How to Authenticate Azure service using managed Identity

Question

How to Authenticate Azure service using managed Identity

Patil, Kiran 20

Hi Team,

I am trying to authenticate azure service with managed identity but it shows below error however all required accesses are given to identity.

Code -

string userAssignedClientId = "AAABBBBCCCC";

var defaultAzureCredentialOptions = new DefaultAzureCredentialOptions

{				

  ManagedIdentityClientId = userAssignedClientId,

 ExcludeEnvironmentCredential = true,

 ExcludeSharedTokenCacheCredential = true,

 ExcludeVisualStudioCredential = true,

 ExcludeAzureCliCredential = true,

ExcludeVisualStudioCodeCredential = true				

};

var client = new ArmClient(new DefaultAzureCredential(defaultAzureCredentialOptions));

Error -
DefaultAzureCredential failed to retrieve a token from the included credentials. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/defaultazurecredential/troubleshoot

WorkloadIdentityCredential authentication unavailable. The workload options are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/workloadidentitycredential/troubleshoot
ManagedIdentityCredential authentication unavailable. Multiple attempts failed to obtain a token from the managed identity endpoint.
Az.Account module >= 2.2.0 is not installed.
Azure Developer CLI could not be found.

LeelaRajeshSayana-MSFT 17,866 Reputation points Moderator

2024-03-15T15:48:14.7266667+00:00

Hi @Patil, Kiran Thank you for posting the question here. Can you share more details about the Azure service you are trying to authenticate using Managed Identity? I appreciate if you could share any articles/guides you might have followed in setting up the Managed Identity account and the configurations you have made to grant access to the Azure service.

Patil, Kiran 20

Hi @LeelaRajeshSayana-MSFT
I am trying to access Azure email communication service and creating customer domain. below is code snippet.

public void CreateTokenAsync()

	{

		try

		{

			string subscriptionId = "test";

			string resourceGroupName = "test";

			string emailServiceName = "test";

			

			string userAssignedClientId = "test"; 

			var defaultAzureCredentialOptions = new DefaultAzureCredentialOptions

			{

				ManagedIdentityClientId = userAssignedClientId,

				ExcludeEnvironmentCredential = true,

				ExcludeSharedTokenCacheCredential = true,

				ExcludeVisualStudioCredential = true,

				ExcludeAzureCliCredential = true,

				ExcludeVisualStudioCodeCredential = true

			};

			var client = new ArmClient(new DefaultAzureCredential(defaultAzureCredentialOptions));

			// Get the EmailServiceResource

			ResourceIdentifier emailServiceResourceId = EmailServiceResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, emailServiceName);

			EmailServiceResource emailServiceResource = client.GetEmailServiceResource(emailServiceResourceId);

			// Get the collection of CommunicationDomainResource

			CommunicationDomainResourceCollection collection = emailServiceResource.GetCommunicationDomainResources();

			

			// Create or update a domain

			string domainName = "MyNewDomain.com";

			CommunicationDomainResourceData data = new CommunicationDomainResourceData(new AzureLocation("Global"))

			{

				DomainManagement = DomainManagement.CustomerManaged,

			};

			// Create or update the domain

			ArmOperation<CommunicationDomainResource> lro = collection.CreateOrUpdate(WaitUntil.Completed, domainName, data);

			Console.WriteLine($"Domain creation/update initiated. Operation ID: {lro.Id}");

		}

		catch (Exception ex)

		{

			Console.WriteLine($"Error creating/updating domain: {ex.Message}");

		}

	}

Patil, Kiran 20 Reputation points

2024-03-15T15:59:08.4566667+00:00

https://learn.microsoft.com/en-us/rest/api/communication/resourcemanager/domains/create-or-update?view=rest-communication-resourcemanager-2023-03-31&tabs=dotnet
LeelaRajeshSayana-MSFT 17,866 Reputation points Moderator

2024-03-15T16:51:04.4566667+00:00

Hi @Patil, Kiran Thank you for sharing more details on the issue. I am removing the Azure Data Factory tag from the question as it is not relevant. I just wanted to check if you have looked into the article How to use Managed Identity with Azure Communication Services which provides the steps around the configurations needed to be done on the Communication service to be authenticated by the managed identity.

Please let us know if you still experience an issue after validating the configurations. Our community members and SMEs on Identity and Security will help you investigate this further.
Patil, Kiran 20 Reputation points

2024-03-15T16:58:48.5733333+00:00

Hi @LeelaRajeshSayana-MSFT
Thanks for your input.
I already tried above things but still issue persists. below code snipper takes again default managed identity key not the user assigned.

could you please add community members and SMEs on Identity and Security for resolution.
Patil, Kiran 20 Reputation points

2024-03-18T11:13:35.87+00:00

Hi Team,
could you please have a look into this.

Your answer

LeelaRajeshSayana-MSFT 17,866 Reputation points Moderator

2024-03-15T15:48:14.7266667+00:00

Hi @Patil, Kiran Thank you for posting the question here. Can you share more details about the Azure service you are trying to authenticate using Managed Identity? I appreciate if you could share any articles/guides you might have followed in setting up the Managed Identity account and the configurations you have made to grant access to the Azure service.
Patil, Kiran 20 Reputation points

2024-03-15T15:58:37.3833333+00:00

Hi @LeelaRajeshSayana-MSFT
I am trying to access Azure email communication service and creating customer domain. below is code snippet.

public void CreateTokenAsync()

{ try { string subscriptionId = "test"; string resourceGroupName = "test"; string emailServiceName = "test"; string userAssignedClientId = "test"; var defaultAzureCredentialOptions = new DefaultAzureCredentialOptions { ManagedIdentityClientId = userAssignedClientId, ExcludeEnvironmentCredential = true, ExcludeSharedTokenCacheCredential = true, ExcludeVisualStudioCredential = true, ExcludeAzureCliCredential = true, ExcludeVisualStudioCodeCredential = true }; var client = new ArmClient(new DefaultAzureCredential(defaultAzureCredentialOptions)); // Get the EmailServiceResource ResourceIdentifier emailServiceResourceId = EmailServiceResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, emailServiceName); EmailServiceResource emailServiceResource = client.GetEmailServiceResource(emailServiceResourceId); // Get the collection of CommunicationDomainResource CommunicationDomainResourceCollection collection = emailServiceResource.GetCommunicationDomainResources(); // Create or update a domain string domainName = "MyNewDomain.com"; CommunicationDomainResourceData data = new CommunicationDomainResourceData(new AzureLocation("Global")) { DomainManagement = DomainManagement.CustomerManaged, }; // Create or update the domain ArmOperation<CommunicationDomainResource> lro = collection.CreateOrUpdate(WaitUntil.Completed, domainName, data); Console.WriteLine($"Domain creation/update initiated. Operation ID: {lro.Id}"); } catch (Exception ex) { Console.WriteLine($"Error creating/updating domain: {ex.Message}"); } }
Patil, Kiran 20 Reputation points

2024-03-15T15:59:08.4566667+00:00

https://learn.microsoft.com/en-us/rest/api/communication/resourcemanager/domains/create-or-update?view=rest-communication-resourcemanager-2023-03-31&tabs=dotnet
LeelaRajeshSayana-MSFT 17,866 Reputation points Moderator

2024-03-15T16:51:04.4566667+00:00

Hi @Patil, Kiran Thank you for sharing more details on the issue. I am removing the Azure Data Factory tag from the question as it is not relevant. I just wanted to check if you have looked into the article How to use Managed Identity with Azure Communication Services which provides the steps around the configurations needed to be done on the Communication service to be authenticated by the managed identity.

Please let us know if you still experience an issue after validating the configurations. Our community members and SMEs on Identity and Security will help you investigate this further.
Patil, Kiran 20 Reputation points

2024-03-15T16:58:48.5733333+00:00

Hi @LeelaRajeshSayana-MSFT
Thanks for your input.
I already tried above things but still issue persists. below code snipper takes again default managed identity key not the user assigned.

could you please add community members and SMEs on Identity and Security for resolution.
Patil, Kiran 20 Reputation points

2024-03-18T11:13:35.87+00:00

Hi Team,
could you please have a look into this.

Share via

How to Authenticate Azure service using managed Identity

Your answer