how to fix azure app configuration connectivity issue using managed idnetity

Question

how to fix azure app configuration connectivity issue using managed idnetity

Shaheda Ansari 0

we have created Azure app configuration and used it through managed identity.

for this we follow the steps as below

enable system assigned identity in app service

In app configuration we have add role as configuration data reader to app service

use managed identity credential in program.cs class

and publish it.

after publish it gives error forbidden

RequestFailedException: Service request failed. Status: 403 (Forbidden) Headers: Date: Fri, 16 May 2025 06:38:09 GMT Connection: keep-alive x-ms-request-id: 6ec4c8d6-0a32-497e-a30e-a94712bf4a82 x-ms-client-request-id: f7a09a6f-3957-4997-916e-9742ee3ba97c x-ms-correlation-request-id: 6ec4c8d6-0a32-497e-a30e-a94712bf4a82 Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Content-Length: 0

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

ODOM IFEANYI 0 Reputation points

2026-07-30T14:20:50.7266667+00:00
@Shaheda Ansari a 403 from App Configuration with an empty body can mean one of three things:

The store's networking rules are blocking the request.

The token belongs to a different principal than the one you granted,

The role isn't a data-plane role,

Can you confirm which identity is actually being used?

Verify the principal ID of the app's system-assigned identity and then list what it's actually assigned:

az webapp identity show -n <app-name> -g <rg> --query principalId -o tsv

az role assignment list --assignee <principalId> --all -o table

Two things to note:

Deployment slots have their own identity. If you published to a staging slot, the slot's principal is different from the production one and has no role assignment. Grant the role to the slot's identity too.

Mixed identities. If the App Service has both a system-assigned and one or more user-assigned identities, ManagedIdentityCredential with no client ID can end up requesting a token for the wrong one. Pin it explicitly:

Verify the role is the data-plane one

Check the store's networking

In the App Configuration resource, look at Settings → Networking. If public network access is disabled or restricted to specific IPs/private endpoints and your App Service isn't VNet-integrated into that network, App Configuration returns 403 with exactly this signature: empty body, no error detail. Temporarily setting public access to "All networks" is a fast way to confirm or rule this out.

Give it time

If you use Key Vault references
JuliaMarvin 21,995 Reputation points Volunteer Moderator

2026-07-30T15:01:37.51+00:00

@ODOM IFEANYI
Please refrain from resurrecting old threads.
See: [Article] Community Tip: Get the most out of active questions

This thread will now be locked.

ODOM IFEANYI 0 Reputation points

2026-07-30T14:20:50.7266667+00:00

@Shaheda Ansari a 403 from App Configuration with an empty body can mean one of three things:

The store's networking rules are blocking the request.

The token belongs to a different principal than the one you granted,

The role isn't a data-plane role,

Can you confirm which identity is actually being used?

Verify the principal ID of the app's system-assigned identity and then list what it's actually assigned:

az webapp identity show -n <app-name> -g <rg> --query principalId -o tsv

az role assignment list --assignee <principalId> --all -o table

Two things to note:

Deployment slots have their own identity. If you published to a staging slot, the slot's principal is different from the production one and has no role assignment. Grant the role to the slot's identity too.

Mixed identities. If the App Service has both a system-assigned and one or more user-assigned identities, ManagedIdentityCredential with no client ID can end up requesting a token for the wrong one. Pin it explicitly:

Verify the role is the data-plane one

Check the store's networking

In the App Configuration resource, look at Settings → Networking. If public network access is disabled or restricted to specific IPs/private endpoints and your App Service isn't VNet-integrated into that network, App Configuration returns 403 with exactly this signature: empty body, no error detail. Temporarily setting public access to "All networks" is a fast way to confirm or rule this out.

Give it time

If you use Key Vault references
JuliaMarvin 21,995 Reputation points Volunteer Moderator

2026-07-30T15:01:37.51+00:00

@ODOM IFEANYI
Please refrain from resurrecting old threads.
See: [Article] Community Tip: Get the most out of active questions

This thread will now be locked.