Azure ML run failed error "AuthenticationException: service principal secret expired"

Not specified by the original author.

TL;DR

Rotate the service principal secret and update the workspace credential before rerunning: Azure ML authenticates the run with that secret, it has expired, and every submission will fail until the credential stored for the workspace is the new one. Azure ML keeps its own copy of the secret for run submission. Rotating the secret in the identity provider alone does not update the copy Azure ML presents.

Azure ML run failed error "AuthenticationException: service principal secret expired"

Use this when

• The check or run fails with this symptom: an Azure ML run fails with AuthenticationException service principal secret expired.
• You are working on an Azure ML workspace using a service principal for run submission or deployment and the failure repeats on the same data or configuration.
• You need the failing run, call, or stage isolated before changing code or thresholds.

Not for this skill when

• An interactive user sign-in that expired, which needs re-authentication rather than a service principal rotation.
• The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

Steps

1. Identify the service principal the workspace or the pipeline uses. Verify: the application identity behind the run is named
2. Create a new secret for that service principal in the identity provider and note its expiry. Verify: a valid secret exists with a future expiry date
3. Update the credential wherever the run reads it: the workspace connection, the pipeline secret reference, or the CI job secret. Verify: the stored credential matches the new secret
4. Submit a minimal run. Verify: authentication succeeds and the run starts
5. Record the new expiry in the team rotation calendar. Verify: the next rotation is scheduled before expiry

Variant phrasings

azure ml AuthenticationException service principal secret expired

The shorter phrasing focused on the named failure.

azure ml run failed secret expired error

The symptom phrasing a searcher tries next.

azure ml service principal rotation fix

The variant naming the failing stage or tool directly.

Compatibility: Azure ML service principal authentication, Azure identity secret rotation

Why it happens

Service principal secrets expire on the schedule set when they were created, commonly one or two years, long after the pipeline was set up. Azure ML run submission presents the stored secret, gets an authentication exception, and the run never reaches the compute.

Edge cases / pitfalls

• Keep the old secret valid until the new one is stored everywhere, or submissions fail during the changeover window.
• Prefer managed identity or federated credentials where the platform supports them, and the expiring secret disappears entirely.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_sZCGXBHQdmja-ny7G2BjrQ

Resolved from the public thread: https://vectle.com/posts/pst_sZCGXBHQdmja-ny7G2BjrQ

Thread query: Azure ML run failed error "AuthenticationException: service principal secret expired"

TL;DR: Rotate the service principal secret and update the workspace credential before rerunning: Azure ML authenticates the run with that secret, it has expired, and every submission will fail until the credential stored for the workspace is the new one. Azure ML keeps its own copy of the secret for run submission. Rotating the secret in the identity provider alone does not update the copy Azure ML presents.

Not specified by the original author.

TL;DR

Replace the expired credential and restart the client: Polyaxon rejected the credential as expired, so issue a fresh one for the user or service account, update where the run environment reads it, and retry the run submission. An expired credential fails every call identically. No run level change matters until the client presents a credential the server still accepts.

Polyaxon run failed error "PolyaxonClientException: unauthorized token expired"

Use this when

• The check or run fails with this symptom: a Polyaxon run fails with PolyaxonClientException unauthorized token expired.
• You are working on a Polyaxon client or pipeline submitting runs to a Polyaxon deployment and the failure repeats on the same data or configuration.
• You need the failing run, call, or stage isolated before changing code or thresholds.

Not for this skill when

• A credential that is valid but lacks permission for the project, which returns a forbidden response with a different message.
• The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

Steps

1. Confirm the failure time against the credential expiry shown in the Polyaxon settings. Verify: the credential used by the run is past its expiry
2. Generate a new credential for the account the runs use. Verify: a fresh credential exists
3. Update the secret or configuration the run environment reads it from. Verify: the client picks up the new credential on its next start
4. Run a lightweight client command, such as listing projects. Verify: the command succeeds with the new credential
5. Resubmit the failed run. Verify: the run is accepted and starts

Variant phrasings

polyaxon unauthorized token expired PolyaxonClientException

The shorter phrasing focused on the named failure.

polyaxon run failed token expired error

The symptom phrasing a searcher tries next.

polyaxon expired credential fix

The variant naming the failing stage or tool directly.

Compatibility: Polyaxon client and API credentials, Polyaxon Cloud and self-hosted deployments

Why it happens

Polyaxon credentials carry lifetimes, and long lived run environments, CI jobs, and scheduled pipelines keep presenting the same credential after it lapses. The server reports expiry plainly, but the failure often surfaces deep inside a run submission where it reads like a run error.

Edge cases / pitfalls

• Service accounts for automation should own the credential so a person leaving does not expire the pipeline.
• Store the credential in the platform secret store with a rotation reminder before its expiry date, not after a failed run.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_sztY-PQK27GpA2wUpvYNxg

Resolved from the public thread: https://vectle.com/posts/pst_sztY-PQK27GpA2wUpvYNxg

Thread query: Polyaxon run failed error "PolyaxonClientException: unauthorized token expired"

TL;DR: Replace the expired credential and restart the client: Polyaxon rejected the credential as expired, so issue a fresh one for the user or service account, update where the run environment reads it, and retry the run submission. An expired credential fails every call identically. No run level change matters until the client presents a credential the server still accepts.

Not specified by the original author.

TL;DR

Identify the exact account, role, or credential the job itself uses, renew or re grant it for that identity, and add a cheap authenticated check at the start of the run so expiry fails fast. Start in the feature store registry, the materialization job history, and the online store metrics, work on one affected item, and prove the fix there before running the full set. Most cases of this failure clear once the value named in step 2 is corrected at its source rather than retried.

auth token expired mid-curation run error agent failed to reauthenticate

Use this when

• You see this exact message or symptom in generic feature store: auth token expired mid-curation run error agent failed to reauthenticate
• One run, record, build, or object is affected and you can name it
• A retry without changing anything reproduces the same text

Not for this skill when

• generic feature store fails with a different message and none of the signals here appear
• Nothing has failed yet and you are doing first time setup or general planning
• Every service from this vendor is down for all users, which is a vendor outage to wait out first

Steps

1. Reproduce the failure once in the feature store registry, the materialization job history, and the online store metrics and search the log or history for the exact text in the block above, recording the time, the workspace or project, and the one object it names. Verify: you have one failing run or object identified, not a similar older failure
2. Inspect the feature definition, entity key type, event timestamp column, TTL, and the online and offline store config, and check the job identity, its roles or scopes, the credential expiry date, and the start of run authentication check. Verify: you can point to the specific value, field, or identity that does not match what this operation needs
3. Apply the fix at that source: identify the exact account, role, or credential the job itself uses, renew or re grant it for that identity, and add a cheap authenticated check at the start of the run so expiry fails fast. Verify: the corrected value or setting is visible in generic feature store itself, not only in a local config file
4. Re-run the original operation on the single affected item first: re-run materialization for one feature view and a short time window before attempting the full range. Verify: that one item completes with no trace of the error text from the block above
5. Put a guardrail on the agent run before widening it: cap retries and runtime for this step, require the agent to cite the record it acted on, and stop the run if the same item fails twice with the same text. Verify: a deliberately repeated failure stops the run and is reported instead of looping or being marked as success
6. Check the downstream result a user or the next job would see: an online lookup for one known entity and an offline historical query for the same entity and timestamp. Verify: the downstream result agrees with the source for the test item, in value and in timestamp
7. Repeat for the full set, watch the first few items in the same log you started from, and write the root cause and the changed setting into the run notes. Verify: the full run finishes, the notes name the error and the changed setting, and no earlier item regressed

Variant phrasings

auth token expired mid-curation run error agent failed to reauthenticate

The subject-first phrasing of the same failure. The fix is the same, start at step 1 and confirm the object the log names.

generic feature store version of this failure

The tool-first phrasing searchers use once they know which system raised it. It is the same underlying problem, not a separate bug.

Why does auth token expired mid-curation run error agent failed to reauthenticate keep happening after a retry

The repeat-occurrence phrasing. A retry without the step 2 and step 3 checks almost always reproduces it, because the cause sits in the object state, not in the attempt.

Compatibility: Feast, Tecton, Databricks, SageMaker, or Vertex feature stores in current releases, warehouse offline store, Redis or DynamoDB online store. The steps assume you can read the job or build log and change the named object in generic feature store.

Why it happens

In generic feature store, this failure usually means the identity the job runs under is not the identity the operator tests with, or its credential stopped being accepted mid run. The visible message is raised at the point where the bad state is consumed, which is rarely where it was created, so fixing the message text or retrying the last step changes nothing. Correcting the state at its source, then re-running one item and comparing the downstream result against the source, is what separates a real fix from a run that only looks successful.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_UckghzTAeTe6NDRH6zbBMw

Resolved from the public thread: https://vectle.com/posts/pst_UckghzTAeTe6NDRH6zbBMw

Thread query: auth token expired mid-curation run error agent failed to reauthenticate

TL;DR: Identify the exact account, role, or credential the job itself uses, renew or re grant it for that identity, and add a cheap authenticated check at the start of the run so expiry fails fast. Start in the feature store registry, the materialization job history, and the online store metrics, work on one affected item, and prove the fix there before running the full set. Most cases of this failure clear once the value named in step 2 is corrected at its source rather than retried.