Model Registering with managed application failing with all the Authentication

[sarthakvijayvergiya]

I am trying to register model inside deployment script using automatic deployment from managed application getting below error

{ "error": { "code": "UserError", "message": "\nOperation returned an invalid status code 'Forbidden'. The possible reason could be:\n1. You are not authorized to access this resource, or directory listing denied.\n2. you may not login your azure service, or use other subscription, you can check your\ndefault account by running azure cli commend:\n'az account list -o table'.\n3. You have multiple objects/login session opened, please close all session and try again.\n " } }

[shivanissambare]

Hi, you need to have at least contributor access to the workspace to perform model registration.

https://docs.microsoft.com/en-us/azure/machine-learning/concept-enterprise-security#restrict-access-to-resources-and-operations

[sarthakvijayvergiya]

Hey @shivanissambare, We had tried with owner access that is giving same error.

[shivanissambare]

ideally if you have owner level permission, this is present but make sure in the RBAC permissions you have following string : Microsoft.MachineLearningServices/workspaces/models/write

https://docs.microsoft.com/en-us/azure/role-based-access-control/overview

[sarthakvijayvergiya]

yes, that is present.. We are creating machine learning workspace from arm template and after that with using deployment script inside azure container instance we are executing python script for registering model and this whole solution is deployed as service catalog definition and where we are getting this above error..

** If we are running without service catalog definition deploy directly from arm template it's working..

[krabhishek8260]

How are you getting the token to auth for model registration? How are you registering models? Is it using REST APIs?

[sarthakvijayvergiya]

` session = azureml.core.authentication.InteractiveLoginAuthentication(tenant_id=tenant_id)

try: ws = Workspace(subscription_id = subscription_id, resource_group = resource_group_name, workspace_name = aml_workspace_name ) ws.write_config()

print('Library configuration succeeded')

except: print('Workspace not found')

print("Registering grocery model on ML workspace")

model = Model.register(model_path = "xxxx", model_name="xxxxx", tags={"model": "xxxx", "device": "xxxx", "framework": "xxxx"}, workspace=ws)`

[krabhishek8260]

You might want to reach out to service catalog support to see why it fails from there. From AzureML perspective this checks out as you are able to register model from ARM template.