Azure.Identity Question

[lucashby]

Library name and version

Azure.Identity 1.8.0

Query/Question

I am able to use v1.7.0 of Azure.Identity with no problems. My situation is I have an AKS cluster using pod identity which is configured to a user assigned managed identity. I use the Microsoft.Extensions.Azure library to configure all of my Azure clients such as Blob client, ServiceBus client, etc.

While using v1.7.0, occasionally my application may attempt to bootstrap before the identity is available to the pod to use and gets the occasional error only during startup which is fine because the pod won't be considered ready until it successfully starts.

However, with v1.8.0 I get stuck in an infinite error state and get stuck with millions of logged failures that look like the following:

ManagedIdentityCredential authentication failed: The json containing instance metadata does not contain details about the authority in use: login.microsoftonline.us. See https://aka.ms/msal-net-custom-instance-metadata for more details. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/managedidentitycredential/troubleshoot The json containing instance metadata does not contain details about the authority in use: login.microsoftonline.us. See https://aka.ms/msal-net-custom-instance-metadata for more details.

The links are of no help. I'm not sure what changed between 1.7.0 and 1.8.0, but could someone please explain what was changed and why this may be occurring?

Environment

No response

[jsquire]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[ohads-MSFT]

We hit the same issue, for us it manifested as this error:

Unhandled exception. Azure.Identity.AuthenticationFailedException: ManagedIdentityCredential authentication failed: Configure either region discovery or custom instance metadata. Custom instance discovery metadata overrides region discovery.
See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/managedidentitycredential/troubleshoot
---> MSAL.NetCore.4.46.0.0.MsalClientException:
ErrorCode: region_discovery_with_custom_instance_metadata
Microsoft.Identity.Client.MsalClientException: Configure either region discovery or custom instance metadata. Custom instance discovery metadata overrides region discovery.
at Microsoft.Identity.Client.ConfidentialClientApplicationBuilder.Validate()
at Microsoft.Identity.Client.AbstractApplicationBuilder1.BuildConfiguration() at Microsoft.Identity.Client.ConfidentialClientApplicationBuilder.BuildConcrete() at Microsoft.Identity.Client.ConfidentialClientApplicationBuilder.Build() at Azure.Identity.MsalConfidentialClient.CreateClientAsync(Boolean async, CancellationToken cancellationToken) at Azure.Identity.MsalClientBase1.GetClientAsync(Boolean async, CancellationToken cancellationToken)
at Azure.Identity.MsalConfidentialClient.AcquireTokenForClientCoreAsync(String[] scopes, String tenantId, Boolean async, CancellationToken cancellationToken)
at Azure.Identity.MsalConfidentialClient.AcquireTokenForClientAsync(String[] scopes, String tenantId, Boolean async, CancellationToken cancellationToken)
at Azure.Identity.ManagedIdentityClient.AuthenticateAsync(Boolean async, TokenRequestContext context, CancellationToken cancellationToken)
at Azure.Identity.ManagedIdentityCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)