on your <flow-name> folder and select Manage Access.

Here, you will see the real file-system permissions. You need to ensure the following:

1. Your User Account ("Me"): Your user (******@domain.com) should be listed with Read, Write, and Execute permissions.
2. AI Project's Managed Identity (Most Likely Fix): The AI Studio often uses the Project's Managed Identity to manage flow files. This identity also needs permission.
   • Click Add (or "Add principal").
   • Search for the name of your AI Project's Managed Identity.
   • Grant it Read, Write, and Execute permissions.
   • Crucially: When adding/editing, make sure you also apply this to the "Default" ACLs. This ensures any new files created in the flow inherit the correct permissions.

After you've granted rwx permissions at the folder level to your Project's Managed Identity, go back to the AI Studio and try opening the flow again. This should resolve the authentication failure.

---

I hope this helps. Please accept and vote for the answer to help other members of the community. Thank you for helping to improve Microsoft Q&A!

Answer 2

Hello !

Thank you for posting on Microsoft Learn Q&A.

I think your issue is with the storage access to the flow files because prompt flow stores each flow under your project default ADLS Gen2 container at a POSIX path like:

/Users/<your-UPN>/promptflow/<flow-name>/flow.dag.yaml

If your user doesn’t have both RBAC on the storage account and POSIX ACLs on that folder path, the portal can’t read the DAG file and leads to auth failure. https://learn.microsoft.com/en-us/answers/questions/2114208/authentication-failed-when-creating-prompt-flow

Answer 3

Hi @Nikhil Jha , @Amira Bedhiafi

Thank you so much for your response. Unfortunately, the issue was from our IT team. As the prompt flow downloads the YAML file to read the content and create the flow. The IT team had restricted the download access to the storage account, which caused the issue. I discussed and provided download access to the storage account. I am now able to view it.