highIntermediateSymptom-first#managed-identity#authentication#rbac#keyvault#authorization

Managed Identity not enabled on Azure resource — authentication failures

Application throws ClientAuthenticationError: ManagedIdentityCredential authentication failed

Likely source:securityconnectivityconfiguration

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Application throws ClientAuthenticationError: ManagedIdentityCredential authentication failed
  • az keyvault secret show returns AuthorizationDenied for the resource identity
  • az identity list shows no user-assigned identity on the resource

Managed identity eliminates secret rotation but requires two steps: enable the identity on the resource AND grant it RBAC on the target. Missing either step causes auth failures.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Resource identity configuration

    az vm show -g <RG> -n <VM-NAME> --query "{type:identity.type,principalId:identity.principalId}" -o json

  • Identity role assignments

    az role assignment list --assignee <PRINCIPAL-ID> --query "[].{role:roleDefinitionName,scope:scope}" -o table

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • az vm show returns identity.type = None
  • No principalId in the identity block

Confirm before fixing

az vm show -g <RG> -n <VM-NAME> --query identity.type -o tsv
READ

Check the identity type

Fix

az vm identity assign -g <RG> -n <VM-NAME> --query principalId -o tsv
CHANGE

Enable system-assigned managed identity on the VM

Expected: A principal ID is returned

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
az vm show -g <RG> -n <VM-NAME> --query identity -o json
READ

Check the current identity configuration

2
az vm identity assign -g <RG> -n <VM-NAME> --query principalId -o tsv
CHANGE

Enable system-assigned identity if missing

3
az role assignment create --assignee-object-id <PRINCIPAL-ID> --role "Key Vault Secrets User" --scope <SCOPE>
CHANGE

Grant the identity access to the target resource

Prevention

  • Use Bicep/Terraform to assign identities and roles atomically during resource creation.
  • Audit identity RBAC assignments regularly with Azure Policy.
  • Use Azure Resource Graph to find resources without a managed identity.
  • Prefer system-assigned identities for single-purpose resources; use user-assigned for shared identities.

Related runbooks

Same stack, same failure family — worth a skim.

Key Vault RBAC — insufficient privileges for secret and certificate accesshigh

az keyvault secret show returns Forbidden: insufficient permissions

AzureIntermediate2 causes
Open runbook
Service principal secret expired — authentication failureshigh

az login --service-principal fails with AADSTS7000222 or invalid client secret

AzureFoundation2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.