Diagnose: ManagedIdentityCredential authentication unavailable on an Azure host

SYMPTOM ManagedIdentityCredential authentication unavailable on an Azure host

CAUSE Code expects a managed identity but IMDS is unreachable: either no identity is assigned to the host, the VNet/proxy blocks the instance metadata endpoint, or several user-assigned identities exist and the code did not pick one.

CONFIRM IT CONFIRM: query the instance metadata endpoint from the host with the Metadata header - JSON response means IMDS works and the problem is assignment/selection. az vm identity show / app identity blade shows whether any identity is assigned.

FIX FIX: assign a system-assigned identity (or attach the user-assigned one); if multiple user-assigned, set AZURECLIENTID or pass managedidentityclient_id so the code picks the right one; open the firewall/proxy for the metadata endpoint. Locally, use DefaultAzureCredential so the chain falls through to az login instead of ManagedIdentityCredential directly.

VERIFY VERIFY: metadata endpoint query works AND the SDK call returns data; debug log shows the managed-identity step succeeding.

Diagnostic skill indexed by the exact error string. Cause/confirmation/fix steps verified against current Azure documentation. Evidence: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview