Azure AI Foundry Responses API returns 401 with Entra ID despite resource-scoped inference role

Question

Azure AI Foundry Responses API returns 401 with Entra ID despite resource-scoped inference role

Maurice Fluelling 0

I am testing a non-production Azure AI Foundry deployment using U.S. Data Zone Standard. Authentication uses Microsoft Entra ID; no API keys or desktop-embedded credentials are permitted.

Token acquisition succeeds. The evaluation identity was temporarily assigned Cognitive Services OpenAI User at the exact Foundry resource scope. After waiting more than five minutes for propagation, a single synthetic request to the Responses API returned HTTP 401 PermissionDenied before inference. No model tokens were consumed.

Could Microsoft clarify:

The currently supported Responses API endpoint and Entra token audience.
The least-privilege RBAC role and required assignment scope.
Whether the role must include Microsoft.CognitiveServices/accounts/OpenAI/responses/write or a newer equivalent.
Whether any Foundry project, provider, deployment, or network configuration is additionally required.
Whether a current gpt-5.4-mini U.S. Data Zone Standard deployment supports this authentication path.

The temporary role was removed after testing. No customer or production data was transmitted.

Sai Kiran Mudavath 345 Reputation points Microsoft External Staff Moderator

2026-10-10T04:51:33.0833333+00:00
Hello @Maurice Fluelling ,

Based on the information provided, the following configuration should be verified for Microsoft Entra ID authentication with the Azure OpenAI Responses API.

1. Verify the endpoint and token scope

For direct Azure OpenAI model inference, use the following endpoint and Microsoft Entra ID token scope:

Endpoint: https://<resource-name>.openai.azure.com/openai/v1/responses

Token scope: https://ai.azure.com/.default

Model: The deployment name configured on the resource, which may differ from the underlying model name.

Reference: Use the Azure OpenAI Responses API

2. Verify the RBAC assignment

The built-in Cognitive Services OpenAI User role supports inference through the Azure OpenAI endpoint. Assign the role to the identity actually making the request at the scope of the Azure OpenAI resource associated with the endpoint.

The current built-in role definition includes Microsoft.CognitiveServices/accounts/OpenAI/responses/*. Therefore, a separate custom permission for Microsoft.CognitiveServices/accounts/OpenAI/responses/write is not required when using this built-in role.

Reference: Azure built-in roles for AI and machine learning

3. Verify the resource configuration

Please confirm the following:

The resource has a custom subdomain configured for token-based authentication.

The requested model deployment exists on the resource identified by the endpoint.

The token corresponds to the intended tenant and calling identity.

Network access restrictions permit requests from the calling environment.

For direct inference through the Azure OpenAI v1 endpoint, a separate Foundry project is not a prerequisite. Ensure that the endpoint and RBAC configuration correspond to the actual inference surface being used.

Reference: Authentication and authorization in Microsoft Foundry

4. Confirm model availability

Microsoft's documentation lists gpt-5.4-mini, version 2026-03-17, as supported by the Responses API and U.S. Data Zone Standard in the documented regions: Central US, East US, East US 2, North Central US, South Central US, West US, and West US 3.

Please verify that the deployed model version and resource region match the documented availability.

Reference: Region availability for Foundry Models sold by Azure

5. If the 401 error persists

Since the initial test already allowed time for role propagation, please verify the endpoint, token scope, calling identity, and effective role assignment before performing another controlled test.

If the issue continues, the following sanitized diagnostic information would help investigate further:

The complete HTTP error response, with sensitive information removed.

The approximate UTC timestamp of a failed request.

The resource region and endpoint hostname.

The apim-request-id or available correlation ID.

Relevant RBAC assignment details for the calling identity.

Please do not share access tokens, API keys, client secrets, or other credentials.

As we have not received further information to confirm the outcome, this answer summarizes the documented configuration and next troubleshooting steps based on the available details.

Thank you.
Sai Kiran Mudavath 345 Reputation points Microsoft External Staff Moderator

2026-10-13T03:29:48.5066667+00:00

Hi @Maurice Fluelling

Did you get any chance to review the above response. Do let me know if you have any further queries.

Thank you!
Sai Kiran Mudavath 345 Reputation points Microsoft External Staff Moderator

2026-10-14T09:39:14.1166667+00:00

Hi @Maurice Fluelling

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thank You!