Permission denied 401 when running AOAI Teams deployment preview

[jgezelscorp]

Hi

I've exported my bot from AOIA Studio and trying it out in the TeamsToolkit locally.
I've added a document into an Azure Search.

In the Config.json under the src/prompts/chat folder, the config looks ok and I added every key in the book that I can think off but
I always get a 401 error: Permission Denied: Principal does not have access to API/Operation.

(I'm using an owner account)

Any Idea?

[therealjohn]

You need to add the Azure role to the user assigned managed identity.

1. Go to the App Service
2. Select the Identity menu
3. You can remove the System assigned identity settings - that isn't used for you with API Keys.
4. Select the User assigned tab
5. Select that identity resource
6. Select the Azure role assignments
7. Give that identity the Cognitive Services OpenAI User role
8. Wait for a few minutes until that takes affect
9. Try again

[jgezelscorp]

Hey John

Not sure I'm following here. Which App Service do you mean exactly?

I'm following this guide:

https://review.learn.microsoft.com/en-us/azure/ai-services/openai/concepts/use-your-data?branch=main&branchFallbackFrom=pr-en-us-277392&tabs=ai-search%2Cteams#tabpanel_2_teams

And these are some of the log files.

(I'm also wondering, in the Env files there is no API key for the model deployment either so I'm guessing this is covered by the TeamsToolkit user that is used ?)

[jgezelscorp]

Ok solved it. Make sure, even if using a global admin/Subscription owner, you need the cognitive services openAI user/Contributor role.
So that clears up the "Who is that Principal" question and the search key, you can find in several places: AI Studio & Azure AI Search like I assumed.

Thanks for your help