Unable to change Azure ML system datastore authentication from AccountKey to Identity for UAI-only workspace

Mustapha Yussif 25 Reputation points Microsoft Employee
2026-08-06T21:45:59.2166667+00:00

We have an existing Azure Machine Learning workspace created with only a user-assigned managed identity. We need to change its default storage access type from AccountKey to Identity without recreating the workspace.

Current configuration

  • Workspace identity type: UserAssigned
  • primaryUserAssignedIdentity is configured
  • systemDatastoresAuthMode: accesskey
  • Storage account shared-key access is disabled
  • Workspace uses an AML managed VNet
  • Blob and File private endpoints are approved
  • The UAI has the required permissions, including:
    • Contributor and Key Vault Administrator on the workspace Key Vault
    • Storage Account Contributor
    • Storage Blob Data Contributor
    • Storage File Data Privileged Contributor

The system datastores have inconsistent authentication:

  • workspaceblobstore: NoneCredentialConfiguration/identity-based
  • workspacefilestore: AccountKey

Error

When changing the workspace storage access type to Identity in the Azure portal, Azure ML attempts to update workspacefilestore and fails:

Credential Service error due to user error.
This can occur if the system assigned managed identity of the workspace
does not have access to the key vault.

Please add workspace managed identity as Contributor for the key vault
associated with the workspace.

Please make sure that you are passing valid secret names.

The inner response is 404 NotFound from the Azure ML datastore Credential Service.

Troubleshooting performed

  1. Verified the UAI's Key Vault and storage role assignments.
  2. Changed the datastore credentials to NoneCredentialConfiguration. It failed with the same error.
  3. Created another Azure Files datastore and made it the default. The workspace update still reconciles the fixed system datastore named workspacefilestore.
  4. Deleted workspacefilestore through the SDK and ARM REST API. DELETE returns 204, but the datastore remains visible through both ARM and Azure ML. Its original creation timestamp is unchanged.
  5. Attempted to add a system-assigned identity alongside the existing UAI. Azure ML rejected the update:
Not supporting updating workspace identity to
SystemAssigned,UserAssigned when workspace's identity is UserAssigned

Questions

  1. Is changing systemDatastoresAuthMode from accesskey to Identity supported for an existing UAI-only workspace?
  2. Is there a supported way to repair or reset the internal credential associated with the platform-managed workspacefilestore?
  3. Can Microsoft perform a backend migration without recreating the workspace?
  4. Why does Credential Service require a system-assigned identity when the workspace has a configured primary UAI with all required permissions?

Recreating the workspace is not currently an acceptable option.

Azure Machine Learning
Answer accepted by question author
Manish Deshpande 8,215 Reputation points Microsoft External Staff Moderator
2026-09-18T05:21:27+00:00

Hello @Mustapha Yussif

As the next troubleshooting step for the Credential Service / 404 NotFound error you're seeing, please try the following sequence. This follows the process outlined in Microsoft's documentation, Change storage account access keys – Azure Machine Learning.

Step 1: Regenerate the storage account access keys
In the Azure Portal, go to your storage account → Access keys → regenerate key1 and/or key2 (or use the Azure CLI/PowerShell if you prefer). Save the new key value somewhere secure — you'll need it if you plan to re-register any datastores later.

Step 2: Sync the new keys to the Azure ML workspace
Normally, the Azure Machine Learning workspace automatically synchronizes to the new key and begins using it within about an hour. Since we want this applied immediately, please force the sync manually:

  1. Sign in to the Azure subscription that contains the workspace using the Azure CLI, and confirm (via az account show or similar) that the active subscription is the same one hosting the Azure ML workspace.
  2. Run the sync command: 
az ml workspace sync-keys -n myworkspace -g myresourcegroup

Replace myworkspace with your actual Azure ML workspace name, and myresourcegroup with the resource group that contains it.

  1. If you get an error saying the ml extension isn't installed, install it first with az extension add -n ml, then re-run the sync-keys command.
  2. This command automatically syncs the new storage account keys to the workspace.

Step 3: Re-register any affected datastores (if applicable)
If the storage account is also used as a registered datastore (not just for workspace-level storage like logs, models, and snapshots), you'll also need to re-register the datastore(s) that use this storage account, either through the SDK or Azure ML studio. Updating only the workspace key or only the datastore credentials — but not both — can leave things in an inconsistent state and cause further errors, so please make sure both are updated together.

Step 4: Retry switching the storage access mode to Identity
Once the key sync (and any datastore re-registration) is confirmed complete, please retry changing the workspace storage access mode from AccountKey to Identity.

Thanks,
Manish.

Was this answer helpful?

1 person found this answer helpful.
0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.