AuthenticationError: Error code: 401 - {'error': {'code': 'PermissionDenied', 'message': 'Principal does not have access to API/Operation.'}}

Hi @Orlando Herrera

Thank you for reaching out to the Microsoft Q&A Forum.

The 401 "PermissionDenied" error suggests that the service principal lacks the necessary permissions to access the Azure OpenAI API. Ensure the service principal is assigned the Cognitive Services Contributor role directly on the Azure OpenAI resource via the Azure portal. Confirm that the role assignment is at the correct scope and that there are no restrictive Azure AD Conditional Access policies in place. Also, review the Azure Activity Logs for any denied actions. If the issue persists, temporarily assign the Owner role to test if it's a permissions issue.

@Orlando Herrera

We haven’t heard from you on the last response and was just checking back to see if you got a chance to try above suggestions.

Thank you.

@dupammi

I believe that to resolve this error, the role that needs to be assigned is Azure AI Developer, not the role mentioned in your response. Could you please double-check the actual situation?

@dupammi I believe that to resolve this error, the role that needs to be assigned is Azure AI Developer, not the role mentioned in your response. Could you please double-check the actual situation?

This is an old post. But in case someone comes here looking for answer, Quincy Qu is correct and you have to assign Azure AI Developer role or Azure AI Administrator role, NOT Cognitive Services Contributor. I tested and the only thing worked for me was AI Developer Role.

var builder = Kernel.CreateBuilder().AddAzureOpenAIChatCompletion(

endpoint: endPointUrl,

deploymentName: deploymentName,

credentials: new DefaultAzureCredential(new DefaultAzureCredentialOptions { TenantId = tenantId })

);