When using Azure App Configuration offline, it crashes even if set as optional.

Question

When using Azure App Configuration offline, it crashes even if set as optional.

Shawn Wildermuth 20 MVP

I am looking for a suggestion for handling App Configuration offline. I don't need to have it work offline, but i would like to configure it to fail silently. I have it setup to be an optional configuration source:

builder.AddAzureAppConfiguration(options =>
{
    options.Connect(new Uri($"https://{configServer}.azconfig.io"),
        new DefaultAzureCredential(credentalOptions));
}, optional);

But if it can't find a credential (which happens when used offline), it throws:

Azure.Identity.CredentialUnavailableException: DefaultAzureCredential failed to retrieve a token from the included credentials. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/defaultazurecredential/troubleshoot
- EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot
- WorkloadIdentityCredential authentication unavailable. The workload options are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/workloadidentitycredential/troubleshoot
- ManagedIdentityCredential authentication unavailable. No response received from the managed identity endpoint.
- Process "C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Asal\TokenService\Microsoft.Asal.TokenService.exe" has failed with unexpected error: TS003: Error, TS004: Unable to get access token.  'WAM Error
 Error Code: 3399942148
 Error Message: NoNetwork
 WAM Error Message: The server or proxy was not found.
 Internal Error Code: 557973641
 Possible cause: no Internet connection '.

Any way to catch and ignore these failures (and just rely on the other configuration sources) if offline? (This is used for an appservice hosted application, but our sales team needs to show it to clients (running locally) where accessing wifi may be difficult or impossible.

Thoughts?

Sridevi Machavarapu 33,475 Reputation points Microsoft External Staff Moderator

2026-06-01T15:08:25.4533333+00:00
Hello Shawn Wildermuth,

optional: true only makes Azure App Configuration an optional configuration source. It does not suppress authentication or connectivity errors that occur while the provider is being initialized.

When Azure App Configuration attempts to connect, DefaultAzureCredential still needs to acquire a token. If the machine is offline or no credential source is available, a CredentialUnavailableException may be raised.

One option is to wrap the Azure App Configuration setup in a try/catch block and continue with the remaining configuration sources if the connection cannot be established:

try { builder.AddAzureAppConfiguration(options => { options.Connect( new Uri($"https://{configServer}.azconfig.io"), new DefaultAzureCredential(credentialOptions)); }); } catch (Azure.Identity.CredentialUnavailableException) { // Continue without Azure App Configuration } catch (Exception) { // Optionally log the failure and continue }

For scenarios where the application must run both in Azure and in disconnected environments, it's often best to keep essential settings in local configuration sources (such as appsettings.json or environment variables) and treat Azure App Configuration as an additional source when it is available.

Could you share the version of Microsoft.Extensions.Configuration.AzureAppConfiguration you're using and whether the exception occurs during startup or later during configuration loading? That may help identify if there are provider-specific options available.

Answer accepted by question author

0 additional answers

Your answer

Sridevi Machavarapu 33,475 Reputation points Microsoft External Staff Moderator

2026-06-01T15:08:25.4533333+00:00

Hello Shawn Wildermuth,

optional: true only makes Azure App Configuration an optional configuration source. It does not suppress authentication or connectivity errors that occur while the provider is being initialized.

When Azure App Configuration attempts to connect, DefaultAzureCredential still needs to acquire a token. If the machine is offline or no credential source is available, a CredentialUnavailableException may be raised.

One option is to wrap the Azure App Configuration setup in a try/catch block and continue with the remaining configuration sources if the connection cannot be established:

try { builder.AddAzureAppConfiguration(options => { options.Connect( new Uri($"https://{configServer}.azconfig.io"), new DefaultAzureCredential(credentialOptions)); }); } catch (Azure.Identity.CredentialUnavailableException) { // Continue without Azure App Configuration } catch (Exception) { // Optionally log the failure and continue }

For scenarios where the application must run both in Azure and in disconnected environments, it's often best to keep essential settings in local configuration sources (such as appsettings.json or environment variables) and treat Azure App Configuration as an additional source when it is available.

Could you share the version of Microsoft.Extensions.Configuration.AzureAppConfiguration you're using and whether the exception occurs during startup or later during configuration loading? That may help identify if there are provider-specific options available.

Answer 1

Wrap the Azure App Configuration provider registration in a try/catch and fall back to other configuration sources when DefaultAzureCredential (or any TokenCredential) throws CredentialUnavailableException.

optional on AddAzureAppConfiguration controls failures when connecting to the store (for example, endpoint not reachable), but not failures thrown by the credential itself. DefaultAzureCredential throws CredentialUnavailableException when no credential in the chain can authenticate, and that exception must be handled explicitly.

Example:

using Azure.Identity;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.Configuration.AzureAppConfiguration;

var builder = new ConfigurationBuilder();

try
{
    builder.AddAzureAppConfiguration(options =>
    {
        var endpoint = new Uri($"https://{configServer}.azconfig.io");
        options.Connect(endpoint, new DefaultAzureCredential(credentialOptions));
    });
}
catch (CredentialUnavailableException)
{
    // Ignore and rely on other configuration providers when offline
}

var config = builder.Build();

For production, consider replacing DefaultAzureCredential with a deterministic credential (for example, ManagedIdentityCredential) and using DefaultAzureCredential only for local development, as recommended in the authentication best practices.

References: