Azure foundry ai project endpoint returns 401 on first attempt

Question

I'm running into a weird problem where the Azure foundry endpoint returns an unauthorized response the first time per endpoint. The second time, the call works. See screenshot:

So the first time GET /contentunderstanding/analyzers is accessed, it returns 401. The message returns to the service bus to be retried a minute later. The second time it works. Then in the same session, the POST doesn't work and returns a 401. A minute later, the whole thing retries and it works. This happens every time.

Code to acquire the token is in a DelegatingHandler:

private readonly DefaultAzureCredential _credential = new DefaultAzureCredential();

protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        AccessToken accessToken = await _credential.GetTokenAsync(new TokenRequestContext(_scopes), cancellationToken);
        request.Headers.Authorization = new AuthenticationHeaderValue("bearer", accessToken.Token);
        return await base.SendAsync(request, cancellationToken);
    }

_scopes is https://cognitiveservices.azure.com/.default, I also tried https://ai.azure.com/.default but it has the same problem.

This only happens when we run it on the app service. Locally it works like it should and there I'm connected through Azure AD. It's probably related to having the wrong token, but it's strange that the second attempt does work.

Do I have to give the app service more rights to the foundry resource? What am I missing?

Answer 1

Hi Wouter Schaekers

Please let us know the issue was resolved after using "Azure AI user" role and pin pointing token URL to - https://cognitiveservices.azure.com/.default

Thank you.