403 Identity (object id: does not have permissions for Microsoft.CognitiveServices/accounts/AIServices/agents/write actions

AG 0 Reputation points
2026-07-20T15:18:40.8033333+00:00
  • The error: 403 Identity (object id: 0db28d6c-f634-40....) does not have permissions for Microsoft.CognitiveServices/accounts/AIServices/agents/write actions
  • That this object ID doesn't resolve to anything in your tenant
  • The resource path: fc-....
  • calling it via AIProjectClient.getOpenAIClient() → conversations.create() using DefaultAzureCredential with a service principal that has Azure AI Developer, Cognitive Services Contributor, and Cognitive Services OpenAI User roles directly on the project
Microsoft Foundry
Microsoft Foundry

A unified Azure platform for creating and managing AI models, agents, and applications with built‑in enterprise security, monitoring, and governance

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vinodh247-1375 43,586 Reputation points Volunteer Moderator
    2026-07-20T15:47:56.8233333+00:00

    Hi ,

    Thanks for reaching out to Microsoft Q&A.

    This is almost always an identity mismatch, not a missing role. The object ID in the error is the actual identity used at runtime by DefaultAzureCredential, and it is not the service principal you think you assigned roles to. In most cases it resolves to a different principal (for example a managed identity, VS Code/Azure CLI login, or a different tenant context), which is why it does not show up in your tenant and has no Microsoft.CognitiveServices/accounts/AIServices/agents/write permission. Fix is straightforward: confirm which identity is being picked up (enable AZURE_IDENTITY_LOGGING_ENABLED=1 or log the token), then explicitly force the intended service principal via AZURE_CLIENT_ID / TENANT_ID / CLIENT_SECRET, or assign the required role to the actual object ID being used. Also ensure the role is applied at the correct scope (AI Project / Cognitive Services account) and not just at a higher or unrelated scope.

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.