Azure job requires interactive authentication every time

Question

I'm running a neural network on azure and it's working except it requires me to sign in with a device code for every job that runs. This is an issue for when I want to run long studies with multiple jobs and can't authenticate every job.

I've tried to use the azure CLI authentication with the following code:

cli_auth = AzureCliAuthentication()
ws = Workspace(subscription_id="id",
               resource_group="rsgp",
               workspace_name="ws", auth=cli_auth)

When I do that, I recieve the error: "Could not retrieve user token. Please run 'az login'"
This happens when I login using az login before a run as well.

I've also tried using the default credential before calling the workspace instead of using CLI, using this code:

credential = DefaultAzureCredential()


client = ResourceManagementClient(
    credential=credential,
    subscription_id="id"
)

This is functional, but I still need to log in manually for every job.

Any help would be appreciated! Thanks!

Answer 1

@SydneyD I think you should be using service principal authentication for automated processes. Detailed steps to create a service principal are documented in this notebook along with other available options.

To summarize, you set a service principal with the required access role and then use the same while defining your workspace.

import os  
from azureml.core.authentication import ServicePrincipalAuthentication  
  
svc_pr_password = os.environ.get("AZUREML_PASSWORD")  
  
svc_pr = ServicePrincipalAuthentication(  
    tenant_id="my-tenant-id",  
    service_principal_id="my-application-id",  
    service_principal_password=svc_pr_password)  
  
  
ws = Workspace(  
    subscription_id="my-subscription-id",  
    resource_group="my-ml-rg",  
    workspace_name="my-ml-workspace",  
    auth=svc_pr  
    )  
  
print("Found workspace {} at location {}".format(ws.name, ws.location))  

Service principal password can be set as environment variable if it is for local testing or can be retried using Azure keyvault or a secret variable in Azure DevOps.
Hope this helps!!

If an answer is helpful, please click on or upvote which might help other community members reading this thread.