title: Azure App Service with User-Assigned Managed Identity crashes application
body: <p>I have both a VMSS and multiple AppServices I would like to use the same User-Assigned Managed Service Identity. For the VMSS, I am able to assign the identity and use it to retrieve secrets from the Azure Key Vault with the following code:</p>
  <pre><code>var client = new SecretClient(new Uri(KeyVault), new DefaultAzureCredential());
  var secret = client.GetSecret(&quot;secret-name&quot;);
  </code></pre>
  <p>The AppServices use ASP.NET Core 3.1, and so <a href="https://github.com/dotnet/AspNetCore.Docs/blob/427dc3d2961c5272ff816c5128fb6c0c40dd7ce8/aspnetcore/security/key-vault-configuration/samples/3.x/SampleApp/Program.cs#L75" rel="nofollow noreferrer">the recommended way</a> to access Key Vault secrets is:</p>
  <pre><code>var azureServiceTokenProvider = new AzureServiceTokenProvider(&quot;RunAs=App;AppId={client id for the user-assigned managed identity elided}&quot;);
  var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
  config.AddAzureKeyVault(&quot;https://{my vault name}.vault.azure.net/&quot;, keyVaultClient, new DefaultKeyVaultSecretManager());
  </code></pre>
  <p>Note the connection string is derived from the 'User-assigned identity for Azure resources' scenario in <a href="https://docs.microsoft.com/en-us/azure/key-vault/general/service-to-service-authentication#connection-string-support" rel="nofollow noreferrer">this documentation</a>.</p>
  <p>The above code snippet throws the following exception:</p>
  <blockquote>
  <p>2020-08-27T02:06:18.409648197Z Unhandled exception. System.ArgumentException: Connection string RunAs=App;AppId={client id ellided} is not valid. Must contain 'TenantId' attribute and it must not be empty.
  2020-08-27T02:06:18.409681697Z    at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderFactory.ValidateAttribute(Dictionary`2 connectionSettings, String attribute, String connectionString)
  2020-08-27T02:06:18.409688597Z    at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderFactory.Create(String connectionString, String azureAdInstance)
  2020-08-27T02:06:18.409693297Z    at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider..ctor(String connectionString, String azureAdInstance)
  2020-08-27T02:06:18.409697797Z    at API.Program.&lt;&gt;c.b__1_0(HostBuilderContext context, IConfigurationBuilder config) in /tmp/8d84a2d16145d21/API/Program.cs:line 25
  2020-08-27T02:06:18.409703497Z    at Microsoft.Extensions.Hosting.HostBuilder.BuildAppConfiguration()
  2020-08-27T02:06:18.409707797Z    at Microsoft.Extensions.Hosting.HostBuilder.Build()</p>
  </blockquote>
  <p>When I add the 'TenantId' as requested, the message changes to:</p>
  <blockquote>
  <p>Unhandled exception. System.ArgumentException: Connection string RunAs=App;AppId={client id elided};TenantId={tenant id elided} is not valid. Must contain at least one of CertificateStoreLocation or AppKey attributes.</p>
  </blockquote>
  <p>The managed identity does not have a certificate, and I am trying to use MSI to avoid adding secrets to code or appsettings.</p>
  <p>I have tried removing the 'AppId' and 'TenantId' part of the connection string as per the 'Managed identities for Azure resources' scenario which results in the following exception:</p>
  <blockquote>
  <p>Unhandled exception. Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderException: Parameters: Connection String: RunAs=App, Resource: <a href="https://vault.azure.net" rel="nofollow noreferrer">https://vault.azure.net</a>, Authority: <a href="https://login.windows.net/b905ac32-5779-4bab-ac34-a8445e89f9e4" rel="nofollow noreferrer">https://login.windows.net/b905ac32-5779-4bab-ac34-a8445e89f9e4</a>. Exception Message: Tried to get token using Managed Service Identity. Access token could not be acquired. MSI ResponseCode: BadRequest, Response: {&quot;statusCode&quot;:400,&quot;message&quot;:&quot;Unable to load requested managed identity.&quot;,&quot;correlationId&quot;:&quot;c8409322-357a-49d0-9686-453fb37cc4b4&quot;}</p>
  </blockquote>
  <p>I assume it's trying to load the non-existing system-assigned identity. I have confirmed that Managed Identity is configured for the (Linux) WebApp instance through the Kudu console:</p>
  <pre><code>  Kudu Remote Execution Console Type 'exit' to reset this console.
    /home&gt;env
    MSI_ENDPOINT=[Managed identity has been configured. This value is not viewable in Kudu but is exposed to the app.]
    IDENTITY_ENDPOINT=[Managed identity has been configured. This value is not viewable in Kudu but is exposed to the app.]
    IDENTITY_HEADER=[Managed identity has been configured. This value is not viewable in Kudu but is exposed to the app.]
    MSI_SECRET=[Managed identity has been configured. This value is not viewable in Kudu but is exposed to the app.]
  </code></pre>
  <p>Is there an issue with MSI+AppService+Linux, or the documentation, or both, or the code samples, or the configuration, or my code?</p>