Question about Azure AI Foundry Course – Managed Identity Issue

Hi @Vikas Salve (MBS MT)

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well. 

The error you are encountering looks like you're facing a common issue with Managed Identity in your Azure Web App deployment. The error message indicates that Managed Identity is not enabled for your account while you're trying to access a key vault.

Here’s the TSG steps to resolve the issue:

1. Enable Managed Identity on All Required Resources.

Make sure that the Managed Identity is enabled for your Azure Web App. To allow your WebApp to use a Managed Identity.

Azure Web App:

• Go to the Azure Portal.
• Navigate to your Azure Web App (App Service).
• In the left menu Settings > Identity.
• Under System assigned, switch the status to "On", then click Save.
• This will automatically create a Managed Identity tied to the app.
• Copy the Object ID of the Managed Identity.

Azure OpenAI Resource:

• Navigate to your Azure OpenAI resource.
• Under Identity enable System Assigned Managed Identity.

Azure Cognitive Search (if used):

• Ensure the identity is enabled and has the correct roles (which you’ve already done).

2. Assign Necessary Roles:

Once you have Managed Identity enabled, you'll need to ensure that it has the appropriate roles assigned. For accessing Azure Key Vault need to assign:

• Key Vault Reader role to access the Key Vault
• Key Vault Secrets User role to read secrets from the Key Vault

If your GPT-4o app is using a Customer-Managed Key (CMK) or secrets stored in Azure Key Vault, the managed identity must have permission to access them.

• Go to your Azure Key Vault.
• Under Access Control (IAM) or Access Policies (depending on your configuration):
• Add a role assignment or policy for the Managed Identity of your Web App and/or OpenAI resource.
• Grant it Key Vault Reader, Key Vault Secrets User, or Key Vault Crypto User roles as needed.

3. Ensure Key Vault Firewall/Networking Is Not Blocking Access

If Key Vault has networking restrictions:

• Go to Key Vault → Networking
• Ensure that either:

1. Access is allowed from all networks (temporarily for testing), or
2. Your App Service outbound IP is added to the allowed list, or
3. Use Private Endpoint if Key Vault is behind a private network

4. Check Encryption Configuration

Since the error mentions:

"encryption key source is 'Microsoft.KeyVault'",

This means your storage or another resource (e.g., Azure Search) is configured with a Customer-Managed Key (CMK) stored in Key Vault.

Make sure:

• That resource (like a Storage Account or Azure AI Search instance) also has proper access to the Key Vault
• The correct Key URI is configured
• The __App has access to the key vault and key__Here are the documentation links:

https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/role-based-access-control?source=recommendations