<p>As said in title, I'm trying to add an AKS cluster to my Azure Machine Learning workspace as <code>Attached computes</code>.</p>
<p>In the wizard that ML studio shows while adding it</p>
<p><a href="https://i.stack.imgur.com/vlVVj.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/vlVVj.png" alt="enter image description here" /></a></p>
<p>there's a link to a guide to <a href="https://learn.microsoft.com/en-gb/azure/machine-learning/how-to-attach-kubernetes-anywhere" rel="nofollow noreferrer">install AzureML extension</a>.</p>
<p>Just 4 steps:</p>
<ol>
<li>Prepare an Azure Kubernetes Service cluster or Arc Kubernetes
cluster.</li>
<li>Deploy the AzureML extension.</li>
<li>Attach Kubernetes cluster to
your Azure ML workspace.</li>
<li>Use the Kubernetes compute target from CLI
v2, SDK v2, and the Studio UI.</li>
</ol>
<p>My issue comes ad 2nd step.</p>
<p>As suggested I'm trying to <a href="https://learn.microsoft.com/en-gb/azure/machine-learning/how-to-deploy-kubernetes-extension?tabs=deploy-extension-with-cli#azureml-extension-deployment---cli-examples-and-azure-portal" rel="nofollow noreferrer">create a POC</a> trough az cli</p>
<p><code>az k8s-extension create --name &lt;extension-name&gt; --extension-type Microsoft.AzureML.Kubernetes --config enableTraining=True enableInference=True inferenceRouterServiceType=LoadBalancer allowInsecureConnections=True inferenceLoadBalancerHA=False --cluster-type managedClusters --cluster-name &lt;your-AKS-cluster-name&gt; --resource-group &lt;your-RG-name&gt; --scope cluster</code></p>
<p>I'm already logged on right subscription (where I'm owner), ad using right cluster name and resource group. as extension-name I've used <code>test-ml-extension</code>, but I keep to get this error</p>
<p><code>(ExtensionOperationFailed) The extension operation failed with the following error:  Request failed to https://management.azure.com/subscriptions/&lt;subscription-id&gt;/resourceGroups/&lt;rg-name&gt;/providers/Microsoft.ContainerService/managedclusters/&lt;cluster-name&gt;/extensionaddons/test-ml-extension?api-version=2021-03-01. Error code: Unauthorized. Reason: Unauthorized.{&quot;error&quot;:{&quot;code&quot;:&quot;InvalidAuthenticationToken&quot;,&quot;message&quot;:&quot;The received access token is not valid: at least one of the claims 'puid' or 'altsecid' or 'oid' should be present. If you are accessing as application please make sure service principal is properly created in the tenant.&quot;}}. Code: ExtensionOperationFailed Message: The extension operation failed with the following error:  Request failed to https://management.azure.com/subscriptions/&lt;subscription-id&gt;/resourceGroups/&lt;rg-name&gt;/providers/Microsoft.ContainerService/managedclusters/&lt;cluster-name&gt;/extensionaddons/test-ml-extension?api-version=2021-03-01. Error code: Unauthorized. Reason: Unauthorized.{&quot;error&quot;:{&quot;code&quot;:&quot;InvalidAuthenticationToken&quot;,&quot;message&quot;:&quot;The received access token is not valid: at least one of the claims 'puid' or 'altsecid' or 'oid' should be present. If you are accessing as application please make sure service principal is properly created in the tenant.&quot;}}.</code></p>
<p>Am I missing something?</p>

Michele Ietri
<p><em><strong>I tried to reproduce the same issue in my environment and got the below results</strong></em></p>
<p><em>I have created the Kubernetes cluster and launched the AML studio</em></p>
<p><em>In the AML I have created the workspace and created the compute with AKS cluster</em></p>
<p><img src="https://i.stack.imgur.com/X4frz.png" alt="enter image description here" /></p>
<p><em>Deployed the azureML extension using the below command</em></p>
<pre><code>az k8s-extension create --name Aml-extension --extension-type Microsoft.AzureML.Kubernetes --config enableTraining=True enableInference=True inferenceRouterServiceType=LoadBalancer allowInsecureConnections=True inferenceLoadBalancerHA=False --cluster-type managedClusters --cluster-name my-aks-cluster --resource-group Alldemorg --scope cluster 
</code></pre>
<p><img src="https://i.stack.imgur.com/PgKIl.png" alt="enter image description here" /></p>
<p><em>I am able to see all the deployed clusters using below commands</em></p>
<pre><code>az k8s-extension show --name &lt;extension_name&gt; --cluster-type connectedClusters --cluster-name &lt;connected_cluster_name&gt; --resource-group &lt;rg_name&gt;
</code></pre>
<p><em>After deploying the AzureML extension I am able to attach the Kubernetes cluster to azureML workspace.</em></p>
<p><img src="https://i.stack.imgur.com/iOb1d.png" alt="enter image description here" /></p>
<p><em><strong>NOTE:</strong></em></p>
<p><em>ExtensionOperationFailed error may occur for the below of reasons,</em></p>
<p><em>1). Blocking of the the regions, for some AML clusters few of the regions are not allowed it will be blocked</em></p>
<p><em>2). Please check the version and upgrade to the latest version</em></p>
<p><em>3). While creating the extension please make sure cluster name it will be there in the AML workspace</em></p>
<p><em>4). The service principal for the cluster does not exist in the tenant in which we are trying to access</em></p>
<p><em>5). Each tenant in which we want to access must consent to the cluster, this will ensure the service principal exists in their tenant and that service principal has the access</em></p>
