ACI Service request failed. Reason: The client 'xxxx' with object id 'zzzz' does not have authorization to perform action

Question

ACI Service request failed. Reason: The client 'xxxx' with object id 'zzzz' does not have authorization to perform action

Park, Hyunjun 0

To whom it concerns,

I'm currently studying Microsoft Azure Machine Learning. During a practical exercise, I attempted to deploy a trained Regression model in Web service way, but it encountered repeated deployment failures even after strictly following the instruction on your website: https://dori-uw-1.kuma-moon.com/en-us/azure/machine-learning/how-to-use-automated-ml-for-ml-models?view=azureml-api-2

My subsequent investigation led me to check whether deployment(deploy) capabilities are included in the Student Free Trial Subscription. However, I was unable to find an explanation or clarification on this matter on your official website.

Last investigation led me to assign Azure Container Instances Contributor Role to my student email, following https://dori-uw-1.kuma-moon.com/en-us/answers/questions/5493874/deployment-failed-for-requesting-aci-service. And then I was about to take the second step, but I couldn't find where I could refresh credentials.

Please give me advice to solve this problem.

Thank you

Aryan Parashar 3,535 Reputation points Microsoft External Staff Moderator

2025-12-11T08:50:22.6333333+00:00
Hi Park, Hyunjun,

I understand how frustrating it can be to follow the instructions carefully and still encounter deployment issues. The student subscription limits certain resource types and comes with limitations.

Since Azure Machine Learning uses the workspace identity for this operation, assigning the role to your email is not enough. You must assign the role to the Workspace Managed Identity.

Here is supported documentation:
https://dori-uw-1.kuma-moon.com/en-us/azure/machine-learning/how-to-identity-based-service-authentication?view=azureml-api-2&tabs=cli#azure-machine-learning-with-auto-created-acr-instance

Alternatively, instead of deploying the model as a web service, try to deploy it as an online endpoint:

az ml online-deployment create --endpoint-name <endpoint-name> -n <deployment-name> -f <spec_file.yaml> --local

Here is supported documentation:
https://dori-uw-1.kuma-moon.com/en-us/azure/machine-learning/how-to-troubleshoot-online-endpoints?view=azureml-api-2&tabs=cli#deploy-locally

You may also hit your student subscription limitations, so in that case please upgrade your subscription to Pay-As-You-Go.

Let me know if you have further queries

Thank you for reaching out to The Microsoft Q&A Portal.

1 answer

Your answer

Aryan Parashar 3,535 Reputation points Microsoft External Staff Moderator

2025-12-11T08:50:22.6333333+00:00

Hi Park, Hyunjun,

I understand how frustrating it can be to follow the instructions carefully and still encounter deployment issues. The student subscription limits certain resource types and comes with limitations.

Since Azure Machine Learning uses the workspace identity for this operation, assigning the role to your email is not enough. You must assign the role to the Workspace Managed Identity.

Here is supported documentation:
https://dori-uw-1.kuma-moon.com/en-us/azure/machine-learning/how-to-identity-based-service-authentication?view=azureml-api-2&tabs=cli#azure-machine-learning-with-auto-created-acr-instance

Alternatively, instead of deploying the model as a web service, try to deploy it as an online endpoint:

az ml online-deployment create --endpoint-name <endpoint-name> -n <deployment-name> -f <spec_file.yaml> --local

Here is supported documentation:
https://dori-uw-1.kuma-moon.com/en-us/azure/machine-learning/how-to-troubleshoot-online-endpoints?view=azureml-api-2&tabs=cli#deploy-locally

You may also hit your student subscription limitations, so in that case please upgrade your subscription to Pay-As-You-Go.

Let me know if you have further queries

Thank you for reaching out to The Microsoft Q&A Portal.

Answer 1

It seems that you are encountering an authorization error when trying to deploy your trained regression model to Azure Container Instances (ACI). This specific error indicates that the client does not have the necessary permissions to perform the action. Here are some steps you can take to resolve this issue:

Check Role Assignments: Ensure that the user associated with the object ID has been assigned the appropriate role. In your case, you mentioned assigning the "Azure Container Instances Contributor Role". Make sure that this role is assigned at the correct scope (subscription, resource group, or specific resource).
Verify Permissions: If you are using a user-assigned managed identity, ensure that it has the necessary permissions on the Azure resources involved, such as the storage account and the container registry. The identity should have at least Storage blob data reader permission on the workspace storage account and AcrPull permission on the container registry.
Refresh Credentials: If you have made changes to role assignments or permissions, you may need to refresh your credentials. This can typically be done by logging out and back into the Azure portal or by using the Azure CLI to refresh the session.
Subscription Limits: Since you are using a student free trial subscription, ensure that there are no limitations or restrictions on deploying resources using ACI. Sometimes, free-tier subscriptions may have certain limitations that could affect deployment.
Deployment Logs: Check the deployment logs for more detailed error messages. You can access these logs through Azure Machine Learning Studio or by using the Azure CLI to get logs for your deployment.

If you continue to face issues, consider reaching out to Azure support for more specific guidance related to your subscription and deployment scenario.

References:

Share via

ACI Service request failed. Reason: The client 'xxxx' with object id 'zzzz' does not have authorization to perform action

1 answer

Your answer