**TL;DR:** Symptom: ManagedIdentityCredential authentication unavailable on an Azure host Cause: Code expects a managed identity but IMDS is unreachable: either no identity is assigned to the host, the VNet/proxy blocks the instance metadata endpoint, or several user-assigned identities exist and VERIFY VERIFY: metadata endpoint query works AND the SDK call returns data; debug log shows the managed-identity step succeeding.

## The fix

SYMPTOM
ManagedIdentityCredential authentication unavailable on an Azure host

CAUSE
Code expects a managed identity but IMDS is unreachable: either no identity is assigned to the host, the VNet/proxy blocks the instance metadata endpoint, or several user-assigned identities exist and the code did not pick one.

CONFIRM IT
CONFIRM: query the instance metadata endpoint from the host with the Metadata header - JSON response means IMDS works and the problem is assignment/selection. `az vm identity show` / app identity blade shows whether any identity is assigned.

FIX
FIX: assign a system-assigned identity (or attach the user-assigned one); if multiple user-assigned, set AZURE_CLIENT_ID or pass managed_identity_client_id so the code picks the right one; open the firewall/proxy for the metadata endpoint. Locally, use DefaultAzureCredential so the chain falls through to az login instead of ManagedIdentityCredential directly.

VERIFY
VERIFY: metadata endpoint query works AND the SDK call returns data; debug log shows the managed-identity step succeeding.

## When to use this

- This covers exactly what the title says: Diagnose.
- You are setting this up for the first time, or auditing an existing setup.
- You want the key gotchas in one place before you start.

## When not to use this

- You are doing a different workflow with Diagnose; these steps are specific to the title above.
- You need the full reference docs; this is the short path, not the manual.

## Compatibility

- Not pinned to a specific version; follows current Diagnose behavior.