Azure.Identity.CredentialUnavailableException: EnvironmentCredential authentication unavailable

Tianqi Zhang 0 Microsoft Employee

Our Azure Function is using managed identity and we are getting random error as below. Sometimes it can work but sometimes get /msi/token/ is returning 500.

Azure.Identity.CredentialUnavailableException: EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot
at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage)
at Azure.Identity.EnvironmentCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
at Azure.Identity.EnvironmentCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
at Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] sources, TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken)

Kenel Angelo (CH/IFT) 0

Azure.Identity.CredentialUnavailableException (0x80131500)

To disable environment credentials:

new DefaultAzureCredential(new DefaultAzureCredentialOptions { ExcludeEnvironmentCredential = true });

Is this the only option to resolve this issue 0x80131500 ? I get similar error with latest Nuget packages.

Azure.Identity.CredentialUnavailableException (0x80131500)

[2023-03-29T13:56:29.786Z] Host configuration file read:
[2023-03-29T13:56:29.786Z] {
[2023-03-29T13:56:29.787Z]   "version": "2.0",
[2023-03-29T13:56:29.788Z]   "logging": {
[2023-03-29T13:56:29.788Z]     "applicationInsights": {
[2023-03-29T13:56:29.789Z]       "samplingSettings": {
[2023-03-29T13:56:29.791Z]         "isEnabled": true,
[2023-03-29T13:56:29.791Z]         "excludedTypes": "Request"
[2023-03-29T13:56:29.792Z]       }
[2023-03-29T13:56:29.792Z]     },
[2023-03-29T13:56:29.793Z]     "logLevel": {
[2023-03-29T13:56:29.793Z]       "default": "Information",
[2023-03-29T13:56:29.794Z]       "Azure.Core": "Warning",
[2023-03-29T13:56:29.794Z]       "FINT": "Information",
[2023-03-29T13:56:29.795Z]       "Microsoft.AspNetCore.HttpLogging.HttpLoggingMiddleware": "Information"
[2023-03-29T13:56:29.795Z]     }
[2023-03-29T13:56:29.796Z]   },
[2023-03-29T13:56:29.796Z]   "extensions": {
[2023-03-29T13:56:29.797Z]     "serviceBus": {
[2023-03-29T13:56:29.797Z]       "clientRetryOptions": {
[2023-03-29T13:56:29.798Z]         "mode": "exponential",
[2023-03-29T13:56:29.798Z]         "tryTimeout": "00:01:00",
[2023-03-29T13:56:29.799Z]         "delay": "00:00:00.80",
[2023-03-29T13:56:29.799Z]         "maxDelay": "00:01:00",
[2023-03-29T13:56:29.800Z]         "maxRetries": 3
[2023-03-29T13:56:29.800Z]       },
[2023-03-29T13:56:29.801Z]       "transportType": "amqpWebSockets"
[2023-03-29T13:56:29.801Z]     }
[2023-03-29T13:56:29.802Z]   }
[2023-03-29T13:56:29.802Z] }
[2023-03-29T13:56:31.394Z] Initializing Warmup Extension.
[2023-03-29T13:56:31.583Z] EnvironmentCredential.GetToken invoked. Scopes: [ https://servicebus.azure.net/.default ] ParentRequestId: xxx-927e-4463-a233-0010713476c3
[2023-03-29T13:56:31.587Z] EnvironmentCredential.GetToken was unable to retrieve an access token. Scopes: [ https://servicebus.azure.net/.default ] ParentRequestId: xxx-927e-4463-a233-0010713476c3 Exception: Azure.Identity.CredentialUnavailableException (0x80131500): EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot
Unhandled exception. Azure.Identity.CredentialUnavailableException: EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot
   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage)
   at Azure.Identity.EnvironmentCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.EnvironmentCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.GetHeaderValueFromCredentialAsync(TokenRequestContext context, Boolean async, CancellationToken cancellationToken)
   at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.GetHeaderValueAsync(HttpMessage message, TokenRequestContext context, Boolean async)
   at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.GetHeaderValueAsync(HttpMessage message, TokenRequestContext context, Boolean async)
   at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AuthenticateAndAuthorizeRequestAsync(HttpMessage message, TokenRequestContext context)
   at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.RedirectPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.HttpPipeline.SendRequestAsync(Request request, CancellationToken cancellationToken)
   at Azure.Messaging.ServiceBus.Administration.HttpRequestAndResponse.SendHttpRequestAsync(Request request, CancellationToken cancellationToken)
   at Azure.Messaging.ServiceBus.Administration.HttpRequestAndResponse.GetEntityAsync(String entityPath, String query, Boolean enrich, CancellationToken cancellationToken)
   at Azure.Messaging.ServiceBus.Administration.ServiceBusAdministrationClient.SubscriptionExistsAsync(String topicName, String subscriptionName, CancellationToken cancellationToken)

...
   C:\Users\kkkk\AppData\Local\AzureFunctionsTools\Releases\4.35.0\cli_x64\func.exe (process 7600) exited with code -532462766.
Press any key to close this window . . .

1 answer

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,456 Reputation points

2023-01-12T18:17:19.3166667+00:00

The EnvironmentCredential authentication unavailable error from within an Azure Function app can be mitigated disabling environment credentials or replacing any DefaultAzureCredential class instance with one of ManagedIdentityCredential.

To disable environment credentials:

new DefaultAzureCredential(new DefaultAzureCredentialOptions { ExcludeEnvironmentCredential = true });

Let us know if you need additional assistance. If the answer was helpful, please accept it and complete the quality survey so that others can find a solution.
Please sign in to rate this answer.
McDonald, Lloyd 0 Reputation points

2023-09-08T04:11:33.32+00:00

Hello,

I'm attempting to fetch a key vault secret in an Azure Function App. The function app runs within a Docker Linux container.

I tried using the ExcludeEnvironmentCredential option when creating an instance of a DefaultAzureCredential, but still get an Azure.Identity.CredentialUnavailableException.

The strange thing is a token is eventually acquired via a retry policy that goes down a few paths to attempt to get the token.

I'm using an instance of the SecretClient to get a KeyVaultSecret by calling its GetSecretAsync() method.

var kvClient = new SecretClient(new Uri(_keyVaultConfig.KeyVaultUrl), new DefaultAzureCredential( new DefaultAzureCredentialOptions { ExcludeEnvironmentCredential = true }) ); KeyVaultSecret keyVaultSecret = await kvClient.GetSecretAsync(secretName);

Scenario 1: Running the function app locally in a VS 2022 debug session.

In the case where I'm running the function app locally and make the call to the SecretClient.GetSecretAsync() method, the console log shows a DefaultAzureCredential.GetToken() method call which then shows a call to the WorkloadIdentityCredential.GetToken() method which fails (no exception thrown) with the message: "WorkloadIdentityCredential authentication unavailable. The workload options are not fully configured".

Next, the ManagedIdentityCredential.GetToken() method is invoked which throws the Azure.Identity.CredentialUnavailableException. The function app is configured with a system assigned identity, but no user assigned identities.

Finally, a VisualStudioCredential.GetToken() method call is made that successfully returns a token and the secret is fetched from the secret vault.

Scenario 2: Running the function remotely in Azure.

When the function runs remotely in Azure, App Insights trace logs show a call to the DefaultAzureCredential.GetToken() method followed by failed calls to the methods: EnvironmentCredential.GetToken() and WorkloadIdentityCredential.GetToken().

The ManagedIdentityCredential.GetToken() method is invoked followed by several MSAL messages prefixed with "False" (e.g. "False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.21 Linux 5.15.116.1-1.cm2 #1 SMP") (Linux container issue?)

Finally immediately after the last MSAL log the message:"ManagedIdentityCredential.GetToken succeeded".

Any ideas on what can be done to resolve this?

Thank you,

A frustrated developer

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,456 Reputation points

2023-09-08T04:55:59.4266667+00:00

Hi Lloyd and thanks for reaching out. For clarity purposes please post your comment as a new question and mention me. I will pick it up ASAP.

McDonald, Lloyd 0 Reputation points

2023-09-08T14:19:02.2766667+00:00

Hi Alfredo,

Thank you for responding!

I posted a new question mentioning your name as requested.

Thanks!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure.Identity.CredentialUnavailableException: EnvironmentCredential authentication unavailable

1 answer

Your answer