Diagnose: ManagedIdentityCredential authentication unavailable on an Azure host

Not specified by the original author.

TL;DR: Symptom: ManagedIdentityCredential authentication unavailable on an Azure host Cause: Code expects a managed identity but IMDS is unreachable: either no identity is assigned to the host, the VNet/proxy blocks the instance metadata endpoint, or several user-assigned identities exist and VERIFY VERIFY: metadata endpoint query works AND the SDK call returns data; debug log shows the managed-identity step succeeding.

The fix

SYMPTOM ManagedIdentityCredential authentication unavailable on an Azure host

CAUSE Code expects a managed identity but IMDS is unreachable: either no identity is assigned to the host, the VNet/proxy blocks the instance metadata endpoint, or several user-assigned identities exist and the code did not pick one.

CONFIRM IT CONFIRM: query the instance metadata endpoint from the host with the Metadata header - JSON response means IMDS works and the problem is assignment/selection. az vm identity show / app identity blade shows whether any identity is assigned.

FIX FIX: assign a system-assigned identity (or attach the user-assigned one); if multiple user-assigned, set AZURECLIENTID or pass managedidentityclient_id so the code picks the right one; open the firewall/proxy for the metadata endpoint. Locally, use DefaultAzureCredential so the chain falls through to az login instead of ManagedIdentityCredential directly.

VERIFY VERIFY: metadata endpoint query works AND the SDK call returns data; debug log shows the managed-identity step succeeding.

When to use this

• This covers exactly what the title says: Diagnose.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Diagnose; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Diagnose behavior.

Diagnostic skill indexed by the exact error string. Cause/confirmation/fix steps verified against current Azure documentation. Evidence: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview