Managed service identity ID changing when swapping slots

Sam Viesselman 20

We're having problems swapping deployments slots on our application. When we do the swap, the managed service identity ID is changing, and it's causing our application to fail accessing resources that require a specific identity for our production environment

In the past, we've never had a problem when deploying, and we don't think the service identity usually changes when swapping slots.

User's image

Samuli Vuorinen 10 Reputation points

2024-07-03T10:16:28.3933333+00:00
We are having a similar issue with our own Azure App Service. We were able to do a minimal reproduction by creating the following:

Azure App Service

Managed identity enabled

Deployment slot

Managed identity enabled

In the App Service we deployed an ASP.NET Core application with a single API endpoint defined as follows:

app.MapGet("/whoami", async () => { var credential = new DefaultAzureCredential(); string[] scopes = ["https://graph.microsoft.com/.default"]; var token = await credential.GetTokenAsync(new Azure.Core.TokenRequestContext(scopes)); var handler = new JwtSecurityTokenHandler(); var jsonToken = handler.ReadToken(token.Token) as JwtSecurityToken; var appid = jsonToken!.Claims.First(c => c.Type == "appid").Value; return Results.Text(appid); });

When you call the endpoint on the deployment slot, it responds with the ID of the Managed Identity corresponding to the staging slot. But when you swap slots or even just start a slot swap with a preview, the ID switches to that of the actual app and not the deployment slot.

The documentation clearly says Managed Identities should not be swapped along with deployment slots: https://learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots?tabs=portal#which-settings-are-swapped So why is this happening?

Then again you have to switch identities at some point before allowing traffic in, so when does that happen? The documentation does not say. The behaviour we see kind of makes sense, as without the deployment slot assuming the identity of the production application at the start of the swap, the production application would end up running with the identity of the deployment slot in the end, and vice versa.
Jens Pettersson 5 Reputation points

2024-08-07T06:22:18.3+00:00

We're also seeing the exact same behaviour. I made an issue here but it got closed as it probably wasn't the correct place for the issue. They asked me to post in this forum instead, but it's unfortunately that you've already reported this but without any response.

The TL:DR; of my issue is that there seems to be a strange workaround that works for us and that's to have at least ONE Environment Variable marked as "Deployment slot setting", then the identities doesn't get swapped...

In my point of view, this is a serious bug in the Azure infrastructure...

Share via

Managed service identity ID changing when swapping slots

Your answer