[QUERY] User Managed Identity not working

Query/Question

Created this issue on behalf of @dsm4u, please be sure to include them on any questions or replies.

I am trying to use usermanaged identity to access storage account from VM scale set. Created a managed identity, added it to scaleset and then given storage contribute access to the identity for the storage account.

But when i try to access the storage account via .net console app running on the scaleset instance, it giving authentication error.

The same scenario is working fine for system managed identity,

Can you please advise.

These are the steps I have followed:

1. Created a Manged Identity via portal.
2. In the Virtual Scaleset, went to the identity and added the newly created identity as user assigned identity.
3. In the portal, went to the storage account, and in the access control (IAM) added role assignment. In that selected user assigned managed identity and selected the identity created above.
4. These are the configuration done on the portal level.
5. Now in the console app used the queue client and tried to access the storage account. and the console app was executed from the scale set instance. code as below: QueueClient queueClient = new QueueClient(queueUri, new DefaultAzureCredential(false)); var message = queueClient.ReceiveMessage();

Please do let me know if any other details required on this.

Environment:

• Name and version of the Library package used: [e.g. Azure.Storage.Blobs 12.2.0]
• Hosting platform or OS and .NET runtime version (dotnet --info output for .NET Core projects): [e.g. Azure AppService or Windows 10 .NET Framework 4.8]
• IDE and version : [e.g. Visual Studio 16.3]

[christothes]

Thanks this worked… Also, observed that if we turn off the system managed identity for the scaleset and enable only user managed identity then its working fine without explicitly setting the clientid.

FYI - These docs explain this behavior

[dsm4u]

Thanks this worked… Also, observed that if we turn off the system managed identity for the scaleset and enable only user managed identity then its working fine without explicitly setting the clientid.