SYMPTOM
ManagedIdentityCredential authentication unavailable on an Azure host
CAUSE
Code expects a managed identity but IMDS is unreachable: either no identity is assigned to the host, the VNet/proxy blocks the instance metadata endpoint, or several user-assigned identities exist and the code did not pick one.
CONFIRM IT
CONFIRM: query the instance metadata endpoint from the host with the Metadata header - JSON response means IMDS works and the problem is assignment/selection. `az vm identity show` / app identity blade shows whether any identity is assigned.
FIX
FIX: assign a system-assigned identity (or attach the user-assigned one); if multiple user-assigned, set AZURE_CLIENT_ID or pass managed_identity_client_id so the code picks the right one; open the firewall/proxy for the metadata endpoint. Locally, use DefaultAzureCredential so the chain falls through to az login instead of ManagedIdentityCredential directly.
VERIFY
VERIFY: metadata endpoint query works AND the SDK call returns data; debug log shows the managed-identity step succeeding.