Allow anonymous access to my Azure OpenAI chat bot

Question

I have an Azure OpenAI chat bot using my own data (I configured an OpenAI resource and chose Deploy as Web App) . Members of my domain can access it by logging in. Now I want it to be accessible anonymously or for other domains I define - whatever is easier to configure.

In the Azure Web App Authentication settings I could do two things:

• Disable Authentication
• Allow unauthenticated access

See this screenshot:

When I disable authentication or when I allow unauthenticated access I get in both cases the same error message when opening the chat bot:

Authentication Not Configured

I also tried to allow not only my single domain but multiple account types of the Identity Provider. But when I login with a different domain I still the an error messge:

AADSTS50020: User account 'myuser@otherdomain' from identity provider 'https://sts.windows.net/....../' does not exist in tenant 'MyDomain' and cannot access the application 'MyChatBot') in that tenant.

How to do it properly?

Answer 1

Context

You have to understand that the "Deploy to Web App" button in Azure OpenAI Studio is only an accelerator for the "all-in-one" deployment of a project which is in fact open-sourced by Microsoft.

It's this one: https://github.com/microsoft/sample-app-aoai-chatGPT

So the Authentication Not Configured message you are facing is implemented inside this project, here: https://github.com/microsoft/sample-app-aoai-chatGPT/blob/af9d06b4ba153523fed366d3f8b1b19d1fc5f5e8/frontend/src/pages/chat/Chat.tsx#L573

Possible solution

The README of the project explains that you can remove it if you want, here

To remove this restriction, you can add AUTH_ENABLED=False to the environment variables. This will disable authentication and allow anyone to access the chat functionality of your app. This is not recommended for production apps.

As said, "This is not recommended for production apps.".

Especially as the frontend is calling itself for the conversation (POST to /conversation) so if you remove the authentication, I guess that someone could use this endpoint directly to consume your OpenAI resource which is behind (ok, they can't modify your system message etc. but it's still an issue)

Answer 2

Allow anonymous access to my Azure OpenAI chat bot

Azure OpenAI Studio currently does not support multiple domain authentication directly. It only recognizes users authenticated through the Azure Active Directory tenant associated with the Azure OpenAI resource.

If you select the directory in OpenAI Studio, the user will only need to accept the authentication.

Alternatively, you can use Azure AD B2B collaboration for users from different Azure tenants to access Azure OpenAI Studio. This allows you to invite guest users from other tenants and give them specific access rights to your Azure resources, such as Azure OpenAI Studio. The users will authenticate through their own AAD tenants, but you can control their access within your Azure environment