Issue "Failed to create Aml RP virtual workspace" when UserOwnedAmlWorkspace

[quangttran2907-pixel]

Hi, I'm testing the deployment of AI Foundry with network injection in the West Europe region. I'm using a VNet with the address space 10.0.0.0/23 and an existing Azure Machine Learning workspace located in the same region.

However, I encountered the following error during deployment:

[{"code":"OperationError","message":"Failed to Update the resource. Provisioning state: Failed","details":
[{"code":"ResourceProviderError","message":"Failed to create Aml RP virtual workspace due to System.Exception: Failed async operation\n   
at Microsoft.CognitiveServices.ResourceProvider.AmlRp.AsyncOperationHelper.PollUntilCompleteAsync[T](TraceContext traceContext, 
HttpResponseMessage response, HttpClient httpClient, Int32 timeoutInMin, CancellationToken cancellationToken) in 
/__w/1/s/src/Common/ResourceProvider/AmlRp/AsyncOperationHelper.cs:line 85\n   at 
Microsoft.CognitiveServices.ResourceProvider.AmlRp.AmlRpClient.PutAmlRpVirtualHubAsync(TraceContext traceContext, Dictionary"2 headers, 
ResourceIdentityInArm resourceIdentity, String primaryUserAssignedIdentity, String internalId, KeyVaultProperties keyVaultProperties, String 
subscriptionId, String resourceGroupName, String workspaceName, List"1 networkInjections, PublicNetworkAccessType 
publicNetworkAccessType, CancellationToken cancellationToken) in /__w/1/s/src/Common/ResourceProvider/AmlRp/AmlRpClient.cs:line 
119\n   at Microsoft.CognitiveServices.ResourceProvider.AmlRp.AmlRpService.PutAmlRpWorkspaceAsync(TraceContext traceContext, 
ResourceRequestContext requestContext, WorkerMessageRequestContext workerMessageRequestContext, 
IResourceEntity insertedResourceEntity, CancellationToken cancellationToken) in 
/__w/1/s/src/Common/ResourceProvider/AmlRp/AmlRpService.cs:line 124\n   at 
Microsoft.CognitiveServices.ResourceProvider.Worker.MessageProcessor.ProcessInternalAsync(TraceContext traceContext, 
RpWorkerQueueMessage message, CancellationToken cancellationToken) in 
/__w/1/s/src/ResourceProvider/Rp.WorkerRole/AccountProvisioning/MessageProcessor.cs:line 297"}]

Properties that I'm using for deployment:

allowProjectManagement: true
customSubDomainName: accountName
amlWorkspace: {
  identityClientId: <app ID of service principal>
  resourceId: '/subscriptions/<SubscriptionID>/resourceGroups/<RG>/providers/Microsoft.MachineLearningServices/workspaces/<Workspace>'
}
networkAcls: {
  defaultAction: 'Allow'
  virtualNetworkRules: []
  ipRules: []
}
publicNetworkAccess: 'Disabled'
networkInjections:([
  {
    scenario: 'agent'
    subnetArmId: agentSubnetId
    useMicrosoftManagedNetwork: false
  }
  ])
disableLocalAuth: false

My concerns are:

1. Why does the deployment still attempt to create a new AML workspace, even though I’ve explicitly specified an existing one?

2. Is it supported to use an address range like 10.0.0.0/23? I understand the deployment scripts are designed to work with 192.168.0.0/16, but that space can not be used in our case.

Thanks in advance for your help.

[denlai-mshk]

@quangttran2907-pixel

https://learn.microsoft.com/en-us/azure/ai-foundry/agents/how-to/virtual-networks#known-limitations

Known limitations
Subnet IP address limitation: both subnets must have IP ranges under 172.16.0.0/12 or 192.168.0.0/16, i.e. class B or C private address ranges reserved for private networking. Public Class A, B or C address ranges are not supported. Private Class A address ranges have limited region support. For more information, see our Private Network Secured Agent deployment template on GitHub.
Agent subnet exclusivity: The agent subnet cannot be shared by multiple Azure AI Foundry resources. Each AI Foundry must use a dedicated agent subnet.
Agent subnet size: The recommended size of the delegated Agent subnet is /24 (256 addresses) due to the delegation of the subnet to Microsoft.App/environment. For more on the subnet sizing, see Configuring virtual networks for Azure Container Apps.
Agent subnet egress firewall allowlisting: If you are integrating an Azure Firewall with your private network secured standard agent, please allowlist the Fully Qualified Domain Names (FQDNs) listed in the Integrate with Azure Firewall article.
All Foundry workspace resources must be deployed in the same region as the virtual network (VNet). This includes Cosmos DB, Storage Account, AI Search, Foundry Account, Project, and Managed Identity.
Exception: You may connect your Foundry Project to models deployed in a different region (on another AI Foundry or Azure OpenAI resource) by configuring an appropriate AI Services connection on the Project's capability host.
Region availability:
For supported regions for model deployments, see: Azure OpenAI model region support.
Azure Blob Storage: using Azure Blob Storage files with the File Search tool isn't supported.

[denlai-mshk]

However, from my tests, it only support 192.168.0.0/16. The same error Failed to create Aml RP virtual workspace due to System.Exception happens in the case of 172.16.0.0/12

Anyone can make it work in 172.16.0.0/12?

[mkemmerz]

We encounter the same issue. I tried it with multiple network setups but always this error message, even with a 192.168.0.0 in France Central - no luck, even though it should be supported.

Anyone an idea why this might happen and how to fix it?

[DarylGraves]

I had the same error in #309 - It turns out my error was because Microsoft.App was not registered against the subscription. I mistakenly assumed it was because we have deployed a number of App Service Plans in the same subscription but I guess this is for something else.

In my situation, I was able to delete the Resource Group, register the providers listed in the Prerequisites here and re-run the deployment using a different name for the resources. Hope this helps.