Azure AI Inference SDK Authentication Audience invalid.

[mrm9084]

• Package Name: azure-ai-inference, azure-identity
• Package Version: 1.0.0b9, 1.21.0
• Operating System: Windows
• Python Version: 3.12.9

Describe the bug
The instructions inside of Azure AI Foundry for authenticating with Entra ID fail when using the Azure AI Inference SDK.

To Reproduce
Steps to reproduce the behavior:

1. Crate a standard hub and project, note API key validation is disabled.
2. Use the instructions to create a ChatCompletionClient

Running the code result in the following error:

ERROR:app:Error processing chat request: (None) Unauthorized. Access token is missing, invalid, audience is incorrect (https://cognitiveservices.azure.com), or have expired.
Code: None
Message: Unauthorized. Access token is missing, invalid, audience is incorrect (https://cognitiveservices.azure.com), or have expired.

Note: The instructions for the openai library work fine.

[github-actions]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @Azure/azure-ml-sdk @azureml-github.

[github-actions]

Hello @mrm9084. I'm an AI assistant for the azure-sdk-for-python repository. I have some suggestions that you can try out while the team gets back to you.

Suggestions:

• Ensure you are using the correct authentication scope for your endpoint. For Azure OpenAI endpoints (which require Entra ID authentication), add the credential_scopes parameter with the value ["https://cognitiveservices.azure.com/.default"] when constructing your client. See the Azure AI Inference README for guidance.

• Verify that the endpoint you are targeting matches the expected deployment type (Managed Compute vs Azure OpenAI). Tokens issued by Entra ID must have the correct audience. If you are not using the appropriate scope, the token may be targeted for a different resource.

• Double-check that your environment is correctly configured for Entra ID authentication (for example, via DefaultAzureCredential) so that the obtained token includes the correct audience claim.

By updating your client construction accordingly, the "audience is incorrect" error should be resolved.

The team will get back to you shortly, hopefully this helps in the meantime.

[trangevi]

Thanks for the report @mrm9084. To make sure I'm giving the best guidance (and can fix things in the right places), can you please let me know:

1. What the model endpoint is you're attempting to hit (redacted of any personal project information)?
2. Which specific instructions you're following for creating the chat client?

[mrm9084]

Thanks for the report @mrm9084. To make sure I'm giving the best guidance (and can fix things in the right places), can you please let me know:

1. What the model endpoint is you're attempting to hit (redacted of any personal project information)?
2. Which specific instructions you're following for creating the chat client?

1. https://[my-endpoint].openai.azure.com/openai/deployments/gpt-4o-mini/chat/completions?api-version=2025-01-01-preview
2. In Azure AI Foundry there are connection instructions for language/authentication type when you select a model.