managed identity authentication

Question

managed identity authentication

Hariharan Viswanath 40

Mar 20, 2025, 5:26 PM

When migrating the code from a development environment to a production environment, the Key vault migration API call fails to be migrated with the Authentication type as Managed Identity.

Vinodh247 32,361 Reputation points MVP

Mar 23, 2025, 11:00 AM
Hi ,

Thanks for reaching out to Microsoft Q&A.

When migrating code from dev to prod, and the keyvault API call fails specifically when using MI for auth, the issue is typically related to one or more of the following:

Managed Identity Not Enabled on Production Resource

Ensure that the Azure Managed Identity is enabled for the production resource (for ex, Azure Function, App Service, VM, Logic App, etc.). Without this, the identity does not exist and cannot be used to authenticate to keyvault.

Go to the Azure portal

Navigate to the production resource

Under Identity > System-assigned, ensure it is On

Key Vault Access Policy or Role Assignment Missing

The Managed Identity must have permissions to access the Key Vault in production.

a. If using Access Policies (older model):

Go to the Azure Key Vault

Under Access policies, add a policy

Select the production resource’s Managed Identity

Grant the necessary permissions (e.g., Get, List, Set, etc.)

b. If using RBAC:

Go to Access Control (IAM) on the Key Vault

Assign roles such as Key Vault Reader, Key Vault Secrets User to the Managed Identity

Environment-Specific Configuration

Check that the code is not hardcoding secrets or assuming a specific environment. For managed identity, the application should be configured to acquire a token using the environment’s identity.

In .net for ex:

This works with managed identity as long as the identity is enabled and has permission.

var client = new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential());

Network Restrictions

If Key Vault has firewall rules or is behind a private endpoint, ensure that the production environment has network access to it.

Verify Firewall and virtual networks settings in the Key Vault

If using private endpoints, ensure DNS resolution works from the production resource

Incorrect Azure Environment Detection

If the app is running in a container or custom environment (like Kubernetes), the managed identity might not be available unless configured with Azure Workload Identity or federated credentials.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.
Navya 17,820 Reputation points Microsoft External Staff

Mar 31, 2025, 4:48 PM

Hi @Hariharan Viswanath

Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Hariharan Viswanath 40 Reputation points

Apr 1, 2025, 7:12 PM

this did not help as i am trying to use the Deployment template to deploy the whole resource over to the Production environment. But as you see in the screenshot below, the logic app itself does not get deployed and the error it shows is:

{"code":"WorkflowManagedIdentityConfigurationInvalid","message":"The workflow connection parameter 'keyvault-2' is not valid. The API connection 'keyvault' is not configured to support managed identity."}
Sai Prabhu Naveen Parimi 1,180 Reputation points Microsoft External Staff

Apr 2, 2025, 4:28 AM

@Hariharan Viswanath

I have sent you a private message. Could you please check and respond so that we can connect further to troubleshoot the issue?

Accepted answer

0 additional answers

Your answer

Navya 17,820 Reputation points Microsoft External Staff

Mar 31, 2025, 4:48 PM

Hi @Hariharan Viswanath

Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Hariharan Viswanath 40 Reputation points

Apr 1, 2025, 7:12 PM

this did not help as i am trying to use the Deployment template to deploy the whole resource over to the Production environment. But as you see in the screenshot below, the logic app itself does not get deployed and the error it shows is:

{"code":"WorkflowManagedIdentityConfigurationInvalid","message":"The workflow connection parameter 'keyvault-2' is not valid. The API connection 'keyvault' is not configured to support managed identity."}
Sai Prabhu Naveen Parimi 1,180 Reputation points Microsoft External Staff

Apr 2, 2025, 4:28 AM

@Hariharan Viswanath

I have sent you a private message. Could you please check and respond so that we can connect further to troubleshoot the issue?

Answer 1

HelloHariharan Viswanath,

Thanks for your time over the meeting and please find the troubleshooting steps below that we have performed to resolve the issue.

First, we have ensured that ARM template for Microsoft.Web/connections correctly references the KeyVault API and includes the Managed Identity for authentication.
After checking and performing the re-deployment we have found the same error " {"code":"WorkflowManagedIdentityConfigurationInvalid","message":"The workflow connection parameter 'keyvault-2' is not valid. The API connection 'keyvault' is not configured to support managed identity."} "

So, we modified the template parameters as shown in the below:

{
    "type": "Microsoft.Web/connections",
    "apiVersion": "2016-06-01",
    "name": "[variables('KeyVault_Connection_Name')]",
    "location": "[variables('location')]",
    "kind": "V1",
    "properties": {
        "api": {
            "id": "[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'), '/managedApis/', 'keyvault')]"
        },
        "parameterValueType": "Alternative",
        "alternativeParameterValues": {
                    "vaultName": "*******"
                },
        "displayName": "[variables('KeyVault_Display_Connection_Name')]"
    }
},

Then we have re-deployed the template and that got worked as expected.

If you found the response helpful, please click Accept Answer and Yes for the provided answer. This will help other community members with similar issues find the solution more easily.

Share via

managed identity authentication

0 additional answers

Your answer