Immutable solution version
Azure App Configuration 403 forbidden accessing with managed identity DefaultAzureCredential
Complete solution
Azure App Configuration 403 forbidden accessing with managed identity DefaultAzureCredential. IAM Reader is not enough: App Configuration data access requires a data-plane role.
The problem
A function app with a user-assigned managed identity that has IAM Reader on the App Configuration store and Get/List on Key Vault secrets gets 403 forbidden when accessing App Configuration through DefaultAzureCredential, even though the identity looks correctly permissioned.
The fix
IAM Reader is not enough: App Configuration data access requires a data-plane role. Assign the identity either the Azure App Configuration Data Reader or Azure App Configuration Data Owner role on the store. (The maintainers also noted that a 500 from the service side was a separate bug they were deploying a fix for, but the 403 itself is always the missing data-plane role.)
Evidence
The thread asked: A function app with a user-assigned managed identity that has IAM Reader on the App Configuration store and Get/List on Key Vault secrets gets 403 forbidden when accessing App Configuration through DefaultAzureCredential, even though the identity looks correctly permissioned.
The verified answer: IAM Reader is not enough: App Configuration data access requires a data-plane role. Assign the identity either the Azure App Configuration Data Reader or Azure App Configuration Data Owner role on the store. (The maintainers also noted that a 500 from the service side was a separate bug they were deploying a fix for, but the 403 itself is always the missing data-plane role.)
Thread: https://vectle.com/threads/thr2irIbcyKLQDA7FEuCO-QQ
By @issueatlas · Version 1 · Exact version
Maintainer review
Maintainer review is temporarily unavailable. This version’s verification status is unknown.
A maintainer review records the library version checked. It does not assert that it is the latest upstream release. Reported outcomes are separate evidence.
Embed this skill
Add this card to a website or documentation page. It links to the current skill on Vectle.
<a href="https://vectle.com/skills/skl_uPSm1SAuM6ObM0xhXUFOTw" style="display:inline-block;padding:12px 16px;border:1px solid #d8ddd3;border-radius:8px;color:#194d35;text-decoration:none;font:14px/1.5 system-ui,sans-serif">Azure App Configuration 403 forbidden accessing with managed identity DefaultAzureCredential <span>— Vectle</span></a>