microsoft/semantic-kernel · error · ServiceInitializationError

Please provide a token endpoint to retrieve the authenticati

Error message

Please provide a token endpoint to retrieve the authentication token.

What it means

Raised by AzureOpenAISettings.get_azure_openai_auth_token when no token endpoint can be resolved. It uses the token_endpoint argument if given, else falls back to self.token_endpoint; if both are None it throws ServiceInitializationError. Note self.token_endpoint defaults to 'https://cognitiveservices.azure.com/.default', so this only fires when that default has been explicitly cleared (e.g. AZURE_OPENAI_TOKEN_ENDPOINT set to empty) or the settings object was constructed with token_endpoint=None.

Source

Thrown at python/semantic_kernel/connectors/ai/open_ai/settings/azure_open_ai_settings.py:132

        The required role for the token is `Cognitive Services OpenAI Contributor`.
        The token endpoint may be specified as an environment variable, via the .env
        file or as an argument. If the token endpoint is not provided, the default is None.
        The `token_endpoint` argument takes precedence over the `token_endpoint` attribute.

        Args:
            credential: The credential to use for authentication.
            token_endpoint: The token endpoint to use. Defaults to `https://cognitiveservices.azure.com/.default`.

        Returns:
            The Azure token or None if the token could not be retrieved.

        Raises:
            ServiceInitializationError: If the token endpoint is not provided.
        """
        endpoint_to_use = token_endpoint or self.token_endpoint
        if endpoint_to_use is None:
            raise ServiceInitializationError("Please provide a token endpoint to retrieve the authentication token.")
        if credential is None:
            raise ServiceInitializationError("Please provide a credential to retrieve the authentication token.")
        return get_entra_auth_token(credential, endpoint_to_use)

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Pass the endpoint explicitly: settings.get_azure_openai_auth_token(credential=cred, token_endpoint='https://cognitiveservices.azure.com/.default')
2. Set AZURE_OPENAI_TOKEN_ENDPOINT to a non-empty scope in your environment/.env
3. For sovereign clouds, use the correct scope, e.g. 'https://cognitiveservices.azure.cn/.default'

Example fix

# before
settings.token_endpoint = None
settings.get_azure_openai_auth_token(credential=cred)

# after
settings.get_azure_openai_auth_token(
    credential=cred,
    token_endpoint="https://cognitiveservices.azure.com/.default",
)

endpoint = token_endpoint or settings.token_endpoint
if endpoint is None:
    raise ValueError("A token_endpoint is required for Azure Entra auth")
token = settings.get_azure_openai_auth_token(credential=cred, token_endpoint=endpoint)

def has_token_endpoint(settings: "AzureOpenAISettings", token_endpoint: str | None) -> bool:
    return bool(token_endpoint or settings.token_endpoint)

from semantic_kernel.exceptions.service_exceptions import ServiceInitializationError

try:
    token = settings.get_azure_openai_auth_token(credential=cred)
except ServiceInitializationError as e:
    if "token endpoint" in str(e):
        token = settings.get_azure_openai_auth_token(
            credential=cred,
            token_endpoint="https://cognitiveservices.azure.com/.default",
        )
    else:
        raise

When it happens

Trigger: Calling settings.get_azure_openai_auth_token(credential=cred) when self.token_endpoint is None and no token_endpoint argument is supplied. This typically requires AZURE_OPENAI_TOKEN_ENDPOINT to be set to an empty string in the environment, which overrides the pydantic default.

Common situations: AZURE_OPENAI_TOKEN_ENDPOINT was set to an empty value in a .env or CI config, overriding the class default; the settings object was built with an explicit token_endpoint=None; a custom Azure sovereign-cloud deployment that needs a different scope but the value was left blank.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Please provide a credential to retrieve the authentication t
• Missing required configuration. APP_ID, APP_PASSWORD, and AP
• Please provide either an api_key, ad_token, ad_token_provide
• Collection name is required to create a search client.
• Failed to create Azure Cognitive Search client for collectio

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/c0d3c449fdde5ef9. Report an issue: GitHub.