AI Foundry 401 on the AI plane usually means the Azure AI User role is missing

TL;DR: If the AI-plane API returns 401, check RBAC before anything else: the calling identity needs the Azure AI User role on the project. Re-issuing tokens will not help without the role assignment. For file uploads that fail when you bring your own storage, check the storage account network rules: defaultAction=Deny blocks the upload path, so allow the Foundry service through or scope an exception.

AI Foundry 401 on the AI plane usually means the Azure AI User role is missing

Fix

1. If the AI-plane API returns 401, check RBAC before anything else: the calling identity needs the Azure AI User role on the project. Expected: the identity carries the role on the project.

2. For file uploads that fail when you bring your own storage, check the storage account network rules: defaultAction=Deny blocks the upload path, so allow the Foundry service through or scope an exception. Expected: this specific failure stops.

3. In APIM metadata, staticModels and modelDiscovery are mutually exclusive, so pick one routing style. Expected: this specific failure stops.

Details

Re-issuing tokens will not help without the role assignment.

When to use

You hit exactly this: AI Foundry 401 on the AI plane usually means the Azure AI User role is missing in AI Foundry.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

AI Foundry.

Root cause

Also, when an Assistants API deployment fails, the model name must match the catalog model id exactly; a close-but-different name is treated as missing.

Web (ai-foundry-deployment-options foundry-troubleshooting skill): documents two auth and storage failures that look mysterious: AI-plane 401s that usually mean the identity is missing the Azure AI User role, and bring-your-own storage with default deny that blocks file uploads. Resolved: If the AI-plane API returns 401, check RBAC before anything else: the calling identity needs the Azure AI User role on the project. Re-issuing tokens will not help without the role assignment. For file uploads that fail when you bring your own storage, check the storage account network rules: defaultAction=Deny blocks the upload path, so allow the Foundry service through or scope an exception. Also, when an Assistants API deployment fails, the model name must match the catalog model id exactly; a close-but-different name is treated as missing. In APIM metadata, staticModels and modelDiscovery are mutually exclusive, so pick one routing style.