Azure OpenAI

Polysync uses an Azure OpenAI resource to discover model deployments and run them as scheduled jobs.

Required attributes

Subscription Id — the Azure subscription containing the OpenAI resource.
Resource Group Name — the resource group containing the OpenAI resource.
OpenAI Resource Name — the resource name. Used to build the data-plane endpoint https://{resource}.openai.azure.com.
OpenAI API Version — optional; defaults to 2024-10-21 when blank.

Authentication methods

Polysync Service Principal ⭐ (recommended) — no extra attributes; grant the Polysync Enterprise Application Cognitive Services OpenAI User on the OpenAI resource. This is the standard method for all Polysync tenants.
Service Principal — Tenant Id, Client Id, Client Secret. Use when you need a dedicated SPN per resource. Rotate the secret regularly.
Certificate — Tenant Id, Client Id, Certificate (upload the PFX), optional Certificate Password.
API Key — the resource access key (api-key header). Execution-only: deployment discovery is unavailable because the Azure Resource Manager control plane does not accept API keys. To bootstrap, import deployments once using a Service Principal method, then switch to API Key for execution if desired. Subscription Id and Resource Group Name are not used by this method.

Granting Polysync access

Polysync Service Principal stores no credentials — it authenticates as the multi-tenant Polysync enterprise application. The Setup editor shows that application's (client) ID beside the auth-method hint: grant that application the role below on the resource.

If it is not listed under Enterprise applications in your Entra tenant, an administrator must consent to the Polysync application once. This happens automatically for a subscription bought through Azure Marketplace.
On a subscription that has never used this resource type, register its provider first — az provider register --namespace <provider-namespace> --wait.

Permissions checklist

Networking. Polysync calls the resource's own endpoint, so allow-list Polysync's outbound address (shown in the Setup editor) on any firewall. A resource restricted to a private endpoint cannot be reached — see Networking and firewalls on the Platform page.
The chosen identity must hold the Cognitive Services OpenAI User role on the OpenAI resource for inference calls.
The control plane discovery call (Microsoft.CognitiveServices/accounts/deployments) additionally requires Reader on the resource (already covered by Contributor or Owner).
For Batch jobs the identity must also be able to read the uploaded input file in the same OpenAI resource.

Job discovery

Get Jobs issues a control-plane request against:

GET https://management.azure.com/subscriptions/{sub}/resourceGroups/{rg}
    /providers/Microsoft.CognitiveServices/accounts/{resource}/deployments?api-version=2023-05-01

Each deployment is classified by model name:

Deployments whose model name contains embedding are imported as Azure OpenAI Embedding jobs.
All other deployments are imported as Azure OpenAI Chat Completion jobs, and as a sibling Azure OpenAI Batch Job so the same deployment can be scheduled in batch mode.

The deployment name is stored on the Job as both ExternalId and the Deployment Name job attribute, so per-environment overrides are supported.

Supported jobs

Azure OpenAI exposes three Polysync job types. See each dedicated page for parameter handling, output binding, execution flow, monitor URL, and troubleshooting:

Azure OpenAI Chat Completion — synchronous inference against a chat-capable deployment.
Azure OpenAI Embedding — synchronous inference against an embeddings deployment.
Azure OpenAI Batch Job — asynchronous batch inference against a pre-uploaded input file.

Troubleshooting

401 / 403 on Test Connection — the identity lacks Cognitive Services OpenAI User on the resource, or the token audience is wrong. Data-plane tokens must be acquired for https://cognitiveservices.azure.com/.default.
404 on discovery — verify Subscription Id, Resource Group Name, and OpenAI Resource Name.
DeploymentNotFound on execute — the Deployment Name override does not match any deployment in the OpenAI resource. Re-run Import Jobs to refresh.
Batch stays Running past the completion window — the Azure Batch API returns expired once the window elapses; Polysync maps that to Failed with the raw error payload in the run message.

Documentation