Appconfiguration: App Configuration 401 error using DefaultAzureCredential in VS2019

[dfibuch]

One of my colleagues is seeing this issue again today, was working fine yesterday and today getting this:

Azure.RequestFailedException: 'Service request failed.
Status: 401 (Unauthorized)

Headers:
Server: openresty/1.15.8.3
Date: Thu, 10 Sep 2020 09:53:40 GMT
Connection: keep-alive
WWW-Authenticate: HMAC-SHA256,Bearer error="invalid_token", 
error_description="The access token is from the wrong issuer. It must match the AD tenant associated with the subscription, to which the configuration store belongs. If you just transferred your subscription and see this error message, please try back later."

Before we start investigating further than we have (restart things, sign out/in again) can you guys verify there is nothing going on your end?

EDIT: It's working fine for me, with same code base and same level of access. Only difference is I am in a different country to him.

[zhenlan]

@dfibuch, are you and your colleague assigned App Configuration Data Reader/Owner role directly or via a security group in the access control of the App Configuration store? Which region does your store reside in?

[dfibuch]

@zhenlan We are both assigned with those roles as individuals, not through any group. The store is in North Europe.

[dfibuch]

Still an issue for us. Is this the best place to try get this fixed or should I be raising a ticket with some Azure department?

[zhenlan]

@dfibuch as you are assigned directly to the App Config store, not through a security group, this is a different issue than #287

Are you in an environment with multiple AAD tenants? Are you and your colleague in different AAD tenants (domains)? According to the error message, you obtained the AAD token from one tenant and used it to authenticate with an App Config store that is created in another AAD tenant.

Given that this works for you but not your colleague, do you see anything else that is different between you two?

[stotlyakov]

Hi, we had the same issue. The solution was to ensure that the Tenant you are using in Azure is the same as the default Azure tenant in your Visual Studio. az login in the shell and see which one has the "isDefault" flag set to true

[dfibuch]

@stotlyakov Uh good one, I'll try it out with him tomorrow and report back!

[zhenlan]

@dfibuch has the issue been resolved?

[dfibuch]

Sorry for inactivity on this @zhenlan , the person in question has been off and is not back until Tuesday so I cannot confirm. If it works for you feel free to close this and I will comment back if it worked or not.

[dfibuch]

@zhenlan Sorry again for the delay, I can confirm this is now working again for my colleague without changing a thing...