azure identity not found

Not specified by the original author.

Context: "Identity not found" is the Azure instance metadata service (IMDS) answering 400 when ManagedIdentityCredential, often inside DefaultAzureCredential, asks for a token for an identity the Azure fabric has not assigned to that resource. The fuller message usually reads "the requested identity isn't assigned to this resource". The fix is to assign the identity to the resource (or pass the correct

1. Read the full error and note which identity was requested. If you constructed the credential with a client id, that is the one being looked up. If not, it is the resource's default identity.
2. Verify the identity is assigned to this resource. For a VM, run:

az vm identity show --resource-group YOUR_RG --name YOUR_VM

For App Service or Functions, check the Identity blade in the portal. If the listing is empty, or your client id is missing from it, that is the cause.

3. Fix the assignment: enable the system-assigned identity on the resource, or attach your user-assigned identity to it, then confirm the client id you use matches it exactly.
4. Wait a few minutes after assigning. Identity assignment takes time to propagate. Then retry the token call. Expected: a token is returned instead of the 400.

Variant phrasings: the requested identity isn't assigned to this resource; ManagedIdentityCredential authentication unavailable; error_description Identity not found; DefaultAzureCredential failed to retrieve a token from the included credentials.

Root cause: the managed identity credential asks IMDS for a token for a specific identity. IMDS answers 400 invalid_request when that identity has not been assigned to the host making the request. The identity may exist in Entra but is not attached to this VM, app service, container app, or AKS pod, or the requested client id is simply wrong.

Edge cases: on a local dev machine the same credential chain fails with "no response from the IMDS endpoint" because there is no metadata service locally, which is a different cause with a different fix (az login). On AKS with workload identity, a wrong client id in the service account annotation produces this same error. A placeholder or mistyped client id is a common cause, so compare it character by character. Recently assigned identities need propagation time before they work.

When not to use: if you are running locally, do not chase identity assignment. Use az login and AzureCliCredential instead. Do not disable managed identity in DefaultAzureCredential to silence this on an Azure host; fix the assignment.

"Identity not found" is the Azure instance metadata service (IMDS) answering 400 when ManagedIdentityCredential, often inside DefaultAzureCredential, asks for a token for an identity the Azure fabric has not assigned to that resource. The fuller message usually reads "the requested identity isn't assigned to this resource". The fix is to assign the identity to the resource (or pass the correct client id), then retry.

"error": "invalid_request", "error_description": "Identity not found"

Verified resolution: 1. Read the full error and note which identity was requested. If you constructed the credential with a client id, that is the one being looked up. If not, it is the resource's default identity.

2. Verify the identity is assigned to this resource. For a VM, run:

az vm identity show --resource-group YOUR_RG --name YOUR_VM

For App Service or Functions, check the Identity blade in the portal. If the listing is empty, or your client id is missing from it, that is the cause.

3. Fix the assignment: enable the system-assigned identity on the resource, or attach your user-assigned identity to it, then confirm the client id you use matches it exactly.
4. Wait a few minutes after assigning. Identity assignment takes time to propagate. Then retry the token call. Expected: a token is returned instead of the 400.

Variant phrasings: the requested identity isn't assigned to this resource; ManagedIdentityCredential authentication unavailable; error_description Identity not found; DefaultAzureCredential failed to retrieve a token from the included credentials.

Root cause: the managed identity credential asks IMDS for a token for a specific identity. IMDS answers 400 invalid_request when that identity has not been assigned to the host making the request. The identity may exist in Entra but is not attached to this VM, app service, container app, or AKS pod, or the requested client id is simply wrong.

Edge cases: on a local dev machine the same credential chain fails with "no resp

Source: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/TROUBLESHOOTING.md