MSI on App Services suddenly not working for App Service slot

Question

Hello,

We're been using Managed Identities with our App Service for sometime. However, suddenly, the staging slot in our app service can no longer make successful MSI requests. This was discovered after we pushed some changes in our codebase.

Note: the changes were made around a service that uses Azure Storage. MSI function wasn't touched, but for Azure Host detected environments this is the MSI code that runs.

   ...  
   var credential = new ChainedTokenCredential(  
                       new ManagedIdentityCredential(settings.UserAssignedId),  
                       new AzureCliCredential());  
                     
   var queues = new QueueTuple  
   {  
        Normal = new QueueClient(normalQueueUri, credential, options),  
        Poison = new QueueClient(poisonQueueUri, credential, options)  
   };  
   ...  

Here is the error message captured in our logs:

ManagedIdentityCredential authentication failed: Service request failed.
Status: 400 (Bad Request)

We can see that this endpoint URI http://127.0.0.1:41691/msi/token/?api-version=2019-08-01&resource=https%3A%2F%2Fstorage.azure.com failed to reach.

The environment variables MSI_ENDPOINT and MSI_SECRET are set

We attempted to manually execute the request with the following Poweshell command:

   Invoke-WebRequest -Uri "$env:MSI_ENDPOINT`?api-version=2017-09-01&resource=https://storage.azure.com" -Method GET -Headers @{Metadata="true";Secret=$env:MSI_SECRET} -UseBasicParsing  

But we get the same 400 status code.

Another task we tried was disconnecting MSI and reconnecting back, but didn't fix it.

Does anyone know what could be happening?

Answer 1

Hi @Brandon L , apologies for the delayed response. If you're still having this issue, please try disabling the managed identity on the app service slot and reenable it. You will also have to add any role assignments back because this will be considered a new identity. If this doesn't resolve your issue, please do let me know with a comment down below.