Error (code ManagedIdentityIsNotEnabled) after deploy a web app from AI Studio

[Katerina-Chernevskaya]

Describe the bug Hi,

I hope this is the right place to ask this question. I'm experiencing a repeatable issue when deploying a web app using the button in AI Studio. Since yesterday, every time I deploy the web app and send any text, I receive the same error message:

Error code: 400 - {'error': {'requestid': '010babac-56b0-4756-9807-7f3703fc88bb', 'code': 400, 'message': 'Failed to get managed identity token. Response: {"error":{"code":"ManagedIdentityIsNotEnabled","message":"Managed Identity (MI) is not set for this account while the encryption key source is \'Microsoft.KeyVault\', customer managed storage or Network Security Perimeter is used."}}'}}

I've tested in several tenants. Deployed resources both with Bicep scripts and manually. The issue reproduces every time.

To Reproduce Steps to reproduce the behavior:

1. Go to Chat section in the AI Project (assume that gpt-4 model was deployed in advance).
2. Click on 'Add your data'.
3. Add an index.
4. Click on Deploy to a web app.
5. Complete the form (either Create a new web app or Update an existing web app) and enable chat history.
6. Click Deploy.
7. Wait till the web app will be deployed (or updated).
8. Open the created (updated) web app.
9. Send "hi".
10. See error

Expected behavior The web app should reply something like "Hi" without any errors.

Screenshots

Configuration: Please provide the following

• Azure OpenAI model name and version: `gpt-4, version 0613'
• Is chat history enabled: 'yes' (but with disable chat history the error reproduced as well)
• Are you using data? If so, what data source? The index was created in Azure AI Search using Azure Blob Storage as data source
• Verify the startup command and runtime configuration by showing the output of the following az CLI command:

az webapp show --name <app name> --resource-group <resource group name> --query "{startupCommand: siteConfig.appCommandLine, runtime: siteConfig.linuxFxVersion}"

Output:

{
  "runtime": "PYTHON|3.11",
  "startupCommand": "python3 -m gunicorn app:app"
}

Logs

1. If the application deployment is failing, please share the deployment logs using the following az CLI command:

az webapp log deployment show --name <app name> --resource-group <rg name>

N/A

2. If the application is crashing after deployment, please share the application logs using the following az CLI command:

az webapp log tail --name <app name> --resource-group <resource group name>

Output:

2024-07-26T06:19:11  Welcome, you are now connected to log-streaming service.
Starting Log Tail -n 10 of existing logs ----
/appsvctmp/volatile/logs/runtime/container.log
2024-07-26T06:04:40.4897229Z            ^^^^^^^^^^^^^^^^^
2024-07-26T06:04:40.4897262Z   File "/tmp/8dcad37dd7c728a/antenv/lib/python3.11/site-packages/openai/_base_client.py", line 1536, in post
2024-07-26T06:04:40.4897293Z     return await self.request(cast_to, opts, stream=stream, stream_cls=stream_cls)
2024-07-26T06:04:40.4897348Z            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2024-07-26T06:04:40.4897380Z   File "/tmp/8dcad37dd7c728a/antenv/lib/python3.11/site-packages/openai/_base_client.py", line 1315, in request
2024-07-26T06:04:40.4897407Z     return await self._request(
2024-07-26T06:04:40.4897434Z            ^^^^^^^^^^^^^^^^^^^^
2024-07-26T06:04:40.4897468Z   File "/tmp/8dcad37dd7c728a/antenv/lib/python3.11/site-packages/openai/_base_client.py", line 1392, in _request
2024-07-26T06:04:40.4897781Z     raise self._make_status_error_from_response(err.response) from None
2024-07-26T06:04:40.4897863Z openai.BadRequestError: Error code: 400 - {'error': {'requestid': '010babac-56b0-4756-9807-7f3703fc88bb', 'code': 400, 'message': 'Failed to get managed identity token. Response: {"error":{"code":"ManagedIdentityIsNotEnabled","message":"Managed Identity (MI) is not set for this account while the encryption key source is \'Microsoft.KeyVault\', customer managed storage or Network Security Perimeter is used."}}'}}
Ending Log Tail of existing logs ---
Starting Live Log Stream ---
2024-07-26T06:19:27.7903526Z ERROR:root:Exception in send_chat_request
2024-07-26T06:19:27.7924534Z Traceback (most recent call last):
2024-07-26T06:19:27.7924630Z   File "/tmp/8dcad37dd7c728a/app.py", line 318, in send_chat_request
2024-07-26T06:19:27.7924663Z     raw_response = await azure_openai_client.chat.completions.with_raw_response.create(**model_args)   
2024-07-26T06:19:27.7924696Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^   
2024-07-26T06:19:27.7924726Z   File "/tmp/8dcad37dd7c728a/antenv/lib/python3.11/site-packages/openai/_response.py", line 262, in wrapped
2024-07-26T06:19:27.7924754Z     return cast(APIResponse[R], await func(*args, **kwargs))
2024-07-26T06:19:27.7924782Z                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^
2024-07-26T06:19:27.7924850Z   File "/tmp/8dcad37dd7c728a/antenv/lib/python3.11/site-packages/openai/resources/chat/completions.py", line 1295, in create
2024-07-26T06:19:27.7924881Z     return await self._post(
2024-07-26T06:19:27.7924908Z            ^^^^^^^^^^^^^^^^^
2024-07-26T06:19:27.7924937Z   File "/tmp/8dcad37dd7c728a/antenv/lib/python3.11/site-packages/openai/_base_client.py", line 1536, in post
2024-07-26T06:19:27.7924968Z     return await self.request(cast_to, opts, stream=stream, stream_cls=stream_cls)
2024-07-26T06:19:27.7924996Z            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2024-07-26T06:19:27.7925026Z   File "/tmp/8dcad37dd7c728a/antenv/lib/python3.11/site-packages/openai/_base_client.py", line 1315, in request
2024-07-26T06:19:27.7925052Z     return await self._request(
2024-07-26T06:19:27.7925092Z            ^^^^^^^^^^^^^^^^^^^^
2024-07-26T06:19:27.7925123Z   File "/tmp/8dcad37dd7c728a/antenv/lib/python3.11/site-packages/openai/_base_client.py", line 1392, in _request
2024-07-26T06:19:27.7925153Z     raise self._make_status_error_from_response(err.response) from None
2024-07-26T06:19:27.7925206Z openai.BadRequestError: Error code: 400 - {'error': {'requestid': '61184aca-fc0b-4f56-99c0-ab7dd94d3a54', 'code': 400, 'message': 'Failed to get managed identity token. Response: {"error":{"code":"ManagedIdentityIsNotEnabled","message":"Managed Identity (MI) is not set for this account while the encryption key source is \'Microsoft.KeyVault\', customer managed storage or Network Security Perimeter is used."}}'}}
2024-07-26T06:19:27.7925779Z ERROR:root:Error code: 400 - {'error': {'requestid': '61184aca-fc0b-4f56-99c0-ab7dd94d3a54', 'code': 400, 'message': 'Failed to get managed identity token. Response: {"error":{"code":"ManagedIdentityIsNotEnabled","message":"Managed Identity (MI) is not set for this account while the encryption key source is \'Microsoft.KeyVault\', customer managed storage or Network Security Perimeter is used."}}'}}
2024-07-26T06:19:27.7925832Z Traceback (most recent call last):
2024-07-26T06:19:27.7925863Z   File "/tmp/8dcad37dd7c728a/app.py", line 358, in conversation_internal
2024-07-26T06:19:27.7925892Z     result = await stream_chat_request(request_body, request_headers)
2024-07-26T06:19:27.7925922Z              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2024-07-26T06:19:27.7925950Z   File "/tmp/8dcad37dd7c728a/app.py", line 345, in stream_chat_request
2024-07-26T06:19:27.7925978Z     response, apim_request_id = await send_chat_request(request_body, request_headers)
2024-07-26T06:19:27.7926007Z                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2024-07-26T06:19:27.7926033Z   File "/tmp/8dcad37dd7c728a/app.py", line 323, in send_chat_request
2024-07-26T06:19:27.7926075Z     raise e
2024-07-26T06:19:27.7926105Z   File "/tmp/8dcad37dd7c728a/app.py", line 318, in send_chat_request
2024-07-26T06:19:27.7926136Z     raw_response = await azure_openai_client.chat.completions.with_raw_response.create(**model_args)   
2024-07-26T06:19:27.7926167Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^   
2024-07-26T06:19:27.7926199Z   File "/tmp/8dcad37dd7c728a/antenv/lib/pyth
on3.11/site-packages/openai/_response.py", line 262, in wrapped
2024-07-26T06:19:27.7926232Z     return cast(APIResponse[R], await func(*args, **kwargs))
2024-07-26T06:19:27.7926264Z                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^
2024-07-26T06:19:27.7926315Z   File "/tmp/8dcad37dd7c728a/antenv/lib/python3.11/site-packages/openai/resources/chat/completions.py", line 1295, in create
2024-07-26T06:19:27.7926344Z     return await self._post(
2024-07-26T06:19:27.7926371Z            ^^^^^^^^^^^^^^^^^
2024-07-26T06:19:27.7926402Z   File "/tmp/8dcad37dd7c728a/antenv/lib/python3.11/site-packages/openai/_base_client.py", line 1536, in post
2024-07-26T06:19:27.7926433Z     return await self.request(cast_to, opts, stream=stream, stream_cls=stream_cls)
2024-07-26T06:19:27.7926464Z            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2024-07-26T06:19:27.7926499Z   File "/tmp/8dcad37dd7c728a/antenv/lib/python3.11/site-packages/openai/_base_client.py", line 1315, in request
2024-07-26T06:19:27.7926530Z     return await self._request(
2024-07-26T06:19:27.7926574Z            ^^^^^^^^^^^^^^^^^^^^
2024-07-26T06:19:27.7926611Z   File "/tmp/8dcad37dd7c728a/antenv/lib/python3.11/site-packages/openai/_base_client.py", line 1392, in _request
2024-07-26T06:19:27.7926643Z     raise self._make_status_error_from_response(err.response) from None
2024-07-26T06:19:27.7926692Z openai.BadRequestError: Error code: 400 - {'error': {'requestid': '61184aca-fc0b-4f56-99c0-ab7dd94d3a54', 'code': 400, 'message': 'Failed to get managed identity token. Response: {"error":{"code":"ManagedIdentityIsNotEnabled","message":"Managed Identity (MI) is not set for this account while the encryption key source is \'Microsoft.KeyVault\', customer managed storage or Network Security Perimeter is used."}}'}}