Azure AI Foundry API key access fails with “not authorized”

Assign Foundry User to your identity at the Foundry resource scope; that role includes the exact management-plane action Microsoft.CognitiveServices/accounts/listKeys/action, which retrieves KEY1 and KEY2.^1^

Grant and verify access

An identity with role-assignment permission—Owner or User Access Administrator at the applicable scope—should:

1. Open Azure portal → your Foundry resource → Access control (IAM).
2. Select Add → Add role assignment.
3. Select Foundry User.
4. Select your user identity, then Review + assign.
5. Assign it directly on the Foundry resource, or at an inherited parent scope if your organization intentionally manages access there.

Because Foundry roles were recently renamed, some interfaces might still show Azure AI User. The current Foundry User role definition ID is:

53ca6127-db72-4b80-b1b0-d745d6d5456d

The role name changed, but its ID and core permissions did not.^2^

Verify the effective assignment:

RESOURCE_ID="/subscriptions/[Subscription ID] ID]/resourceGroups/[Resource Group] Group]/providers/Microsoft.CognitiveServices/accounts/<resource-name>"

az role assignment list \
  --assignee "<your-principal-id>" \
  --scope "$RESOURCE_ID" \
  --include-inherited \
  --output table

Then retrieve both keys directly:

az cognitiveservices account keys list \
  --name <resource-name> \
  --resource-group <resource-group> \
  --query "{KEY1:key1, KEY2:key2}" \
  --output json

The documented command returns the access keys of the Cognitive Services/Foundry account.^3^

The underlying operation is specifically:

Microsoft.CognitiveServices/accounts/listKeys/action

Key regeneration is a separate, more privileged operation:

Microsoft.CognitiveServices/accounts/regenerateKey/action

Azure documents these as distinct management-plane actions.^4^

Why the playground can work while keys remain unavailable

Playground inference is a data-plane operation, while listing or rotating resource keys is a control-plane operation. Therefore, successful model invocation does not by itself prove that your identity can retrieve account keys.^5^

If Foundry User grants more access than your policy permits, create a custom role containing only the required read operations and Microsoft.CognitiveServices/accounts/listKeys/action, then assign it at the resource scope. Do not add regenerateKey/action unless the identity must rotate keys.

If this is actually a separately managed Azure OpenAI/Cognitive Services resource backing the project rather than the new Foundry resource, open that underlying resource in Azure portal and manage access under its Access control (IAM). The same listKeys/action operation applies, but the applicable role model and resource scope must match that underlying account.

Microsoft Support access

A support engineer can verify resource state, RBAC assignments, authorization failures, and service logs when provided the tenant, subscription, and resource IDs through a private support channel. Do not post those identifiers—or any keys—in a public Q&A thread.^6^

Microsoft engineers do not have default access to customer data. If exceptional elevated access is required, it follows a just-in-time process and, for supported services and data-access scenarios, can require a Customer Lockbox request that your organization approves.^7^

Treat support as a path to diagnose the authorization failure, not as a way to obtain or disclose KEY1/KEY2. Retrieve the keys using your authorized identity after the correct RBAC assignment is effective, and store them in a secret store rather than sending them in a ticket. For a production ServiceNow integration, prefer Microsoft Entra ID authentication if the integration supports it; API keys are resource-wide static secrets without per-caller RBAC granularity.^5^

References

1. Azure built-in roles for AI + machine learning
2. Role-based access control for Microsoft Foundry
3. Create and deploy an Azure OpenAI in Azure AI Foundry Models resource (cli)
4. Azure permissions for AI + machine learning
5. Authentication and authorization in Microsoft Foundry
6. Get Azure help through Priority Community Support (PCS)
7. Customer Lockbox for Microsoft Azure