byok_401_debug_expert

A silent BYOK 401 error occurs because the agent identity lacks the Foundry User role assignment at the CognitiveServices account scope, even if project-scope RBAC is configured correctly.

To fix a BYOK 401 failure, collect the agent identity principalId, verify Foundry User role assignments at the CognitiveServices account scope, and run the az role assignment create command to grant missing permissions.

Project-scope RBAC allows a Foundry hosted agent to connect, but account-scope RBAC on the CognitiveServices account is required to authorize BYOK streaming invocations and prevent silent 401 errors on the first SSE event.

Yes, you can use Azure App Insights traces to guide targeted verification and confirm the silent BYOK 401 pattern by analyzing the authentication errors logged after the initial connection succeeds.

No, the diagnostic process does not handle BYOK secrets or keys; it strictly validates role assignments and outputs the exact az role assignment create command to remediate the missing account-scope permissions.

Verify RBAC role assignments by listing the Foundry User role assignments at the CognitiveServices account scope and matching the agent identity principalId to the RBAC entries to detect the missing authorization.