Azure CLU Evaluation Job Failing with "Invalid Certificate" Error - Cross-Region, Cross-Subscription, 3+ Days

Kunal Jangra 5 Reputation points
2026-05-18T08:53:50.0266667+00:00

Hi,

CLU evaluation jobs have been consistently failing for 3+ days across multiple regions and subscriptions with this error:

Evaluation Job Failed: Http client call failed, 
reasonPhrase: Unauthorized, content:

Copy

Key Facts

Training completes 100% successfully every time

Evaluation fails within 10-12 seconds

Same training data worked fine 3 days ago

Tried multiple regions, subscriptions, and both Standard and Advanced training modes

Azure status page shows Language Service as healthy

This looks like an internal certificate issue in the shared CLU evaluation pipeline on Azure's side since nothing changed on my end.

Has anyone else seen this recently? Any workaround other than deploying the untested trained model directly?

Azure Language in Foundry Tools
Azure Language in Foundry Tools

An Azure service that provides natural language capabilities including sentiment analysis, entity extraction, and automated question answering.

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sina Salam 31,456 Reputation points Volunteer Moderator
    2026-05-31T13:49:21.2766667+00:00

    Hello Kunal Jangra, Singh Sanatya, and Dale Ellis,

    Welcome to the Microsoft Q&A and thank you for posting your questions here.

    I understand that you are having Azure CLU Evaluation Job Failing with "Invalid Certificate" Error - Cross-Region, Cross-Subscription, 3+ Days.

    Your CLU project is not failing because of your data, region choice, subscription, or training mode. For now, there is no documented customer-side certificate fix for CLU evaluation.

    What you can do now:

    Open an Azure support via your Portal request against Cognitive Services / Azure Language, include the failing job IDs, UTC timestamps, subscription IDs, regions, resource/project names, and the exact error, enable Advanced diagnostic information, and ask for product team escalation for CLU evaluation pipeline authorization failure.

    Do not deploy from the failed run. After Microsoft fixes the backend, rerun training/evaluation and validate success using the official CLU evaluation summary/result endpoints or the Conversation Authoring SDK.

    Use the following links for references:

    I hope this is helpful! Do not hesitate to let me know if you have any other questions, steps or clarifications.

    Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

    Was this answer helpful?

    0 comments
  2. Karnam Venkata Rajeswari 5,255 Reputation points Microsoft External Staff Moderator
    2026-05-31T08:09:11.51+00:00

    Hello Kunal Jangra

    Welcome to Microsoft Q&A .Thank you for reaching out to us.

    Current observations strongly indicate a service-side issue affecting the CLU evaluation stage, rather than configuration, permissions, or dataset-related causes.

    The pattern consistently shows that:

    • Training completes successfully using the same dataset
    • Evaluation fails quickly within ~10–12 seconds
    • The issue occurs across multiple regions and subscriptions
    • Both Standard and Advanced training modes are affected
    • No recent changes were introduced in data or configuration
    • Service status indicates overall healthy availability

    This clearly indicates that the failure is occurring after successful training, specifically during the evaluation execution stage and not due to schema, dataset, or configuration issues.

    Based on this pattern and the current behavior is consistent with a transient service-side condition and is expected to stabilize as backend remediation progresses.

    As an optional temporary validation approach :

    • A trained model can be deployed
    • Inference can be executed using a controlled dataset
    • Predictions can be compared manually or through scripts

    This allows continued validation while the evaluation pipeline issue is being investigated.

    The following references might be helpful , please check them out

    Please let us know if the response was helpful

     

    Thank you

     

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the response was helpful. This will be benefitting other community members who face the same issue.

    Was this answer helpful?

    0 comments
  3. kagiyama yutaka 5,490 Reputation points
    2026-05-18T13:48:54.5533333+00:00

    I think CLU eval path just is not reachable right now, and the only safe step is one clean re‑run with a new project name and then sending the job IDs to Azure support.

    Was this answer helpful?

    0 comments

  4. AI answer

    2026-05-18T08:54:03.2066667+00:00

    The described CLU evaluation failures with Http client call failed, reasonPhrase: Unauthorized across regions and subscriptions are consistent with a platform-side issue in the evaluation pipeline rather than with training itself, especially since:

    • Training jobs complete successfully.
    • The same data worked recently.
    • The error occurs quickly and consistently across regions/subscriptions and training modes.

    From the available information, there is no documented client-side configuration or workaround in the CLU training/evaluation flow that addresses this specific “Unauthorized” evaluation failure. The CLU documentation only describes the normal behavior:

    • After training completes successfully, evaluation is automatically triggered using the testing set.
    • Only successfully completed jobs create a model; failed jobs do not produce a valid evaluation result.

    Given that:

    1. Retries in different regions and subscriptions already failed.
    2. Training is succeeding, which indicates that project configuration and data are valid.

    The recommended actions are:

    1. Avoid relying on evaluation until the issue is resolved, and do not assume evaluation failures reflect problems in the training data or configuration.
    2. If deployment without evaluation is acceptable for the scenario, deploy the trained model and validate it with a small, controlled set of test utterances in a non-production environment.
    3. Open a support ticket with Azure support, providing:
      • Subscription IDs and regions tested.
      • Approximate timestamps and job IDs of failing evaluation runs.
      • Confirmation that training succeeds but evaluation fails within ~10–12 seconds with Unauthorized.

    There is no documented client-side certificate rotation or configuration step for CLU evaluation analogous to the AKS or VM certificate issues in the context, so remediation must be handled by the service team.

    Separately, when integrating CLU models into applications, design the client experience so that:

    • Users confirm actions before they are processed.
    • There is always a correction path (for example, the ability to undo or adjust an action if the model output is wrong).

    These patterns help mitigate risk if a model must be deployed before full automated evaluation is available.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.