Seem like a bug for standard v2 sku APIM, can't turn on system managed identity. Powershell nor portal will work. also while I was trying this in portal, there were quite a few errors in the dev console (F12).

@Henry Zhang Thanks for your patience. I had a discussion internally and confirmed that this is Bug in the standard V2 APIM. If APIM with Standard V2 tier is integrated with a VNET, users are NOT able to perform service management operations, including adding/removing service tags, enabling/disabling developer portal and adding/removing custom domains. And it will fail with an error similar to the following: System.InvalidOperationException: service '/subscriptions/xxx/resourceGroupsxxx/providers/Microsoft.ApiManagement/service/servicename' is not ready. Workaround: You must remove your service from VNET, perform the desired operations such as publishing the portal, enabling system managed identity and add service back to VNET. This is a preview SKU and is expected to have some problems. We expect to fix this issue over the next couple of months. Do let me know if you have any queries. Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.

[Potential Bug]Can't turn on system managed Identity for APIM standard V2 SKU both in portal or via powershell

Henry Zhang 186

Seem like a bug for standard v2 sku APIM, can't turn on system managed identity. Powershell nor portal will work.
User's image

User's image

also while I was trying this in portal, there were quite a few errors in the dev console (F12).

JananiRamesh-MSFT 21,866 Reputation points

2023-12-05T16:49:05.33+00:00
@Henry Zhang Thanks for reaching out. I tried at my end and am able to turn on the system assigned managed identity for my APIM instance in Standardv2 tier.

Could you please retry the operation and if still the issue persists, Please share the below details over an email at AzCommunity@microsoft.com ( with subject "Attn: Janani") and include the below details:

You Azure APIM resource URI in below format: /subscriptions/XXXXXX/resourceGroups/XXXX/providers/Microsoft.ApiManagement/service/XXXX

Most recent UTC time of the actual issue

I will look at the backend logs to identify the root cause.
Henry Zhang 186 Reputation points

2023-12-05T18:48:11.1+00:00

@JananiRamesh-MSFT Hi Janani, I tried to send you an email to AzCommunity@microsoft.com
but I got the following error. I think AzCommunity@microsoft.com don't allow people outside of microsoft.
Henry Zhang 186 Reputation points

2023-12-05T18:49:50.3933333+00:00

Do you have another email to reach you?
Thanks
Henry Zhang 186 Reputation points

2023-12-06T17:57:18.5533333+00:00

@JananiRamesh-MSFT Hello, I tried to send the email again this morning. Still got blocked by the MSFT mail policy. Are there any other ways I can send the information to you?
JananiRamesh-MSFT 21,866 Reputation points

2023-12-08T15:43:35.4933333+00:00

@Henry Zhang Just following up to check if the below answer helped. If that answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know. I would be happy to help.
JananiRamesh-MSFT 21,866 Reputation points

2023-12-11T15:38:57.4+00:00

@Henry Zhang I hope the answer helps. Please let me know if you have any further queries.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.

Accepted answer

JananiRamesh-MSFT 21,866 Reputation points

2023-12-07T08:03:57.8833333+00:00

@Henry Zhang Thanks for your patience. I had a discussion internally and confirmed that this is Bug in the standard V2 APIM.

If APIM with Standard V2 tier is integrated with a VNET, users are NOT able to perform service management operations, including adding/removing service tags, enabling/disabling developer portal and adding/removing custom domains. And it will fail with an error similar to the following: System.InvalidOperationException: service '/subscriptions/xxx/resourceGroupsxxx/providers/Microsoft.ApiManagement/service/servicename' is not ready.

Workaround:
You must remove your service from VNET, perform the desired operations such as publishing the portal, enabling system managed identity and add service back to VNET. This is a preview SKU and is expected to have some problems. We expect to fix this issue over the next couple of months.

Do let me know if you have any queries.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

[Potential Bug]Can't turn on system managed Identity for APIM standard V2 SKU both in portal or via powershell

0 additional answers