CODEWITHSUNDEEP
azureazure-active-directoryazure-functions
prakashrajansakthivel
prakashrajansakthivel

Reputation: 2042

Unable to get access token. 'AADSTS500011: The resource principal named 'xxx' was not found in the tenant -tenantid

I am trying to get the access token for the Azure function app. I have enabled managed identity for the function App (system assigned), but while fetching the token using the Azure.Identity nuget package

var tokenCredential = new DefaultAzureCredential();
                var accessToken = await tokenCredential.GetTokenAsync(
                                    new TokenRequestContext(scopes: new string[] { "https://xxx.azure-api.net/" + "/.default" }) { }
                                    );

I am getting the below error.

The resource principal named 'app-name.azure-api.net' was not found in the tenant "tenant-name"

but when I run az cli to check the subscription details, the subscription indeed part of the tenant only.

Upvotes: 5

Views: 28987

Answers (3)

Aileron79
Aileron79

Reputation: 937

Unfortunately, the error message is not really helpful. But adding a scope to the app registration solved the problem for me:

  • In Azure Portal navigate to App Registrations
  • Find your app, in the left side menu select Manage => Expose an API
  • Add a scope. I named mine api_access as this was where this error occurred.

In my case I then got an API URI (like api://client-id/scope_name) which I used in my Angular app. Error message was gone.

Also, make sure that in the Enterprise Application you have created, under Manage => Properties, "Assignment required" and "Visible to users" is turned on.

Upvotes: 3

prakashrajansakthivel
prakashrajansakthivel

Reputation: 2042

Here is what I have finally done.

  1. I have registered an App in AD. and Exposed the API of that App.
  2. I have assigned System Assigned Managed Identity to the Function.
  3. In the local I am not able to request token because Azure CLI is not given consent.
  4. After deploying the application in Function my Function app can request a token using its identity.

Upvotes: 3

Rahul Shukla
Rahul Shukla

Reputation: 716

You need to register the application in azure ad and enable the access token. Once that is done the you need to provide RBAC access to your xxx.azurewebsites.net

enter image description here

Follow this article for the step by step documentation Microsoft Document Reference

Upvotes: 0

Related Questions