Azure OpenAI Service
An Azure service that provides access to OpenAI’s GPT-3 models with enterprise capabilities.
3,974 questions
I can create an AI agent in the Azure AI Foundry but can not use it even in the playground.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(185.6, 48%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EYJ%3C/text%3E%3C/svg%3E)
Yang Jun
0
Reputation points
Error
403: Service invocation failed!
Request: POST obotoken.vienna-swedencentral.svc/obotoken/v1.0/saveusertoken/v2
Status Code: 403 Forbidden
Error Code: UserError/ForbiddenError
Reason Phrase: Forbidden
Response Body: { "error": { "code": "UserError", "severity": null, "message": "AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance. Trace ID: Correlation ID: Timestamp: 2025-05-10 07:57:28Z The returned error contains a claims challenge. For additional info on how to handle claims related to multifactor authentication, Conditional Access, and incremental consent, see https://aka.ms/msal-conditional-access-claims. If you are using the On-Behalf-Of flow, see https://aka.ms/msal-conditional-access-claims-obo for details.", "messageFormat": null, "messageParameters": null, "referenceCode": null, "detailsUri": null, "target": null, "details": [], "innerError": { "code": "ForbiddenError", "innerError": null }, "debugInfo": null, "additionalInfo": null }, "correlation": { "operation": "", "request": "" }, "environment": "swedencentral", "location": "swedencentral", "time": "2025-05-10T07:57:28.4850896+00:00", "componentName": "obotoken", "statusCode": 403 }
Azure OpenAI Service
{count} votes
-
Yang Jun 0 Reputation points
2025-05-10T08:14:15.3433333+00:00 -
Yang Jun 0 Reputation points
2025-05-10T08:55:58.3833333+00:00 I can use my created base model in chat playground or create api client and requests using API keys. But can not do the same thing using DefaultAzureCredential (or Microsoft Entra ID ?) I do not know is it an issue with Microsoft Entra ID but I can not know what it is and I did not change anything when I create those actions on Azure AI Foundry. I also only copy the example code to run on my local.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 88%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESA%3C/text%3E%3C/svg%3E)
Saideep Anchuri 6,885 Reputation points Microsoft External Staff Moderator2025-05-11T04:02:20.0166667+00:00 Hi Yang Jun
The error you're encountering (403 Forbidden) indicates that access has been blocked by Conditional Access policies in Azure Active Directory (AAD). This typically happens when the access policy does not allow token issuance,
Here are some steps:
- They can review the Conditional Access policies in place and determine why your access is being blocked. They may need to modify the policies to allow your access.
- Review the Conditional Access policies configured in your Azure AD tenant. Ensure that the policies do not restrict access to the Azure AI Foundry or the specific service you are trying to use.
- Verify that the user or service principal you are using has the appropriate permissions assigned. You may need to assign roles such as Cognitive Services User or Cognitive Services OpenAI User to ensure access.
Kindly refer below link: role-based-access-control
Thank You.
-
Saideep Anchuri 6,885 Reputation points Microsoft External Staff Moderator
2025-05-12T00:37:02.41+00:00
Sign in to comment
Sign in to answer