Azure Machine Learning
An Azure machine learning service for building and deploying models.
2,833 questions
Current tenant is not authorized to access linked subscription
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 84%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERP%3C/text%3E%3C/svg%3E)
Rama Phaneendra Intipalli
0
Reputation points Microsoft Employee
I attempted to deploy a model where the model is located in the MSFT tenant and the deployment is in the different tenantB. The Service Principal (SP) used for deployment has contributor access to the subscription, which houses the model. This SP is configured as a multi-tenant application and resides in tenantB. Here is the error message I encountered
The client has permission to perform action 'Microsoft.MachineLearningServices/workspaces/models/read' on scope '/subscriptions/xx/resourcegroups/NorthCentralUS/providers/Microsoft.CognitiveServices/accounts/ft-northcentralus/deployments/test-provisioned', however the current tenant 'tenantB' is not authorized to access linked subscription 'xxxxxxxx'.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 24%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENM%3C/text%3E%3C/svg%3E)
navba-MSFT 23,095 Reputation points Microsoft Employee2024-07-30T05:22:53.8533333+00:00 @Rama Phaneendra Intipalli Welcome to Microsoft Q&A Forum, Thank you for posting your query here!
.
.
When creating a multi-tenant application, you may need to handle authentication requests for resources that are in different tenants. Azure Resource Manager provides a header value for storing auxiliary tokens to authenticate the requests to different tenants.
.
.
So for Authenticating requests across tenants, You should leverage the
Authorizationandx-ms-authorization-auxiliaryheaders. More info here..
If you need any further assistance on this, since you are internal to Microsoft, I have provided more details to get assistance on this issue.
Hope this helps.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 42%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
paradigmbrian 0 Reputation points2024-07-31T16:25:02.03+00:00 I'm also bumping into this issue when trying to have Tenant A send Event Grid topics to Tenant B Storage Queue. @navba-MSFT , your solution suggests I would need to setup an Azure Function in Tenant A as a middleman to capture the event, then authenticate with Tenant B when sending events to Storage Queue, is this correct? Ideally I could do this without the Azure function and just give the correct Service Principals and Roles for the 2 services to communicate.Thanks,
Brian
Sign in to comment
Sign in to answer