Skip to content
Point of Contact

Deployment errors

import { Aside } from “@astrojs/starlight/components”;

The wizard deploy fails for one of a small number of reasons. Each one has a clean fix.

”AuthorizationFailed: … does not have permission to create role assignment”

Cause: you have Contributor on the subscription but not User Access Administrator. The bicep creates three role assignments (Cosmos DB Data Contributor, KV Secrets Officer, SignalR Service Owner) on the customer Function App’s MI, which requires UAA.

Fix:

Terminal window
# Either add UAA to your account:
az role assignment create \
  --role "User Access Administrator" \
  --assignee $(az account show --query user.name -o tsv) \
  --scope /subscriptions/{your-sub-id}


# OR ask your subscription Owner to deploy on your behalf.

After the role assignment propagates (~30s), delete the failed Managed Application from the Azure portal (a failed deploy holds no data) and deploy again from the Marketplace listing.

”ServiceModelDeprecated: gpt-X is not available for new deployments”

Cause: Azure has stopped accepting new deployments of the AI model we depend on (gpt-5-mini). Microsoft typically gives 6-12 months notice.

Fix: this requires us to ship an updated package with a newer model. Contact support — we monitor model deprecation and ship updates ahead of cutoffs, but if you hit this, it means your install was triggered AFTER cutoff but BEFORE our update propagated.

”InvalidQuota: No quota for X in region Y”

Cause: your subscription has no gpt-5-mini GlobalStandard quota in the region you picked.

Fix: two options.

  1. Request quota in the portal: Azure AI Foundry → Quotas → Request quota for gpt-5-mini in your chosen region. Approval typically takes minutes for small asks.

  2. Pick a different region with available quota: westus3, eastus2, and swedencentral are typically reliable. Delete the failed Managed Application, then deploy again from the Marketplace listing with the new region.

”Storage account name already exists”

Cause: your stack name (the suffix used in resource names) collides with an existing globally-unique resource. This is extremely rare with our uniqueString() derivation but theoretically possible.

Fix: pick a different stack name. Stack names use 3-12 lowercase alphanumeric chars; avoid common words.

Deploy succeeds, but /api/health returns 404 or 500

Cause: the customer-runtime publish (the step where we push the function code into your Function App) failed or hasn’t completed yet. The template finished but the Function App has no functions.

What you can check yourself (the Managed RG is read-only for your tenant, so diagnosis is read-only too):

  • Retry https://pocai-fa-{stack-hash}.azurewebsites.net/api/health after 10-15 minutes — the publish step can lag the ARM deploy.
  • In the portal, open the Function App inside the Managed RG → Functions. An empty list confirms the package never mounted.

Fix: contact support with your stack name. Re-publishing the runtime package and re-syncing the Functions host are publisher-side actions — the storage and az rest commands they involve are denied for your account under the Managed RG’s deny assignment.

”Sign-in failed” in the Teams tab right after install

Cause: the deploy wizard does not create the AAD app for Teams SSO. It’s a one-time post-install step, and it hasn’t been done yet on this stack.

Fix: run the setup script from a checkout of the PointOfContactAI repo:

Terminal window
git clone https://github.com/innovations24/pocai.git
cd pocai
node scripts/create-aad-app.mjs --stack-name {your-stack-id}

Then have the three non-secret values it prints set on your Function App via support. Full procedure in Teams app setup.