I recently reached the limit for the free LUIS usage. I first created the LUIS app directly on the LUIS.ia portal and used those keys on my code. Now I wanted to get the paid option to continue using it so I created an azure resource for LUIS.ia I then went to the LUIS.ia app and added the azure resource throught the Publish>>Add Key on the LUIS.ia portal. I then changed on my code the subscriptionKey for one of the two from the new keys but it is still not working. What did I do wrong?
One answer that probably isn't applicable at this time is that it will take time for an Azure resource to successfully propogate throughout Azure. What this means in the case of newly created LUIS Subscription keys, is that it can take up to ten minutes for a newly created LUIS Subscription Key in Azure to be valid to LUIS.
However, the steps you outlined indicate that you might be missing this next part.
After you created the key in Azure, you should have associated the key with the LUIS application you wish to use it with. Following a successful LUIS Subscription Key association in the LUIS Portal with one of your applications, the next step is to continue to your bot's code and change the previous key, to your new key.
Depending on which the error codes you're getting when you try to use LUIS will help with unblocking you.
If you're getting a 401, that means the key you're using is invalid, which might mean either the wrong region, or that the key hasn't finished propagating.
If it's a 403, that usually means you're out of your monthly quota, which would imply that the key being used in your LUIS queries are of the free-tier or is the Authoring/Programmatic API Key, so the key needs to be replaced with your paid-tier LUIS Subscription Key.
Edit for BotBuilder .NET v3 users:
For users of the .NET v3 SDK, when instantiating the LuisModel, if you are using a region other than westus, you must pass in the correct domain. An example of this in action can be found here, but I've also included the code below:
[LuisModel("XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX",
"XXXXXXXXXXXXXXXXX", domain: "eastus2.api.cognitive.microsoft.com")]
Related
Currently, I am trying to run a trigger on a Logic App on Microsoft Azure, but every time I try, I receive an InvalidAuthorizationTokenTenant error. Let me explain.
So I have a Virtual Machine on Microsoft Azure called StaticReportingVM that runs a service automatically when it is turned on. I am trying to automate the process of turning the machine on and off using a Logic App called startVM. The logic design is below: it has a recurrence task that checks the time of year it is (the task should run at the beginning of every month), it tells the machine to turn on, and notifies me through my personal email whether or not the task has succeeded.
startVM design
startVM parameters
The parameters are correct for my machine and my subscription. However, every time I run the trigger, I get the following error:
{
"error": {
"code": "InvalidAuthenticationTokenTenant",
"message": "The access token is from the wrong issuer 'https://sts.windows.net/xxxxxxx-xxxxxxx-xxxxxxx/'. It must match the tenant 'https://sts.windows.net/yyyyy-yyyyy-yyyyyy/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/yyyyy-yyyyy-yyyyyy' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later."
}
}
Note that xxxxx-xxxxx-xxxxx is different from yyyyy-yyyyy-yyyyy and the two yyyyy-yyyyy-yyyyys are the same. (Not sure if this helps answer my question but I just want to cover more bases!)
Below is a (poorly edited) image of the connections I have set for the Logic App to work, where the email above is the email registered with my Azure account and the Office 365 email is my personal email to notify me of whether or not the trigger has worked.
startVM connections
I have a few questions about this: why am I getting an InvalidAuthenticationTokenTenant error even though I only am using the one subscription? Is it possible I have multiple tenants under this account and if so how can I delete those tenants? How can I bypass the error and get the logic app working?
P.S. This is my first stackoverflow question so I'm sorry if I am missing any critical details! Any and all feedback is appreciated.
• The way you are trying to trigger a logic app on Microsoft Azure VM for starting a recurrence task and notify you through the personal email address is incorrect. You should create a managed identity for the logic app through which the trigger is configured. Once configured, then assign a new role to the logic app’s managed identity through the VM’s IAM (Identity and Access Management) blade. Once done, then update the ‘Start the Virtual Machine’ task in the logic app to connect using the managed identity created for the logic app.
In this way, your issue should get resolved and you should not receive any error regarding the ‘Tenant token authentication’. Also, you are getting this error because, when you are configuring the ‘StartVM parameters’, the tenant ID is not asked in it, rather only ‘subscription ID’ is asked and the ‘resourceGroup’ is asked. Thus, due to which, if you have atleast ‘Contributor’ role access in more than one tenant linked to each other, then the default tenant ID and the tenant in which your VM us deployed will be different and hence the conflicting error faced regarding it.
• Please find the below snapshot of the configuration for including the managed identity in your logic app design: -
Thus, once you give managed identity of a VM as the connection in the logic app ‘Start VM’ action, the logic app ‘Start VM’ trigger will use the managed identity’s assigned role to the VM as authorization to start the VM and hence the tenant token issue will get resolved.
For more information and clarification on this, kindly refer to the below link: -
https://learn.microsoft.com/en-us/azure/azure-functions/start-stop-vms/deploy#enable-multiple-subscriptions
I am testing my bot for my school project which was due in next two days and suddenly, the bot stopped functioning correctly and showing the default message all the time.
After some research in Google and Stackoverflow, found it is due to Quota limit.
I see in the Luis keys, the current key is "Starter_key" and also below error message in the end-point.
{ "statusCode": 403, "message": "Out of call volume quota. Quota will be replenished in 11.00:25:53." }
I read similar problems here, but none of them clearly mentioned what next. What is the best possible way to overcome this and I dont want to wait for the next 11 days. Is there anyway to upgrade to pay-as-you-go only for Luis? or even that wont work?
As your error message indicates, you simply hit the max amount of request for your LUIS Starter_Key (which is sort of a trial).
To permanently resolve this issue you need to provision a LUIS resource on your Microsoft Azure Subscription and use the subscription keys from there.
The approach is well documented here.
In short:
Create a LUIS Resource within your Azure Subscription
Back in your LUIS portal go to Keys and Endpoints of your model
Click "Assign resource" and select the previously created LUIS Resource
I resolved the problem with below steps and this can be marked as closed.
Created New Luis app in luis.ai using different account.
Exported the existing account settings from My Apps -> Export as Json.
Imported the Json into new app under Manage -> Versions
Trained and published the new Luis app.
Copy the new app's App ID and API key and update them in the Bot Application settings --> LuisAPIKey and LuisAppId
Restart the Bot service.
Validate the Bot.
How to publish in the new UI of Luis? The tenant id is not getting listed in my account. I have generated keys in the azure portal but not able to configure it in LUIS. Earlier we had a keys tab and we could add the key there. It seems they have changed it now. Any help on this?
I see what you mean: there was previously a My Keys tab in LUIS.ai website.
This tab seems to have been removed, but you can still change your key inside your project, using Publish App: there is an item called Assigned endpoint key.
Based on the image you put in your question, I suppose you have found it. On my side it is successfully listing my Tenant IDs, then my subscriptions and keys so I am able to managed them.
If you are talking about creating a new key, it must be done from the Azure portal.
I'm trying to use the Computer Vision API from Microsoft's Cognitive Services. However, my keys don't seem to be working. I created an account using the free trial of that API and got the two keys from it. Trying to use the key with the ProjectOxford.Vision SDK always yields:
Access denied due to invalid subscription key. Make sure to provide a valid key for an active subscription.
I tried the API console, however I get the same error with my key in the Ocp-Apim-Subscription-Key field. I tried both keys and neither of them work. I even got the free version of Face API and tried its console, but encountered the same issue with its keys. I even tried different datacenters, but they all seem to return the same error.
This would need to be some problem with the key then right? This can't be a problem with my C# code, since the console doesn't work either. And since it's failing in the API console, there's nothing more I can do to rule out any other possibilities is there? I'm not sure what else I can do to debug this. I'd like to regenerate my keys (I saw a tutorial video which showed an older UI of getting the API keys and they used to have a "regenerate" link) but I don't see a way of doing that anymore.
I only just made the account and registered for the APIs, so there's no way I'd be over quota. Is there something else I need to do to enable these keys or something?
I managed to skirt around the issue of 'Access Denied' by performing the following actions:
I created a free Azure account
I set up an instance of the Cognitive Services Api (this generated a pair of new keys for me to use)
Utilizing the new key, I had to use the following link:
https://westus.api.cognitive.microsoft.com/vision/v1.0/ocr
Instead of
https://westus.api.cognitive.microsoft.com/vision/v1.0/recognizeText
(I obtained this link from the Cognitive Services Test Dashboard).
Look at the request pattern on the test dashboard and you should be able to tell how to use the api.
Even when #Xuan Hu response states correctly to the solution, I scratched my head some time trying to figure out how to change the end point. Here are my 2 cents:
Go to portal.azure.com, in the dashboard of your subscription to the Cognitive Services > General Information > End Point take note of the URL. You need it.
Find in the code of your VisionAPI samples where the VisionServiceClient is instantiated:
VisionServiceClient VisionServiceCliente = new VisionServiceClient(SubscriptionKey);
and change including the URL that you found in Azure:
VisionServiceClient VisionServiceCliente = new VisionServiceClient(SubscriptionKey, StringOfMyURLTakedFromPortal);
That worked for me.
If you are using the free trial keys got from azure.microsoft.com. You need to change the API endpoint region to westcentralus. The previous default region is westus and I think that is the reason of the invalid key problem.
FYI, there is a blog post that covers all of the 401 Access Denied scenarios, including this one regarding the free API keys and region specific API endpoint. Adding it here for folks in the future who find this SO post - https://blogs.msdn.microsoft.com/kwill/2017/05/17/http-401-access-denied-when-calling-azure-cognitive-services-apis/.
Using the incorrect regional endpoint
Most of the Cognitive Services APIs are region specific, which means that during API account creation you select which region you want to create the account in. These APIs have region specific endpoints such as westus.api.cognitive.microsoft.com or eastus2.api.cognitive.microsoft.com, and an API key for an account created in one region will only work using the endpoint for that specific region. This means that if you create an API account in West US you will not be able to call the eastus2.api.cognitive.microsoft.com API endpoint.
You can verify the region and endpoint in the Azure management portal.
Trial API Keys
The free trial API keys have 30 day expiration dates, and the same restrictions for region and version. If you are using the trial keys you can go to https://azure.microsoft.com/en-us/try/cognitive-services/my-apis/ to manage your API keys (if you are not already logged in then just click one of the ‘Create’ buttons and you can go through the wizard to login and see your existing API keys), and you will also see the expiration date and endpoint.
One thing to remember if using Postman to get the results is to use GET and put your keys in the Header.
I'm trying to create a simple chat bot on Microsoft Bot Framework and I want to add LUIS app ID and LUIS subscription key to my application.
Where can I get the subscription key?
I believe lately Microsoft has changed the structure of the portal so most of the links are not working.
Where can I get the subscription key?
You can get the subscription key by going to
The "Publish App" link on the left,
Select staging from the "end point slot" under Publish Settings. (Don't know why doesn't it show while the option is Production. Maybe there are other ways to connect in the production environment)
Selecting the "staging" option will show an endpoint url which will have "subscription-key" field, which you can copy
I want to add LUIS app ID
To get your luis app ID
Go to "My Apps" in "https://www.luis.ai/applications"
Click your app
Click settings from the options on the left
Copy the 36 character "Application Id"
The followings are steps that worked for me:
Login into https://portal.azure.com
Search luis
Create 1 Language understanding in Cognitive Service section
Go to "My Apps" in https://www.luis.ai/applications
Select your app
Click on Change link nearing Assigned endpoint key
Select available items in 3 comboboxes
Here is the result that you could get subscription key
Hope this help.
Subscription key: In azure create a new cognitive service -> Luis. In the new luis service, on the left you can find an option labeled keys. Use Key1 for everything.
API key: go to your luis.ai account, and select the key's tab. You need to link your luis subscription key here to link luis to your azure sub.
You can navigate at this page https://www.luis.ai/keys where you will see "Programmatic API Key" it's your subscription key also known as "Ocp-Apim-Subscription-Key".
I found this article on msdn that really explains the keys well https://blogs.msdn.microsoft.com/kwill/2017/05/17/http-401-access-denied-when-calling-azure-cognitive-services-apis/
you can find your subscription keys the azure portal
Location of Subscription Key for Luis Services
the application id can be found on the settings page of your app on the luis dashboard (start at www.luis.ai)
... all the details for this are in the article linked, but what I found was that:
Use the key as in the screenshot above
The region your azure resource for luis is in, should match the region that your luis application is in.
The resource is managed through the azure portal, the luis app is managed through the www.luis.ai homepage
As the article says, it can be quite confusing about what keys to use where, (especially when you first create the luis app you get a 'starter key' ... sorry for the waffle,
The Subscription Key is the same as the Authoring Key (refer to this documentation). You can get the Authoring Key for your LUIS app by taking the following steps:
Log on to luis.ai
Navigate to the MANAGE menu
Navigate to the Keys and Endpoints tab on the sidebar