A developer asks a security engineer why their Azure AI services application is getting 403 errors when using a managed identity to call Azure OpenAI. The managed identity is assigned the 'Cognitive Services OpenAI User' role on the Azure OpenAI resource. What is the most likely cause?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because even when a managed identity has the correct RBAC role assigned, the application code must be updated to acquire a bearer token using the managed identity credential and pass it as an Authorization header instead of using the API key. The 403 is most likely because the code is still sending an API key while the resource may require Entra ID auth.
Full explanation below image
Full Explanation
B is correct because even when a managed identity has the correct RBAC role assigned, the application code must be updated to acquire a bearer token using the managed identity credential and pass it as an Authorization header instead of using the API key. The 403 is most likely because the code is still sending an API key while the resource may require Entra ID auth. A is incorrect because managed identities are fully supported with Azure OpenAI using Entra ID token-based authentication. C is incorrect because 'Cognitive Services OpenAI User' grants access to inference endpoints including completions and chat completions. D is incorrect because the managed identity does not need a subscription-level Reader role to make API calls to Azure OpenAI.