I have been working on a sample in my series of AI videos and this error drove me nuts and took me far too long to figure out and also I was being a bit stupid so Id like to share this and hopefully save someone else some time.

Error


Exception has occurred: CLR/System.ClientModel.ClientResultException
An exception of type 'System.ClientModel.ClientResultException' occurred in System.Private.CoreLib.dll but was not handled in user code: 'HTTP 403 (ServiceError: UserError)

Identity(object id: [OBJECT-ID]) does not have permissions for Microsoft.CognitiveServices/accounts/AIServices/agents/write actions. Please refer to https://learn.microsoft.com/en-us/azure/foundry/concepts/rbac-foundry to fix the permissions issue.

{
  "code": "UserError",
  "severity": null,
  "message": "Identity(object id: [OBJECT-ID]) does not have permissions for Microsoft.CognitiveServices/accounts/AIServices/agents/write actions. Please refer to https://learn.microsoft.com/en-us/azure/foundry/concepts/rbac-foundry to fix the permissions issue.",
  "messageFormat": null,
  "messageParameters": null,
  "referenceCode": null,
  "detailsUri": null,
  "target": null,
  "details": [],
  "innerError": {
    "code": "ForbiddenError",
    "innerError": null
  },
  "debugInfo": null,
  "additionalInfo": null
}'
   at OpenAI.ClientPipelineExtensions.<ProcessMessageAsync>d__0.MoveNext()
   at System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable`1.ConfiguredValueTaskAwaiter.GetResult()
   at OpenAI.Responses.ResponsesClient.<CreateResponseAsync>d__48.MoveNext()
   at OpenAI.Responses.ResponsesClient.<CreateResponseAsync>d__11.MoveNext()
   at Azure.AI.Extensions.OpenAI.ProjectResponsesClient.<CreateResponseAsync>d__19.MoveNext()
   at Azure.AI.Extensions.OpenAI.ProjectResponsesClient.<CreateResponseAsync>d__18.MoveNext()
   at Program.<<Main>$>d__0.MoveNext() in

What was I doing

I was writing some code with C# to call an agent hosted in Foundry with the Azure.AI.Projects SDK.

I am constructing the appropriate objects to make the call to the foundry agent and I am using Entra authentication.

AIProjectClient projectClient = new(
    endpoint: new Uri(endpoint),
    tokenProvider: new DefaultAzureCredential(),
    options: options);

It sometimes worked but mostly was getting a problem

What was happening

The thing that threw me was that I could not find the object id that was specified in the error message. Im checking my managed identities for APIM, foundry, I wondered if it might be a magic enterprise app that Microsoft uses behind the scenes. No users or groups that it maps to, nothing.

All to no avail.

In the end I realized that the object id belonged to a user I have in a different tenant. [Add your swear word of choice here]

What was happening was that I had multiple credentials logged in and the DefaultAzureCredential was picking different ones from the cache. In this case when it picked the credential from the user on the other tenant randomly it didnt work.

I tried various forms of logging out with minimal success and I didnt fancy having to repeatedly clear stuff whenever I come back to the sample.

The Workaround

As this is just a sample I changed to using AzureCliCredential so it picks the user logged in for my session in the VsCode terminal. This gave me the right user consistently.

AIProjectClient projectClient = new(
    endpoint: new Uri(endpoint),
    tokenProvider: new AzureCliCredential(),
    options: options);

Lesson learnt

If I deployed my app then id use DefaultAzureCredential so it picks up the managed identity but when you are developing locally if your machine has more than 1 user logged into Azure with cached tokens then you might get intermittent issues so AzureCliCredential can workaround this.

 

Buy Me A Coffee