Azure Machine Learning
An Azure machine learning service for building and deploying models.
Azure ml | Stream access authentication error
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 27%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESD%3C/text%3E%3C/svg%3E)
Sanjay Dokula
0
Reputation points
Hi, I get this error when running a pipeline job which takes in data from my azure storage blob container
Error Code: ScriptExecution.StreamAccess.Authentication Native Error: error in streaming from input data sources StreamError(PermissionDenied(None)) => permission denied when access stream. Reason: None PermissionDenied(None) Error Message: Authentication failed when trying to access the stream. Make sure you have correct permissions set up. Err("")
I granted both storage account and storage blob data contrib permission to my compute cluster in azure ml workspace, the azure ml workspace itself and my user id. I am unable to figure out what permissions I need.
I use DefaultCredentials() to authenticate to my ml workspace and submit the job, which I suppose is using azureclicredentials() since I am logged in to azure cli using az login in my local
I greatly appreciate any help on this matter. Thank you.
Azure Machine Learning
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(297.6, 93%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAP%3C/text%3E%3C/svg%3E)
Aryan Parashar 3,695 Reputation points Microsoft External Staff Moderator2025-12-15T09:22:33.1333333+00:00 Hi Sanjay Dokula,
I understand how frustrating this issue can be, especially after assigning what appear to be the correct permissions. Thank you for your patience.The error is due to authentication failed while trying to connect to the storage account.Below are the steps to mitigate the error by verifying and enabling the required managed identity on the Azure ML compute:
Check whether the compute has a managed identity enabled
Run the following command to inspect the compute configuration:
az ml compute show --name <your-compute-name> --workspace-name <workspace> --resource-group <rg>Enable a system-assigned managed identity on the compute
If the compute does not have a managed identity enabled, run:
# Enable system-assigned managed identity az ml compute update --name <your-compute-name> \ --workspace-name <workspace> \ --resource-group <rg> \ --assign-identity [system]Supported documentation:
https://learn.microsoft.com/en-us/azure/machine-learning/how-to-identity-based-service-authentication?view=azureml-api-2&tabs=cli#workspace-identity-typesPlease let me know if this workaround resolves the issue.
-
Sanjay Dokula 0 Reputation points
2025-12-15T16:14:22.55+00:00 Hi aryan,
Yes, my compute has system assigned identity enabled.
{ "enable_node_public_ip": true, "id": "/subscriptions/sub_id/resourceGroups/azure_ml/providers/Microsoft.MachineLearningServices/workspaces/azure_ml_study/computes/cpu-med-cluster", "identity": { "principal_id": "principal_id", "tenant_id": "tenant_id", "type": "system_assigned" }, "idle_time_before_scale_down": 120, "location": "eastus2", "max_instances": 2, "min_instances": 0, "name": "cpu-med-cluster", "network_settings": {}, "provisioning_state": "Succeeded", "resourceGroup": "azure_ml", "size": "Standard_DS2_v2", "ssh_public_access_enabled": true, "tier": "dedicated", "type": "amlcompute" } -
Aryan Parashar 3,695 Reputation points Microsoft External Staff Moderator
2025-12-16T08:21:22.2+00:00 Hi Sanjay Dokula,
Could you verify the role assignment as shown below:az role assignment list \ --assignee <principal-id> \ --scope /subscriptions/<subscription-id>/resourceGroups/<storage-rg>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>If the assignment is not shown than use the below command:
# Use the principal_id from your compute cluster PRINCIPAL_ID="<your-principal-id-from-json>" # Grant Storage Blob Data Contributor role to the compute's managed identity az role assignment create \ --assignee $PRINCIPAL_ID \ --role "Storage Blob Data Contributor" \ --scope /subscriptions/<subscription-id>/resourceGroups/<storage-rg>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>Let me know if you still face issues.
Thank you for your patience.
-
Sanjay Dokula 0 Reputation points
2025-12-16T13:24:35.5533333+00:00 Hi aryan,
I have these roles assigned to the compute:
- Storage Blob Data Contributor
- Storage Account Contributor
- Storage Blob Data Reader
-
Aryan Parashar 3,695 Reputation points Microsoft External Staff Moderator
2025-12-23T08:05:48.8566667+00:00 Hi Sanjay Dokula,
Please verify the role assignment as shown below:
az role assignment list \ --assignee <principal-id> \ --scope /subscriptions/<subscription-id>/resourceGroups/<storage-rg>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>If the assignment is not shown than use the below command:
# Use the principal_id from your compute cluster PRINCIPAL_ID="<your-principal-id-from-json>" # Grant Storage Blob Data Contributor role to the compute's managed identity az role assignment create \ --assignee $PRINCIPAL_ID \ --role "Storage Blob Data Contributor" \ --scope /subscriptions/<subscription-id>/resourceGroups/<storage-rg>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>Let me know if you still face issues.
-
Sanjay Dokula 0 Reputation points
2025-12-27T09:18:36.5833333+00:00 Hi Aryan,
I posted a list of role assignments assigned to my compute earlier.
-
Aryan Parashar 3,695 Reputation points Microsoft External Staff Moderator
2025-12-29T07:22:02.3933333+00:00 Hi Sanjay Dokula,
Make sure your blob storage is registered as a datastore, as shown below:
from azure.ai.ml.entities import AzureBlobDatastore from azure.ai.ml import MLClient from azure.identity import DefaultAzureCredential ml_client = MLClient.from_config(credential=DefaultAzureCredential()) store = AzureBlobDatastore( name="", description="", account_name="", container_name="" ) ml_client.create_or_update(store)Here is supported documentation:
https://learn.microsoft.com/en-us/azure/machine-learning/how-to-datastore?view=azureml-api-2&tabs=sdk-identity-based-access%2Csdk-adls-identity-access%2Csdk-azfiles-accountkey%2Csdk-adlsgen1-identity-access%2Csdk-onelake-identity-access#create-an-azure-blob-datastoreLet me know if you still face issues.
Sign in to comment
Sign in to answer