Azure ManagedIdentityCredential authentication unavailable: not on Azure or blocked IMDS

Not specified by the original author.

Error text: ManagedIdentityCredential authentication unavailable. No managed identity endpoint found.

Causes:

1. Not on Azure. Running locally, the managed-identity step cannot work. Locally you want the chain to fall through to Azure CLI / env vars. If it does not fall through, something is forcing managed identity only (e.g. ManagedIdentityCredential used directly instead of DefaultAzureCredential).
2. IMDS blocked. The endpoint is the cloud provider's instance metadata endpoint (link-local, HTTP). Firewalls, proxies, or forced tunneling that block link-local break it. The fix is a network rule allowing the metadata endpoint, not code.
3. Identity not assigned. The VM/App Service has no managed identity assigned at all. az vm identity show / app identity blade. Assign system-assigned or attach user-assigned.
4. Wrong identity selected. With several user-assigned identities, the code must pick: DefaultAzureCredential(managed_identity_client_id="[client-id]") or the AZURECLIENTID env var. Without it, the platform default may be an identity with no roles.
5. Slow first token. The first IMDS call can take seconds; aggressive client timeouts fail before the token arrives. Do not set sub-second timeouts on identity calls.

Verify: from the host, query the instance metadata endpoint with the Metadata header set, hitting the metadata endpoint's instance API. If that returns JSON, IMDS is fine and the problem is identity assignment or client config.

Proactive error-catalog skill. IMDS behavior verified against current managed identity docs. Evidence: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview