This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(48, 61%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJV%3C/text%3E%3C/svg%3E)
Hi Team,
I have a function app calling the prebuilt-layout in Document Intelligence.
I have assigned "Cognitive Services Contributor" access to the managed identity of the function App.
Still ended up with the error "Principal does not have access to API/Operation"
Can you let me know what is the correct role(s) required to fix this issue?
@Jeyasingh, Vijayalingam I think you may try to add Storage Blob Data Contributor role too and check if it works. Since you will be using storage blobs with this operation I think this might have triggered this message. Please see the FAQ page on other permissions that you could assign.
@Jeyasingh, Vijayalingam Did you get a chance to try if adding storage role helped? Thanks!!
@romungi-MSFT I tried adding the Storage Blob Data Contributor role, but still the same error exists. Currently, following are the two roles assigned to the Function App's Managed Identity
@romungi-MSFT I went ahead to be so liberal to test the access, but none of the below assignments helped me.
Following is the simple code I am trying:
Please advise if I am missing anything important!!!
@Jeyasingh, Vijayalingam I think you are not using your resource key in this case, please see this sample on setting the key correctly along with the resource or endpoint URL.
It should look like below while you are trying to initialize your client. See complete sample from this page.
endpoint = "<your-endpoint>"
key = "<your-key>"
formUrl = "<your_url"
document_intelligence_client = DocumentIntelligenceClient( endpoint=endpoint, credential=AzureKeyCredential(key) )
poller = document_intelligence_client.begin_analyze_document_from_url( "prebuilt-layout", formUrl )
@romungi-MSFT Thanks for the suggestions. Yes i am aware it will work with keys. But I am trying to use managed identity and i do not want to manage the keys specifically. I hope the above example you have quoted does not use the managed identity. Is my understanding is correct?
@Jeyasingh, Vijayalingam Yes you are right, that example uses keys. If you have enabled MI on the resource and configured the target resource i.e the function app it should work.
@romungi-MSFT If I understand your statement correctly, I have already enabled Managed Identity for Function App. And given all the possible rights that the Function App's Managed Identity should have on Document intelligence instance. This was my initial query as well.
So as per the discussion, I assume accessing Document Intelligence with Other Azure Service's Managed Identity is not possible now. Document intelligence can only be accessed through its Keys and Endpoints. Is my understanding being correct?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 96%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKJ%3C/text%3E%3C/svg%3E)
@Jeyasingh, Vijayalingam For some reason, adding "Cognitive Services User" role resolved this for me...