Unable to get access to Key Vault using Azure MSI on App Service

Question

I have enabled Managed Service Identities on an App Service. However, my WebJobs seem unable to access the keys.

They report:

Tried the following 3 methods to get an access token, but none of them worked. Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried to get token using Managed Service Identity. Unable to connect to the Managed Service Identity (MSI) endpoint. Please check that you are running on an Azure resource that has MSI setup. Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.microsoftonline.com/common. Exception Message: Tried to get token using Active Directory Integrated Authentication. Access token could not be acquired. password_required_for_managed_user: Password is required for managed user Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. 'az' is not recognized as an internal or external command,

Kudo does not show any MSI_ environmental variables.

How is this supposed to work? This is an existing App Service Plan.

Answer 1

For the folks that will come across these answers, I would like to share my experience.

I got this problem with Azure Synapse pipeline run. Essentially I added access policies properly to the KeyVault, and also I added a LinkedService to the Azure Synapse pointing to my KeyVault.

If I trigger the notebook manually it works, but in the pipeline, it fails.

Initially, I used the following statement:

url = TokenLibrary.getSecret("mykeyvault", "ConnectionString")

Then I added the name of the linked service as a third parameter, and the pipeline was able to leverage that linked service to obtain the MSI token for a Vault.

url = TokenLibrary.getSecret("mykeyvault", "ConnectionString", "AzureKeyVaultLinkedServiceName")

Answer 2

Enable the identity and give access to your azure function app in keyvault via access policy. You can find identity in platform feature tab These two steps works for me