title: DefaultAzureCredential doesn't work with User Assigned Managed Identity in Azure App Service while thats not the case with Azure VMSS
body: <p>Enabled same &quot;user assigned managed identity&quot; for Azure VMSS as well as for Azure function app.</p>
  <p>Added the MI to the access policy of Azure key vault.</p>
  <p>On below application hosts, using &quot;DefaultAzureCredential&quot; trying connect to the Azure key vault to read application secrets,</p>
  <ol>
  <li><p>From the application deployed on Azure VMSS, with out any hassle can able to connect to the Azure key vault to read application secrets using &quot;DefaultAzureCredential&quot; api</p>
  </li>
  <li><p>Where as from Azure function can't able to connect to keyvault using &quot;DefaultAzureCredential&quot; api, it throws below exception</p>
  <pre><code>Error occurred while trying to connect to Key Vault. Azure.Identity: 
  ManagedIdentityCredential authentication failed: Service request 
  failed. Status: 400 (Bad Request)
  </code></pre>
  </li>
  </ol>
  <p>Overcome the above issue in Azure function app by adding explicit &quot;AZURE_CLIENT_ID&quot; variable in appsettings and by assigning &quot;user assigned managed identity&quot; name to it.</p>
  <p>Would like to know, why there is difference in behaviour of &quot;DefaultAzureCredential&quot;api while consuming it in Azure VMSS vs Azure function app where explicit mentioning of &quot;AZURE_CLIENT_ID&quot; required? what is the rationale here?</p>
  <p>P.S: the above mentioned happening only with user assigned not system assigned managed identity.</p>