A developer asks a security engineer why their Azure AI services application is getting 403 errors when using a managed identity to call Azure OpenAI. The managed identity is assigned the 'Cognitive Services OpenAI User' role on the Azure OpenAI resource. What is the most likely cause?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — the 403 usually means your app is still sending an API key instead of getting a bearer token from the managed identity and passing it in the Authorization header. Even with the right role assigned, the code has to switch to Entra ID token auth.
Full Explanation
The correct cause is that the application code is still using API key authentication instead of acquiring a token via the managed identity. Even when a managed identity has the correct RBAC role assigned, the application code must be updated to acquire a bearer token using the managed identity credential and pass it as an Authorization header instead of using the API key. The 403 is most likely because the code is still sending an API key while the resource may require Entra ID auth. The option claiming managed identities cannot be used with Azure OpenAI and that API keys must be used instead is incorrect because managed identities are fully supported with Azure OpenAI using Entra ID token-based authentication. The option saying the 'Cognitive Services OpenAI User' role only grants access to fine-tuning endpoints, not completions, is incorrect because that role grants access to inference endpoints including completions and chat completions. The option saying the managed identity requires an additional 'Reader' role at the subscription level to resolve the resource is incorrect because the managed identity does not need a subscription-level Reader role to make API calls to Azure OpenAI.