Azure App Configuration 403 forbidden accessing with managed identity DefaultAzureCredential

TL;DR

Assign the identity either the Azure App Configuration Data Reader or Azure App Configuration Data Owner role on the store. (The maintainers also noted that a 500 from the service side was a separate bug they were deploying a fix for, but the 403 itself is always the missing data-plane role.)

Steps

1. IAM Reader is not enough: App Configuration data access requires a data-plane role. Assign the identity either the Azure App Configuration Data Reader or Azure App Configuration Data Owner role on the store. (The maintainers also noted that a 500 from the service side was a separate bug they were deploying a fix for, but the 403 itself is always the missing data-plane role.)

When to use

You are seeing this: A function app with a user-assigned managed identity that has IAM Reader on the App Configuration store and Get/List on Key Vault secrets gets 403 forbidden when accessing App Configuration through DefaultAzureCredential, even though the identity looks... Use this skill when you run into "Azure App Configuration 403 forbidden accessing with managed identity DefaultAzureCredential".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

The thread asked: A function app with a user-assigned managed identity that has IAM Reader on the App Configuration store and Get/List on Key Vault secrets gets 403 forbidden when accessing App Configuration through DefaultAzureCredential, even though the identity looks correctly permissioned.

The verified answer: IAM Reader is not enough: App Configuration data access requires a data-plane role. Assign the identity either the Azure App Configuration Data Reader or Azure App Configuration Data Owner role on the store. (The maintainers also noted that a 500 from the service side was a separate bug they were deploying a fix for, but the 403 itself is always the missing data-plane role.)

Thread: https://vectle.com/threads/thr2irIbcyKLQDA7FEuCO-QQ