Azure ML won't create Workspace, giving Interservererror

Office 0 Reputation points
2025-04-26T21:07:06.79+00:00

33

Trying to create my first workspace and this is what keeps happening.

Gives an InternalServerError and the message is:

"code": "InternalServerError",
        "message": "{\"code\":\"Unauthorized\",\"message\":\"{\\\"error\\\":{\\\"code\\\":\\\"InvalidAuthenticationToken\\\",\\\"message\\\":\\\"The received access token is not valid: at least one of the claims 'puid' or 'altsecid' or 'oid' should be present. If you are accessing as application please make sure service principal is properly created in the tenant.\\\"}}\",\"details\":[]}"
    }
Azure Machine Learning
Azure Machine Learning
An Azure machine learning service for building and deploying models.
3,257 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Sina Salam 19,936 Reputation points
    2025-04-27T00:16:52.84+00:00

    Hello Office,

    Welcome to the Microsoft Q&A and thank you for posting your questions here.

    I understand that your Azure ML won't create Workspace, and it's giving Interservererror.

    Though, there is "general Internal Server Error" (500) is usually caused by a problem on Azure's side (like server problems or outages). But in your case, Azure ML catches that you are not properly authenticated (wrong account type, broken token, missing claims, wrong login method), but (badly) wraps it in a 500 error instead of returning a cleaner 401. The error message specifically says:

    Unauthorized

    InvalidAuthenticationToken

    Missing claims (oid, puid, altsecid)

    This is NOT a general server error but it's an authentication problem with your access token before Azure ML can even start doing anything.

    You can resolve this by the following steps:

    • If you're using a personal Microsoft account, you need to switch to an Azure Active Directory (Azure AD) account because personal Microsoft accounts aren't supported for Azure Machine Learning. You might have to create an Azure AD user or invite yourself as a guest into the tenant.
    • Make sure the service principal is properly set up in Azure AD and that the app has the necessary permissions. When you're authenticating, request the token for the correct audience, such as https://management.azure.com/.default.
    • When you log in using az login, ensure it shows an account type of "User" or "ServicePrincipal" linked to Azure AD. az login az account show
    • If you're doing this in a script or SDK, make sure you're using the DefaultAzureCredential or the correct login method.

    Relevant documentation

    Using Service principal

    Manage user roles

    I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.


    Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.