project.inference.get_chat_completions_client() not working - Principal does not have access to API/Operation.

[jakeatmsft]

Name: azure-ai-inference
Version: 1.0.0b8
Summary: Microsoft Azure AI Inference Client Library for Python
Home-page: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/ai/azure-ai-inference
Author: Microsoft Corporation
Author-email: azpysdkhelp@microsoft.com
License: MIT License
Location: C:\Users\jacwang\AppData\Local\anaconda3\envs\lab\Lib\site-packages
Requires: azure-core, isodate, typing-extensions
Required-by:

When running following ecample:
https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/ai/azure-ai-projects/samples/inference/sample_chat_completions_with_azure_ai_inference_client.py

  chat = project.inference.get_chat_completions_client() # Error here
    messages = [
        {
            "role": "system",
            "content": "You are an AI assistant that tells jokes for toddlers.",
        },
        {"role": "user", "content": "Hey, can you tell a joke about teddy bear?"},
    ]
    print(f"Sending request to model '{model}' with messages: {messages}")
    
    response = chat.complete(
        model=model,
        messages=messages,
    )

I get the following error:
ClientAuthenticationError: (PermissionDenied) Principal does not have access to API/Operation.
Code: PermissionDenied
Message: Principal does not have access to API/Operation.

Permissions granted:
User -

• Owner - Everything
• AI Developer - AI Service
• Azure OpenAI User - AI Service

Project (SMI)

• AI Developer - AI Service

Hub (SMI)

• AI Developer - AI Service

Expected behavior
Expected completion returned.

[github-actions]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @bojunehsu @vkurpad.

[github-actions]

Hello @jakeatmsft. I'm an AI assistant for the azure-sdk-for-python repository. I have some suggestions that you can try out while the team gets back to you.

• Confirm that the authenticated principal has been granted permissions for the specific inference endpoint. You may need to assign or update roles so that the identity used by your client (whether a managed identity, DefaultAzureCredential, or API key) has rights to call the chat completions API. Learn more about role assignments.

• Verify that you’re using the correct endpoint and authentication parameters. In your sample, ensure the client is properly created with the expected credentials (for example, with AzureKeyCredential or DefaultAzureCredential) and that the endpoint URL is accurate.

• Double-check the model deployment name and API version. When using Azure OpenAI endpoints, you may need to provide the correct api_version (for example, "2024-06-01"). See the Azure AI Inference documentation for details.

• Review your Azure role assignments and the permissions granted to the principal (both at the project and hub levels). Sometimes the error indicates that while the role is assigned, it may not include this specific API/operation. Consider validating the range of allowed actions for the assigned role.

These steps should help resolve the PermissionDenied error you’re encountering.

The team will get back to you shortly, hopefully this helps in the meantime.

[dargilco]

@jakeatmsft To do inference using OpenAI models, you will need Cognitive Services OpenAI User or Cognitive Services OpenAI Contributor role (see https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/role-based-access-control)
To do inference using non-OpenAI models (e.g. Mistral-large-2407), you will need "Cognitive Services User" role

[github-actions]

Hi @jakeatmsft. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.