401 Authentication Error When Deploying Managed Compute Endpoint

Hello Freddy Mei,

Welcome to Microsoft Q&A and thank you for reaching out.

I understand you’re running into a 401 “Server failed to authenticate the request” error while deploying a Managed Compute endpoint for the gpt-5-mini model. This error typically means that the container responsible for loading the model is unable to authenticate to the Azure-managed Blob Storage where the model artifacts are hosted.

Here are several steps to help you resolve this issue:

1. Verify Managed Identity Configuration

Ensure that your Azure AI Foundry project or Azure ML workspace has either a System-Assigned or User-Assigned Managed Identity enabled. You can check this under: Azure Portal → AI Services resource / Managed Compute endpoint → Identity tab

• Confirm that the identity status is On and that the identity is properly listed.

2. Check and Assign Role Permissions

The managed identity associated with your deployment must have appropriate permissions to access Azure Storage. Depending on the mode:

User-assigned identity: Needs Storage Blob Data Reader access on the workspace storage account.

Managed Compute (MDC) mode: Requires Storage Blob Data Contributor permissions to pull the model artifacts.

You can assign roles using Azure CLI:

az role assignment create \
  --assignee <MANAGED_IDENTITY_CLIENT_ID> \
  --role "Storage Blob Data Contributor" \
  --scope <STORAGE_ACCOUNT_RESOURCE_ID>

If the Blob Storage is Azure-managed (not visible in your resource group), ensure the endpoint deployment is happening within the same subscription and region as the model. Cross-subscription deployments are not supported for Managed Compute.

3. Verify Token Configuration

In some cases, a 401 error can be caused by an invalid or expired authentication token. Make sure your authorization token follows this format: aad#<resourceId>#<aadToken.token>

Check that the token is valid, active, and associated with the correct identity.

4. Review Deployment Logs for More Details

Logs often contain more context about where authentication failed. You can fetch deployment logs using either the Azure CLI or Python SDK:

Using Azure CLI:

az ml online-deployment get-logs -e <endpoint-name> -n <deployment-name> -l 100

Using Python SDK:

ml_client.online_deployments.get_logs(
    name="<deployment-name>",
    endpoint_name="<endpoint-name>",
    lines=100
)

Look for entries related to authentication, storage access, or token validation failures.

5. Network Configuration

If your environment uses Private Endpoints or Virtual Networks, confirm that:

The Azure Storage endpoints are accessible.

The AzureAI and Azure Storage service tags are allowed in your network security rules. Any blocked outbound connection can prevent the model container from reaching the storage resource.

6. Confirm Authentication Mode in Deployment YAML (if applicable)

If you’re deploying via YAML or script, confirm that your authentication section is configured correctly:

auth_mode: managed_identity
identity:
  type: system_assigned

This ensures the deployment uses the correct managed identity for token generation.

7. Redeploy After Configuration Updates

Once you’ve verified or updated your managed identity, permissions, and network setup:

1. Stop any deployment that’s stuck in “Starting” or “Failed”.
2. Redeploy the endpoint to refresh the authentication token and reattempt the model download.

please refer this

• Getting 401/403 error when accessing cognitiveservices
• Authenticate requests to Azure AI services
• Troubleshoot online endpoint deployment and scoring
• Resolving OpenAI Endpoint Authentication Failures

I Hope this helps. Do let me know if you have any further queries.

Thank you!

Hi Freddy Mei,

Did you get any chance to review the above response. Do let me know if you have any further queries.

Thank you!