Azure ml | Stream access authentication error

Question

Azure ml | Stream access authentication error

Sanjay Dokula 0

Hi, I get this error when running a pipeline job which takes in data from my azure storage blob container

Error Code: ScriptExecution.StreamAccess.Authentication Native Error: error in streaming from input data sources StreamError(PermissionDenied(None)) => permission denied when access stream. Reason: None PermissionDenied(None) Error Message: Authentication failed when trying to access the stream. Make sure you have correct permissions set up. Err("")

User's image

I granted both storage account and storage blob data contrib permission to my compute cluster in azure ml workspace, the azure ml workspace itself and my user id. I am unable to figure out what permissions I need.

I use DefaultCredentials() to authenticate to my ml workspace and submit the job, which I suppose is using azureclicredentials() since I am logged in to azure cli using az login in my local

I greatly appreciate any help on this matter. Thank you.

Aryan Parashar 3,615 Reputation points Microsoft External Staff Moderator

2025-12-15T09:22:33.1333333+00:00
Hi Sanjay Dokula,
I understand how frustrating this issue can be, especially after assigning what appear to be the correct permissions. Thank you for your patience.The error is due to authentication failed while trying to connect to the storage account.

Below are the steps to mitigate the error by verifying and enabling the required managed identity on the Azure ML compute:

Check whether the compute has a managed identity enabled

Run the following command to inspect the compute configuration:

az ml compute show --name <your-compute-name> --workspace-name <workspace> --resource-group <rg>

Enable a system-assigned managed identity on the compute

If the compute does not have a managed identity enabled, run:

# Enable system-assigned managed identity az ml compute update --name <your-compute-name> \ --workspace-name <workspace> \ --resource-group <rg> \ --assign-identity [system]

Supported documentation:
https://v4.hkg1.meaqua.org/en-us/azure/machine-learning/how-to-identity-based-service-authentication?view=azureml-api-2&tabs=cli#workspace-identity-types

Please let me know if this workaround resolves the issue.

Sanjay Dokula 0

Hi aryan,

Yes, my compute has system assigned identity enabled.

{
  "enable_node_public_ip": true,
  "id": "/subscriptions/sub_id/resourceGroups/azure_ml/providers/Microsoft.MachineLearningServices/workspaces/azure_ml_study/computes/cpu-med-cluster",
  "identity": {
    "principal_id": "principal_id",
    "tenant_id": "tenant_id",
    "type": "system_assigned"
  },
  "idle_time_before_scale_down": 120,
  "location": "eastus2",
  "max_instances": 2,
  "min_instances": 0,
  "name": "cpu-med-cluster",
  "network_settings": {},
  "provisioning_state": "Succeeded",
  "resourceGroup": "azure_ml",
  "size": "Standard_DS2_v2",
  "ssh_public_access_enabled": true,
  "tier": "dedicated",
  "type": "amlcompute"
}

Aryan Parashar 3,615 Microsoft External Staff Moderator

Hi Sanjay Dokula,
Could you verify the role assignment as shown below:

az role assignment list \
  --assignee <principal-id> \
  --scope /subscriptions/<subscription-id>/resourceGroups/<storage-rg>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>

If the assignment is not shown than use the below command:

# Use the principal_id from your compute cluster
PRINCIPAL_ID="<your-principal-id-from-json>"
# Grant Storage Blob Data Contributor role to the compute's managed identity
az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role "Storage Blob Data Contributor" \
  --scope /subscriptions/<subscription-id>/resourceGroups/<storage-rg>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>

Let me know if you still face issues.

Thank you for your patience.

Sanjay Dokula 0 Reputation points

2025-12-16T13:24:35.5533333+00:00
Hi aryan,

I have these roles assigned to the compute:

Storage Blob Data Contributor

Storage Account Contributor

Storage Blob Data Reader

Your answer

Aryan Parashar 3,615 Reputation points Microsoft External Staff Moderator

2025-12-15T09:22:33.1333333+00:00

Hi Sanjay Dokula,
I understand how frustrating this issue can be, especially after assigning what appear to be the correct permissions. Thank you for your patience.The error is due to authentication failed while trying to connect to the storage account.

Below are the steps to mitigate the error by verifying and enabling the required managed identity on the Azure ML compute:

Check whether the compute has a managed identity enabled

Run the following command to inspect the compute configuration:

az ml compute show --name <your-compute-name> --workspace-name <workspace> --resource-group <rg>

Enable a system-assigned managed identity on the compute

If the compute does not have a managed identity enabled, run:

# Enable system-assigned managed identity az ml compute update --name <your-compute-name> \ --workspace-name <workspace> \ --resource-group <rg> \ --assign-identity [system]

Supported documentation:
https://v4.hkg1.meaqua.org/en-us/azure/machine-learning/how-to-identity-based-service-authentication?view=azureml-api-2&tabs=cli#workspace-identity-types

Please let me know if this workaround resolves the issue.
Sanjay Dokula 0 Reputation points

2025-12-15T16:14:22.55+00:00

Hi aryan,

Yes, my compute has system assigned identity enabled.

{ "enable_node_public_ip": true, "id": "/subscriptions/sub_id/resourceGroups/azure_ml/providers/Microsoft.MachineLearningServices/workspaces/azure_ml_study/computes/cpu-med-cluster", "identity": { "principal_id": "principal_id", "tenant_id": "tenant_id", "type": "system_assigned" }, "idle_time_before_scale_down": 120, "location": "eastus2", "max_instances": 2, "min_instances": 0, "name": "cpu-med-cluster", "network_settings": {}, "provisioning_state": "Succeeded", "resourceGroup": "azure_ml", "size": "Standard_DS2_v2", "ssh_public_access_enabled": true, "tier": "dedicated", "type": "amlcompute" }
Aryan Parashar 3,615 Reputation points Microsoft External Staff Moderator

2025-12-16T08:21:22.2+00:00

Hi Sanjay Dokula,
Could you verify the role assignment as shown below:

az role assignment list \ --assignee <principal-id> \ --scope /subscriptions/<subscription-id>/resourceGroups/<storage-rg>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>

If the assignment is not shown than use the below command:

# Use the principal_id from your compute cluster PRINCIPAL_ID="<your-principal-id-from-json>" # Grant Storage Blob Data Contributor role to the compute's managed identity az role assignment create \ --assignee $PRINCIPAL_ID \ --role "Storage Blob Data Contributor" \ --scope /subscriptions/<subscription-id>/resourceGroups/<storage-rg>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>

Let me know if you still face issues.

Thank you for your patience.
Sanjay Dokula 0 Reputation points

2025-12-16T13:24:35.5533333+00:00

Hi aryan,

I have these roles assigned to the compute:

Storage Blob Data Contributor

Storage Account Contributor

Storage Blob Data Reader

Share via

Azure ml | Stream access authentication error

Your answer