I follow Azure's tutorial on fine-tuning GPT. I'm stuck at the deployment phase.

Code:

# Deploy fine-tuned model

import json
import requests

token = '[redacted]'
subscription = '[redacted]'
resource_group = "[redacted]"
resource_name = "[redacted]"
model_deployment_name = "gpt-4o-mini-2024-07-18-ft" # Custom deployment name you chose for your fine-tuning model

deploy_params = {'api-version': "2023-05-01"}
deploy_headers = {'Authorization': 'Bearer {}'.format(token), 'Content-Type': 'application/json'}

deploy_data = {
    "sku": {"name": "standard", "capacity": 1},
    "properties": {
        "model": {
            "format": "OpenAI",
            "name": "gpt-4o-mini-2024-07-18.ft-[redacted]", #retrieve this value from the previous call, it will look like gpt-4o-mini-2024-07-18.ft-[redacted]
            "version": "1"
        }
    }
}
deploy_data = json.dumps(deploy_data)

request_url = f'/{subscription}/resourceGroups/{resource_group}/providers/Microsoft.CognitiveServices/accounts/{resource_name}/deployments/{model_deployment_name}'

print('Creating a new deployment...')

r = requests.put(request_url, params=deploy_params, headers=deploy_headers, data=deploy_data)

print(r)
print(r.reason)
print(r.json())

Creating a new deployment... <Response [403]> Forbidden {'error': {'code': 'AuthorizationFailed', 'message': "The client '[redacted email]' with object id '[redacted]' does not have authorization to perform action 'Microsoft.CognitiveServices/accounts/deployments/write' over scope '/subscriptions/[redacted]/resourceGroups/[redacted]/providers/Microsoft.CognitiveServices/accounts/[redacted]/deployments/gpt-4o-mini-2024-07-18-ft' or the scope is invalid. If access was recently granted, please refresh your credentials."}}

I was able to deploy the model via Azure web UI. Why is the Python code returning <Response [403]> Forbidden?

• The subscription looks correct since I get an InvalidSubscriptionId if I add a typo in it.
• I got the access token by launching the Cloud Shell from the Azure portal then running az account get-access-token.

I follow Azure's tutorial on fine-tuning GPT. I'm stuck at the deployment phase.

Code:

# Deploy fine-tuned model

import json
import requests

token = '[redacted]'
subscription = '[redacted]'
resource_group = "[redacted]"
resource_name = "[redacted]"
model_deployment_name = "gpt-4o-mini-2024-07-18-ft" # Custom deployment name you chose for your fine-tuning model

deploy_params = {'api-version': "2023-05-01"}
deploy_headers = {'Authorization': 'Bearer {}'.format(token), 'Content-Type': 'application/json'}

deploy_data = {
    "sku": {"name": "standard", "capacity": 1},
    "properties": {
        "model": {
            "format": "OpenAI",
            "name": "gpt-4o-mini-2024-07-18.ft-[redacted]", #retrieve this value from the previous call, it will look like gpt-4o-mini-2024-07-18.ft-[redacted]
            "version": "1"
        }
    }
}
deploy_data = json.dumps(deploy_data)

request_url = f'https://management.azure/subscriptions/{subscription}/resourceGroups/{resource_group}/providers/Microsoft.CognitiveServices/accounts/{resource_name}/deployments/{model_deployment_name}'

print('Creating a new deployment...')

r = requests.put(request_url, params=deploy_params, headers=deploy_headers, data=deploy_data)

print(r)
print(r.reason)
print(r.json())

Creating a new deployment... <Response [403]> Forbidden {'error': {'code': 'AuthorizationFailed', 'message': "The client '[redacted email]' with object id '[redacted]' does not have authorization to perform action 'Microsoft.CognitiveServices/accounts/deployments/write' over scope '/subscriptions/[redacted]/resourceGroups/[redacted]/providers/Microsoft.CognitiveServices/accounts/[redacted]/deployments/gpt-4o-mini-2024-07-18-ft' or the scope is invalid. If access was recently granted, please refresh your credentials."}}

I was able to deploy the model via Azure web UI. Why is the Python code returning <Response [403]> Forbidden?

• The subscription looks correct since I get an InvalidSubscriptionId if I add a typo in it.
• I got the access token by launching the Cloud Shell from the Azure portal then running az account get-access-token.

• python
• azure
• azure-openai
• fine-tuning
• gpt-4

• How are you getting the access token? – Venkatesan Commented Mar 21 at 9:46
• @Venkatesan thanks, I launch the Cloud Shell from the Azure portal then run az account get-access-token – Franck Dernoncourt Commented Mar 21 at 11:26
• 1 Check the below answer. – Venkatesan Commented Mar 21 at 12:31

2 Answers 2

How can I resolve the 403 Forbidden error when deploying a fine-tuned GPT model in Azure via Python?

The above error may be passing wrong or incorrect token passed to access the request_url.

You can use the below code which will authenticate with DefaultAzureCredential using azure-identity package.

First run az-login in your terminal to connect with your Azure account.

Code:

import json
import requests
from azure.identity import DefaultAzureCredential

# Replace with your values
subscription_id = "xxxx"
resource_group = "xxxx"
resource_name = "xxx"
deployment_name = "gpt-4o-mini-2024-07-18-ft"

# Get Azure access token
credential = DefaultAzureCredential()
token = credential.get_token("https://management.azure/.default").token

# Set request parameters
deploy_params = {'api-version': "2023-05-01"}
deploy_headers = {
    'Authorization': f'Bearer {token}',
    'Content-Type': 'application/json'
}

deploy_data = {
    "sku": {"name": "standard", "capacity": 1},
    "properties": {
        "model": {
            "format": "OpenAI",
            "name": "gpt-4o-mini-2024-07-18.ft-xxxxxx",
            "version": "1"
        }
    }
}
deploy_data = json.dumps(deploy_data)

# Construct API URL
request_url = f'https://management.azure/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.CognitiveServices/accounts/{resource_name}/deployments/{deployment_name}'

print('Creating a new deployment...')

# Send request to deploy the model
response = requests.put(request_url, params=deploy_params, headers=deploy_headers, data=deploy_data)

print(response.status_code, response.reason)
print(response.json())

Output:

Creating a new deployment...
201 Created
{'id': '/subscriptions/xxxxx/resourceGroups/xxx/providers/Microsoft.CognitiveServices/accounts/xxx/deployments/gpt-4o-mini-2024-07-18-ft', 'type': 'Microsoft.CognitiveServices/accounts/deployments', 'name': 'gpt-4o-mini-2024-07-18-ft', 'sku': {'name': 'standard', 'capacity': 1}, 'properties': {'model': {'format': 'OpenAI', 'name': 'gpt-4o-mini-2024-07-18.ft-5xxxxx8', 'version': '1'}, 'versionUpgradeOption': 'NoAutoUpgrade', 'capabilities': {'area': 'US', 'chatCompletion': 'true', 'jsonObjectResponse': 'true', 'maxContextToken': '128000', 'maxOutputToken': '16384', 'assistants': 'true', 'responses': 'true'}, 'provisioningState': 'Creating', 'rateLimits': [{'key': 'request', 'renewalPeriod': 10, 'count': 1}, {'key': 'token', 'renewalPeriod': 60, 'count': 1000}]}, 'systemData': {'createdBy': 'xxxxxx', 'createdByType': 'User', 'createdAt': '2025-03-21T11:53:19.4468357Z', 'lastModifiedBy': 'v-xxxxxx', 'lastModifiedByType': 'User', 'lastModifiedAt': '2025-03-21T11:53:19.4468357Z'}, 'etag': '"40261125xxxxxb47b4ec2"'}

Reference: azure.identity.DefaultAzureCredential class | Microsoft Learn

The issue is that the subscription ID was incorrect: I was getting it via az account get-access-token, but my account has multiple subscriptions as shown by az account show (and https://portal.azure/#view/Microsoft_Azure_Billing/SubscriptionsBladeV2) and az login used some default subscription that was a different one from the one where my resource is located, resulting in az account get-access-token returning the subscription ID that didn't have that resource.