Trying to build an environment and getting a DownloadJobSpecFromXDSError:

Hi Andre Watts

The error message you're encountering—“Permission was denied when downloading job spec”—is a clear indication of an authentication failure rather than a firewall or basic network connectivity issue. In Azure Machine Learning (AML), especially within serverless compute setups, the job submission process involves a sequence of authentication steps that rely on the workspace’s managed identity.
This identity must have the correct permissions to access resources such as the container registry and storage accounts. The failure typically occurs when the managed identity lacks the necessary role assignments, particularly the AcrPull role on the Azure Container Registry. To resolve this, you should first synchronize your workspace credentials using the command az ml workspace sync-keys --name <your-workspace-name> --resource-group <your-resource-group>, which ensures that all authentication tokens are properly refreshed. Next, verify that the managed identity of your AML workspace has been granted the AcrPull role by checking the Access Control (IAM) settings in the Azure Portal.

Additionally, ensure that your serverless compute target is correctly configured and that there are no conflicting network security groups or private endpoint restrictions that could interfere with resource access. While firewall issues can contribute to connectivity problems, the specific error you're seeing points directly to a misconfiguration in authentication and permission settings. Addressing these will likely resolve the issue and allow your environment to build successfully.

Reference links: Azure ML documentation , Azure CLI reference for ML , Authenticate with an Azure container registry

Hope it helps!

Thank you