microsoft/autogen · error · Error

Workbench template ${templateId} not found

Error message

Workbench template ${templateId} not found

What it means

Raised inside the azure_ad_token_provider callback when DefaultAzureCredential.get_token() succeeds as a call but returns an empty/missing token string. This is the defensive check between acquiring a credential and handing it to AsyncAzureOpenAI; an empty token would otherwise surface later as an opaque 401 from the service.

Source

Thrown at python/packages/autogen-studio/frontend/src/components/types/component-templates.ts:570

  templateId: string;
}

export function getWorkbenchTemplatesForDropdown(): WorkbenchDropdownOption[] {
  return WORKBENCH_TEMPLATES.map((template) => ({
    key: template.id,
    label: template.label,
    description: template.description,
    templateId: template.id,
  }));
}

export function createWorkbenchFromTemplate(
  templateId: string,
  customLabel?: string
): Component<ComponentConfig> {
  const template = getTemplateById("workbench", templateId);
  if (!template) {
    throw new Error(`Workbench template ${templateId} not found`);
  }

  return createComponentFromTemplate(templateId, "workbench", {
    label: customLabel || `New ${template.label}`,
  });
}

// Generic dropdown option interface
export interface ComponentDropdownOption {
  key: string;
  label: string;
  description: string;
  templateId: string;
}

// Generic helper functions for all component types
export function getTemplatesForDropdown(
  componentType: ComponentTypes

View on GitHub (pinned to 027ecf0a37)

Solutions

  1. Authenticate locally: run `az login` and confirm the account has access to the Azure OpenAI resource.
  2. For CI/service environments, set AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET (service principal) or ensure a user-assigned managed identity is attached and set AZURE_CLIENT_ID to its client id.
  3. Simplest unblock: pass `openai_api_key` in the config to bypass the DefaultAzureCredential path entirely.
  4. Verify with `az account get-access-token --resource https://cognitiveservices.azure.com` to reproduce the failure outside the tool.

Example fix

# before
config = AzureAISearchConfig(
    ..., embedding_provider="azure_openai", embedding_model=M,
    openai_endpoint=EP,
)  # no api_key -> DefaultAzureCredential path

# after (choose one)
# 1) key auth:
config = AzureAISearchConfig(..., openai_api_key=os.environ["AZURE_OPENAI_API_KEY"])
# 2) fix env: az login  (or set AZURE_CLIENT_ID/TENANT_ID/CLIENT_SECRET)
Defensive patterns

Strategy: validation

Validate before calling

from azure.identity import DefaultAzureCredential

def token_acquirable() -> bool:
    try:
        tok = DefaultAzureCredential().get_token("https://cognitiveservices.azure.com/.default")
        return bool(tok and tok.token)
    except Exception:
        return False

Try / catch

try:
    results = await tool.run(query)
except ValueError as e:
    if "DefaultAzureCredential" in str(e):
        # credential-chain problem: fall back to key auth or surface a login hint
        raise
    raise

Prevention

When it happens

Trigger: Configuring azure_openai embeddings without openai_api_key (forcing the DefaultAzureCredential path) in an environment where the credential chain runs but yields no usable token — e.g. managed identity unavailable, az CLI not logged in, or a corrupted cached token.

Common situations: Local development without `az login`; running in a container/CI where neither AZURE_CLIENT_* env vars nor a managed identity exist; a shared token cache containing an expired entry; the default subscription lacking access to the Cognitive Services scope.

Related errors

AI-assisted analysis of microsoft/autogen@027ecf0a37 (2026-08-15). Data as JSON: /api/errors/3dc86375b9cdc7ef. Report an issue: GitHub.