PermissionDenied
azure.core.exceptions.ClientAuthenticationError: PermissionDenied
Stack trace
azure.core.exceptions.ClientAuthenticationError: (403) PermissionDenied: The client does not have permission to perform this action.
at azure.ai.openai._client._client._send_request(...) Why it happens
Azure OpenAI enforces Role-Based Access Control (RBAC) on resources. If the user or service principal calling the API lacks the necessary RBAC role assignments (like 'Cognitive Services OpenAI User'), the service denies access with a PermissionDenied error.
Detection
Monitor API call failures for 403 PermissionDenied errors and verify the identity used for authentication has the required RBAC roles assigned in the Azure portal or via CLI.
Causes & fixes
The Azure AD user or service principal lacks the 'Cognitive Services OpenAI User' RBAC role on the Azure OpenAI resource.
Assign the 'Cognitive Services OpenAI User' role to the calling identity on the Azure OpenAI resource via Azure Portal, CLI, or ARM templates.
The authentication token is obtained for a different tenant or subscription without access to the Azure OpenAI resource.
Ensure the token is acquired for the correct Azure tenant and subscription where the OpenAI resource exists and that the identity has RBAC permissions there.
Using an incorrect or expired API key or token that does not authenticate properly.
Refresh the authentication credentials and confirm the API key or token is valid and scoped for the Azure OpenAI resource.
Code: broken vs fixed
from azure.ai.openai import OpenAIClient
import os
client = OpenAIClient(os.environ['AZURE_OPENAI_ENDPOINT'], credential=None) # Missing credential causes PermissionDenied
response = client.get_models() # This line triggers PermissionDenied errorfrom azure.identity import DefaultAzureCredential
from azure.ai.openai import OpenAIClient
import os
credential = DefaultAzureCredential() # Use proper Azure AD credential
client = OpenAIClient(os.environ['AZURE_OPENAI_ENDPOINT'], credential=credential) # Fixed: added credential
response = client.get_models()
print(response) # Should succeed if RBAC roles are assignedWorkaround
If immediate RBAC role assignment is not possible, use an API key with sufficient permissions from the Azure portal as a temporary credential to authenticate the client.
Prevention
Implement automated RBAC role assignment during deployment pipelines and validate identity permissions before making API calls to avoid PermissionDenied errors.