Azure OpenAI Error 400 Token tenant xxxx does not match resource tenant #321
Description
Hi,
i might be having an edge-case situation of having multiple subscriptions under my Azure account. If i login i
get the error Error: 400 Token xxx1 does not match resource tenant. when registering my Azure OpenAI endpoint using Microsoft-authentication.
It's trying to use a token of my main tenant, to request the OpenAI resouces on my other tenant. Is there a way i can select the tenant?
thanks in advance!
If i'm already logged in onto 'Microsoft", i get the following error in the output:
[error] Error: 400 Resource Id is badly formed or from wrong namespace: NA
I did some more debugging and it seems that i do am able to login using Microsoft oAuth. But i'm then logged in onto the main/default Subscription, which doesn't have the Azure OpenAI resources.
This is the token which is the result of the login:
{
"accessToken":"... super secret token...",
"idToken":"...super secret token...",
"id":"<guid>.<guid of main subscription>",
"account":{
"id":"<guid>.<guid of main subscription>",
"label":"[email protected]"
},
"scopes":["https://cognitiveservices.azure.com/.default","offline_access"]
}
This blog seems related: https://www.eliostruyf.com/microsoft-authentication-provider-visual-studio-code/
I tried to hardcode add my tenantid:
const msSession = await authentication.getSession(
'microsoft',
['https://cognitiveservices.azure.com/.default', 'offline_access', 'VSCODE_TENANT: <mytenant guid>'],
{ createIfNone: true }
)
return msSession.accessToken
I stepped through the code and it catches an exception in src/apis/openai/api/models/listModelsAzureOpenAI.ts:L63
error:
{
"status":400,
"headers":{
"apim-request-id":"<a guid>",
"connection":"close","content-length":"0",
"date":"Fri, 28 Feb 2025 14:08:42 GMT",
"strict-transport-security":"max-age=31536000; includeSubDomains; preload",
"x-content-type-options":"nosniff","x-ms-client-request-id":"Not-Set"},
}
Error: 400 status code (no body)
at _APIError.generate (/root/vscode-openai/out/extension.js:41707:14)
at AzureOpenAI.makeStatusError (/root/vscode-openai/out/extension.js:42520:21)
at AzureOpenAI.makeRequest (/root/vscode-openai/out/extension.js:42564:24)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async listModelsAzureOpenAI (/root/vscode-openai/out/extension.js:44102:24)
at async getAvailableModelsAzure (/root/vscode-openai/out/extension.js:48969:32)
at async showQuickPickAzureInferenceModel (/root/vscode-openai/out/extension.js:49011:18)
at async /root/vscode-openai/out/extension.js:49235:9
at async _MultiStepInput.stepThrough (/root/vscode-openai/out/extension.js:40697:16)
at async collectInputs (/root/vscode-openai/out/extension.js:49233:5)
at async quickPickSetupAzureOpenai (/root/vscode-openai/out/extension.js:49243:17)
at async _ConfigurationQuickPickProvider.execute (/root/vscode-openai/out/extension.js:50361:9)'
The url it's using: https://swedencentral.api.cognitive.microsoft.com/openai/deployments?api-version=2022-12-01
I also got the following error:
'{
"status":400,"headers":{"apim-request-id":"<a guid>","connection":"close","content-length":"114","content-type":"application/json","date":"Fri, 28 Feb 2025 14:24:13 GMT","strict-transport-security":"max-age=31536000; includeSubDomains; preload","x-content-type-options":"nosniff","x-ms-client-request-id":"Not-Set"},
"error":{"code":"Request is badly formated","message":"Resource Id is badly formed or from wrong namespace: NA"},
"code":"Request is badly formated",
This latter error directs me to: https://learn.microsoft.com/en-sg/answers/questions/1680345/issue-with-authenticating-api-management-with-azur
The base-url is indeed "regional".