AppAuthentication is not detecting MSI in a Windows container on Azure App Service

Describe the bug I use the Microsoft.Azure.Services.AppAuthentication package to retrieve the access token of the MSI to authenticate with both Key Vault and other App Services. This works great for a ASP.NET Core 3.1 web app running in Linux container on an Azure App Service. The exact same code also works great for a ASP.NET Core 2.2 web app targeting the .NET Framework 4.8 and running on a normal Windows Azure App Service. The exact same code does NOT work for a ASP.NET Core 2.2 web app targeting the .NET Framework 4.8 and running in a Windows container on a Windows Azure App Service.

When running in a Windows container, the Microsoft.Azure.Services.AppAuthentication library does not seem to pickup the MSI credentials or detect the MSI for some reason. I’m wondering if this is expected to work or not and if anyone has actually tested this and can confirm if it works?

If I supply an AzureServicesAuthConnectionString environment variable it works fine and the Microsoft.Azure.Services.AppAuthentication library detects and uses the SP and credentials that are specified in the AzureServicesAuthConnectionString environment variable. But this is not meant to be used like this for production deployments. It should detect and use the MSI of the web app.

Expected behavior Microsoft.Azure.Services.AppAuthentication should work the same in a Windows container on an Azure App Service as it does for a Linux container on an Azure App Service and also a normal web app.

Actual behavior (include Exception or Stack Trace) Seems to ignore the MSI credentials. I am having a difficult time getting any logs out of the container regarding Microsoft.Azure.Services.AppAuthentication.

Environment Azure Windows container App Service with MSI enabled. ASP.NET Core 2.2 targeting the .NET Framework 4.8. Microsoft.Azure.Services.AppAuthentication v1.6.0.

[jvano]

We have no plans to fix VNET_ROUTE_ALL=1 in the short term but I will make sure that if it is defined not to break existing functionality like MSI

[krispenner]

Thanks @jvano. I have created a support request. Will close this.