Microsoft Identity Manager
A family of Microsoft products that manage a user's digital identity using identity synchronization, certificate management, and user provisioning.
649 questions
Managed service identity ID changing when swapping slots
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(99.2, 79%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESV%3C/text%3E%3C/svg%3E)
Sam Viesselman
15
Reputation points
We're having problems swapping deployments slots on our application. When we do the swap, the managed service identity ID is changing, and it's causing our application to fail accessing resources that require a specific identity for our production environment
In the past, we've never had a problem when deploying, and we don't think the service identity usually changes when swapping slots.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(291.2, 72%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESV%3C/text%3E%3C/svg%3E)
Samuli Vuorinen 5 Reputation points2024-07-03T10:16:28.3933333+00:00 We are having a similar issue with our own Azure App Service. We were able to do a minimal reproduction by creating the following:
- Azure App Service
- Managed identity enabled
- Deployment slot
- Managed identity enabled
In the App Service we deployed an ASP.NET Core application with a single API endpoint defined as follows:
app.MapGet("/whoami", async () => { var credential = new DefaultAzureCredential(); string[] scopes = ["https://graph.microsoft.com/.default"]; var token = await credential.GetTokenAsync(new Azure.Core.TokenRequestContext(scopes)); var handler = new JwtSecurityTokenHandler(); var jsonToken = handler.ReadToken(token.Token) as JwtSecurityToken; var appid = jsonToken!.Claims.First(c => c.Type == "appid").Value; return Results.Text(appid); });When you call the endpoint on the deployment slot, it responds with the ID of the Managed Identity corresponding to the staging slot. But when you swap slots or even just start a slot swap with a preview, the ID switches to that of the actual app and not the deployment slot.
The documentation clearly says Managed Identities should not be swapped along with deployment slots: https://learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots?tabs=portal#which-settings-are-swapped So why is this happening?
Then again you have to switch identities at some point before allowing traffic in, so when does that happen? The documentation does not say.
- Azure App Service
Sign in to comment