This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 7.000000000000001%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERK%3C/text%3E%3C/svg%3E)
We have a function app in our dev environment that isn't able to connect to our sql database using managed identity. I used the msi-validator.exe utility from within kudu of the function app production slot to test connectivity with the database and it failed with "Unable to connect to SQL. Exception : Login failed for user '
An Azure service that provides an event-driven serverless compute platform.
In diagnostics, the production slot says that Managed Identity isn't enabled.
But in the Identity page for the app, it says it is enabled:
And the environment variables for MSI are there:
I'm able to get a token using the msi-validator.exe, but it returns the wrong token.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(294.40000000000003, 87%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMU%3C/text%3E%3C/svg%3E)
Hi @Rafe Kemmis - Were you expecting the app deployed to the dev slot to access the same SQL DB that the production slot already has access to? or apps in both dev and prod slots aren't able to access the DB with either of its managed identities? Deployment slots are separate, live apps with their own hostnames so System Assigned identity would be unique to each slot.
@Mike Urnun We were expecting the production slot to be able to access the sql database. But since it is using the identity token of the deployment slot, it couldn't access the db. When added the deployment slot MI user to the db, then the production slot was able to connect.
@Rafe Kemmis Regarding:
We were expecting the production slot to be able to access the sql database. But since it is using the identity token of the deployment slot, it couldn't access the db.
Was that after the slot swap? if so, that makes sense, and adding both MIs to the DB should rectify the issue which sounds like what you've already done.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(204.8, 4%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
@Rafe Kemmis can you please switch off and on again the managed identity and see if the behaviour is persistent ?