Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,645 questions
Facing authentication error with manageIdentity for resource https://api.loganalytics.io/ on azure dev ops pipeline
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 78%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESG%3C/text%3E%3C/svg%3E)
Saransh Gaur
40
Reputation points Microsoft Employee
I am working on the validation of an Azure query using logQueryClient, which requires credentials to initialize. When I perform interactive authentication on my local machine, it works fine. However, when I use managed identity-based authentication in the pipeline, I encounter the following error:
"Query validation failed: (InvalidTokenError) The provided authentication is not valid for this resource
Code: InvalidTokenError
Message: The provided authentication is not valid for this resource
Inner error: {
"code": "InvalidAuthenticationTokenTenant",
"message": "The access token is from the wrong issuer 'https://sts.windows.net/124edf19-b350-4797-aefc-3206115ffdb3/'. It must match the tenant 'https://sts.windows.net/***/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/***' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later."}"
Azure Monitor
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2024-09-03T16:51:05.22+00:00 Hi @Saransh Gaur ,
Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.
The error occurs because the token being used by your Azure DevOps pipeline comes from a different organization than the token in your Log Analytics resource. This discrepancy is the reason for the rejection of the token.
Try the following steps and see if it helps:
- Verify that the tenant ID in your pipeline matches your Log Analytics resource.
- Verify that the managed identity used by your pipeline has the appropriate permissions to access the Log Analytics resource.
- If you use a specific URL to get a token, make sure it is for the right tenant.
- Double-check your pipeline configuration to ensure it uses a properly maintained identity.
- If your subscription has recently been transferred to another acquirer, it may take some time for anything to be updated. If so, try again after a short wait
If you have any additional queries, don't hesitate to reach out.
If the answer helpful, please click the "Accept Answer" And "upvote"
-
Anonymous
2024-09-05T10:45:26.35+00:00 Hi @Saransh Gaur
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...! -
Saransh Gaur 40 Reputation points Microsoft Employee
2024-09-05T10:53:40.5366667+00:00 I found out that there was some issue in logAnalyticsWorkspace resource with ManageIdentity. I resolved it by mentioning mi_client_id inside the DefaultAzureCredential:
credential = DefaultAzureCredential(managed_identity_client_id=mi_client_id client = LogsQueryClient(credential) -
Anonymous
2024-09-13T08:52:58.94+00:00 Hi @Saransh Gaur
Thanks for the updated
If the answer helpful, please click the "Accept Answer" And "upvote"
Sign in to comment
Sign in to answer